Content filtering of remote file-system access protocols

Patent metadata

Field	Value
Publication number	US-9825988-B2
Application number	US-201514825990-A
Country	US
Kind code	B2
Filing date	Aug 13, 2015
Priority date	Nov 22, 2005
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

Methods and systems for content filtering of remote file-system access protocols are provided. According to one embodiment, a proxy, implemented within a network gateway device of a private network, monitors remote file-system access protocol sessions involving client computer systems and a server computer system associated with the private network. For each file on a share of the server computer system being accessed by one or more of the client computer systems: (i) a shared holding buffer corresponding to the file is created within a shared memory of the network gateway device; (ii) data being read from or written to the file by the monitored remote file-system access protocol sessions is buffered into the shared holding buffer; and (iii) responsive to a predetermined event, content filtering is performed on the shared holding buffer to determine whether malicious, dangerous or unauthorized content is contained within the shared holding buffer.

First claim

What is claimed is:

1. A method comprising:
monitoring, by a proxy implemented within a network gateway device of a private network, remote file-system access protocol sessions involving one or more of a plurality of client computer systems and a server computer system associated with the private network; and
for each file of a plurality of files on a share of the server computer system being accessed by one or more of the plurality of client computer systems:
creating, by the proxy, a shared holding buffer corresponding to the file within a shared memory of the network gateway device that is accessible to a plurality of processes running within the network gateway device;
buffering, by the proxy, into the shared holding buffer data being read from or written to the file by the monitored remote file-system access protocol sessions; and
responsive to a predetermined event, determining, by the proxy, whether malicious, dangerous or unauthorized content is contained within the shared holding buffer by performing content filtering on the shared holding buffer.

2. The method of claim 1 , wherein the remote file-system access protocol comprises Server Message Block (SMB)/Common Internet File System (CIFS).

3. The method of claim 1 , further comprising tracking, by the proxy, usage and modification of each of the shared holding buffers with a corresponding usage table.

4. The method of claim 3 , wherein the usage tables contain information indicative of free and filled portions of respective shared holding buffers.

5. The method of claim 4 , wherein the predetermined event comprises the shared holding buffer reaching a predetermined or configurable fullness threshold.

6. The method of claim 1 , further comprising when a result of said determining is affirmative, restoring, by the proxy device, the file on the server computer system from a clean copy of the file maintained in a shadow buffer within the memory of the network gateway device.

7. The method of claim 1 , further comprising tracking a number of file identifiers currently referencing the file by:
when a remote file-system access protocol command observed by the proxy represents a command to open the file, then incrementing, by the proxy, a reference count of the shared holding buffer; and
when the remote file-system access protocol command represents a request to close the file, then decrementing, by the proxy, the reference count.

8. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network gateway device, logically interposed between a plurality of client computer systems associated with a private network and a server computer system associated with the private network, cause a proxy implemented within the network gateway device to perform a method comprising:
monitoring remote file-system access protocol sessions involving one or more of the plurality of client computer systems and the server computer system; and
for each file of a plurality of files on a share of the server computer system being accessed by one or more of the plurality of client computer systems:
creating a shared holding buffer corresponding to the file within a shared memory of the network gateway device that is accessible to a plurality of processes running within the network gateway device;
buffering into the shared holding buffer data being read from or written to the file by the monitored remote file-system access protocol sessions; and
responsive to a predetermined event, determining whether malicious, dangerous or unauthorized content is contained within the shared holding buffer by performing content filtering on the shared holding buffer.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the remote file-system access protocol comprises Server Message Block (SMB)/Common Internet File System (CIFS).

10. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises tracking usage and modification of each of the shared holding buffers with a corresponding usage table.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the usage tables contain information indicative of free and filled portions of respective shared holding buffers.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the predetermined event comprises the shared holding buffer reaching a predetermined or configurable fullness threshold.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises when a result of said determining is affirmative, restoring the file on the server computer system from a clean copy of the file maintained in a shadow buffer within the memory of the network gateway device.

14. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises tracking a number of file identifiers currently referencing the file by:
when a remote file-system access protocol command observed by the proxy represents a command to open the file, then incrementing a reference count of the shared holding buffer; and
when the remote file-system access protocol command represents a request to close the file, then decrementing the reference count.

Assignees

• Fortinet Inc

Inventors

• Crawford William Jeffrey

Classifications

• G06F16/00

  Information retrieval; Database structures therefor; File system structures therefor · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L67/289

  Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network · CPC title