Natively mounting storage for inspection and sandboxing in the cloud

Patent metadata

Field	Value
Publication number	US-2020089881-A1
Application number	US-201816132433-A
Country	US
Kind code	A1
Filing date	Sep 16, 2018
Priority date	Sep 16, 2018
Publication date	Mar 19, 2020
Grant date	—

Abstract

Systems and methods for continuously scanning and/or sandboxing files to protect users from accessing infected files by natively mounting public cloud file stores are provided. According to one embodiment, a determination is made by a network security device that is protecting the enterprise network regarding whether an untrusted file stored within a first repository of a public cloud file store, which is natively mounted on the network security device, is a clean file that is free of malicious content by applying one or more security checks to the untrusted file. When a result of the determination is affirmative, the network security device makes the clean file accessible to the users by copying the clean file from the first repository to a second repository that is accessible to the users.

First claim

What is claimed is:

1 . A secure data transfer system comprising:
a non-transitory storage device having embodied therein one or more routines operable to prevent users of an enterprise network from accessing malware infected files that stored within public cloud file stores; and one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines, wherein the one or more routines include:
an untrusted file processing module, which when executed by the one or more processors:
accesses an untrusted file stored within a first repository of a public cloud file store, wherein the public cloud file store is natively mounted on a network security device that is protecting the enterprise network and wherein the users do not have read access to the first repository of the public cloud file store; and
causes the network security device to make a determination regarding whether the untrusted file is a clean file that is free of malicious content by applying one or more security checks to the untrusted file; and
a clean file transfer module, which when executed by the one or more processors, makes the clean file accessible to the users by, when a result of the determination is affirmative, copying the clean file from the first repository to a second repository that is accessible to the users.

2 . The secure data transfer system of claim 1 , wherein the network security device is or comprises any or a combination of a sandbox device, a network controller, a firewall, a network gateway device, an Intrusion Prevention System (IPS), and an Intrusion Detection System (IDS).

3 . The secure data transfer system of claim 1 , wherein the network security device comprises a sandbox appliance, and wherein the one or more security checks comprise behavioral-based malware detection.

4 . The secure data transfer system of claim 1 , wherein the network security device comprises a virtual machine that is controlled by a sandbox appliance to determine whether the untrusted file is a clean file that is free of malicious content.

5 . The secure data transfer system of claim 1 , wherein the network security device copies the file to the second repository by sharing it by means of any or a combination of network file system (NFS), file transfer protocol (FTP), common Internet file system (CIFS), Internet Small Computer Systems Interface (iSCSI), Storage Area Network (SAN), and local storage.

6 . The secure data transfer system of claim 1 , wherein the untrusted file processing module further removes any malware from the untrusted file that is detected by the one or more security checks when the result of said determining is negative.

7 . The secure data transfer system of claim 1 , wherein the untrusted file processing module quarantines or deletes the untrusted file when the result of the determination is negative.

8 . The secure data transfer system of claim 1 , wherein the second repository is part of the network security device or part of an external storage device that forms part of the enterprise network.

9 . The secure data transfer system of claim 1 , wherein the second repository forms part of the public cloud file store.

10 . The secure data transfer system of claim 1 , wherein the public cloud file store is provided by a third-party cloud storage service provider.

11 . The secure data transfer system of claim 1 , wherein the network security device determines whether the untrusted file is a clean file that is free of malicious content based any or a combination of a file signature, a file hash, a file path, file attributes, a file source, file pre-scan parameters, a file extension, file content, and a file name, and any part thereof.

12 . The secure data transfer system of claim 1 , wherein the network security device makes said determination regarding whether the untrusted file is a clean file that is free of malicious content by first moving the untrusted file from the first repository to a third repository, and then applying one or more security checks to the untrusted file in the third repository, and moving back the checked file as a clean file into the first repository for onward copying to the second repository or moving the checked file as a clean file directly from the third repository to the second repository.

13 . A method comprising:
receiving, by a network security device that is protecting an enterprise network, a notification, via an Application Programming Interface (API) call from a notification service monitoring a first repository of a public cloud file store, regarding existence of an untrusted file stored within the first repository, wherein the public cloud file store is natively mounted on the network security device and wherein users of the enterprise network do not have read access the first repository of the public cloud file store; determining, by the network security device, whether the untrusted file is a clean file that is free of malicious content by applying one or more security checks to the untrusted file; and making the clean file accessible to the users by, when a result of said determining is affirmative, copying the clean file from the first repository to a second repository that is accessible to the users.

14 . The method of claim 13 , wherein the network security device is or comprises any or a combination of a sandbox device, a network controller, a firewall, a network gateway device, an Intrusion Prevention System (IPS), and an Intrusion Detection System (IDS).

15 . The method of claim 13 , wherein the network security device comprises a sandbox appliance, and wherein the one or more security checks comprise behavioral-based malware detection.

16 . The method of claim 13 , wherein the network security device copies the file to the second repository by sharing it by means of any or a combination of network file system (NFS), file transfer protocol (FTP), common Internet file system (CIFS), Internet Small Computer Systems Interface (iSCSI), Storage Area Network (SAN), and local storage.

17 . The method of claim 13 , wherein the file processing module further removes any malware from the untrusted file that is detected by the one or more security checks when the result of said determining is negative.

18 . The method of claim 13 , further comprising quarantining or deleting, by the network security device, the untrusted file when the result of said determining is negative.

19 . The method of claim 13 , wherein the second repository is part of the network security device or part of an external storage device that forms part of the enterprise network.

20 . The method of claim 13 , wherein the second repository forms part of the public cloud file store.

Assignees

• Fortinet Inc

Inventors

• Graun Jason
• Alverson Jesse

Classifications

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title