RU2601162C1 - Method of using dedicated computer security service - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to means of computer security. Method comprises a intercepting a request from an user computer in a cloud safety service, including a public cloud service and private cloud service, private cloud service is within a corporate network; request parameters are determined from the user computer in the cloud service; policies of cloud service selection is determined, including the following parameters: date of the last updating the private cloud service; connected services types in the private cloud service; type of data transmitted in the request; traffic share; public cloud service is selected, if the policies of cloud service selection allow transmitting data outside a company, private cloud service is selected, if the policies of cloud service selection prohibit transmitting data outside a company; request is redirected from the user computer to a selected cloud service.

EFFECT: technical result is preventing transmitting confidential data of a company-client, using cloud security services of a company-computer security service provider.

1 cl, 6 dwg

Description

Technical field

The invention relates to antivirus technologies, and more specifically, to methods for using a dedicated computer security service.

State of the art

Currently, the so-called "cloud" technology (we will use this term without quotes below) is becoming more widespread. Cloud technologies provide remote access to computing resources or data without significant costs for the company's information infrastructure (cloud service client). As a rule, all that a client needs is to have a permanent Internet connection in order to gain access to the cloud service. There are several types of cloud services - private, public, hybrid. A private cloud service is designed for a specific company or group of people and, in fact, represents a dedicated network with resources, while a public cloud service provides access to its resources to all connected clients. A hybrid cloud service combines both of these approaches and allows you to more flexibly build the company's information infrastructure.

It is not surprising that manufacturers of antivirus software were also interested in cloud technologies, because due to the increase in the number of malicious programs and their distribution methods, there was a need for a new approach to protecting users than the constant release of antivirus databases, which in turn is not immune from possible errors, related to the lack of time for testing, as well as the ability of antivirus solution providers to hide the logic of decision-making in the cloud service.

One example of cloud technology in information security is Kaspersky Security Network (KSN). In short, the algorithm of its operation is as follows - the user sends a request to the cloud service to check an unknown file or link and receives a response in the form of the verdict “dangerous” or “safe”. Of course, the technology is much more complicated than the proposed option, its implementation options are described in patents US 7640589 or US 8732836.

However, cloud technologies may have a drawback due to the fact that corporate networks may use data (for example, data about an unknown file, such as a digital signature, size, name, etc.), the use of which by third parties may be prohibited, and the network administrator may prohibit the transfer of such data, or even more so, refuse to use such technology, as it may run counter to existing privacy policies in the organization, which are also called tsya DLP policy (Data Leak Prevention).

It is not surprising that in the light of such a problem, they began to offer solutions for data anonymization or more flexible configuration of the cloud service. For example, the application US 20120215898 discloses the principles of anonymization of the transmitted data, while making it possible to configure the service for a specific user. Nevertheless, the application does not disclose the principles of traffic filtering and anonymization except for the use of a unique user identifier.

In addition, in order to use anti-virus cloud technologies similar to KSN in corporate networks with requirements for checking transmitted data, a balance must be struck between the level of detection of malware and attacks (the quality of the provision of anti-virus services) and the level of secrecy (English privacy) associated with with verification of forwarded data.

An analysis of the prior art allows us to conclude about the inefficiency and, in some cases, the impossibility of using previous technologies, the disadvantages of which are solved by the present invention, namely, the method of using a dedicated computer security service.

Disclosure of invention

The technical result of the present invention is to prevent the transfer of confidential data to a client company that uses the cloud security services of a computer security service provider company.

Another technical result of the present invention in this case is to reduce the amount of data transmitted over the Internet from a client company that uses the cloud security services of a computer security service provider company.

According to one implementation option, a method for redirecting a request from a user’s computer to a public or private cloud service is proposed, while the user’s computer is located within the company’s network, which uses both public and private cloud services, the method itself contains the steps at which the request is intercepted from the user's computer to the cloud service, while the cloud service includes both public and private cloud services; determine the request parameters from the user's computer to the cloud service, while the request parameters include at least the type of data transmitted in the request; determine cloud service selection policies that include at least the following parameters: date of last update of the private cloud service; types of connected services in a private cloud service; type of data transmitted in the request; traffic quota; choose a public cloud service if certain cloud service selection policies allow data transfer outside the company, and choose a private cloud service if certain cloud service selection policies prohibit data transfer outside the company; redirect the request from the user's computer to the selected cloud service

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 illustrates an example of a computer interacting with a public cloud service of a computer security service provider (antivirus company).

FIG. 2 describes an option of a computer working on a network with a private cloud service of a computer security service provider (antivirus company).

FIG. Figure 3 describes the operation of a computer on a network with both private and public cloud services of a computer security service provider (antivirus company).

FIG. 4 illustrates an exemplary embodiment of connected service types.

FIG. 5 illustrates the method of operation of the present invention.

FIG. 6 is an example of a general purpose computer system within which the present invention can be implemented.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details necessary to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined in the scope of the attached claims.

We introduce a few terms to better understand the application material.

The computer security service provider is an antivirus company that offers access to its cloud-based security services (for example, Kaspersky Lab ZAO and the Kaspersky Security Network service).

Client company is a company that uses the cloud security services of a computer security service provider company.

A public cloud service is a cloud security service that is provided by a computer security service provider for client companies (for example, the Kaspersky Security Network can act as a public cloud service).

FIG. 1 illustrates an example of the interaction of a computer (which is located in the network of a client company) with a public cloud service of a computer security service provider (antivirus company). The anti-virus software (anti-virus software or simply anti-virus) sends a request from the user's computer 100 to analyze an unknown object (usually a file or link) via the Internet 110 to the public cloud service 120 of the anti-virus company. The request is analyzed using the internal logic of the cloud service, as a result of the analysis, a verdict is issued on the object (usually whether the object is malicious or not, but also the verdicts can determine the logic of application control, which restricts program access to computer resources), which is sent to computer side 100, where the antivirus uses the received verdict for further actions with the object. An example of such a service is Kaspersky Security Network ( https://securelist.ru/analysis/1422/antivirusny-j-prognoz-pogody-oblachno/ ). As already noted, the implementation of the KSN is described in patents US7640589 or US8732836.

However, as noted in the prior art, the public cloud service 120 may use data that represents a potential trade secret or is sent to it, which requires other options for the operation of such a service.

FIG. 2 describes an option of a computer working on a network with a private cloud service of a computer security service provider (antivirus company). In the framework of the proposed approach, in comparison with FIG. 1, a private cloud service 105 is added, which acts as a replacement for the public cloud service 120 of the antivirus company. Thus, the computer security service provider company provides a cloud service in the form of both a public cloud service 120 and a private cloud service 105. In this case, all requests from computer 100 go no further than private cloud service 105, which contains all (or the most necessary part for work) the internal logic of the public cloud service 120. Of course, communication with the public cloud service 120 via the Internet 110 still remains, since there is a need for constant updating of the logic and data for operation (for example, anti-virus databases) of a private cloud service 105. However, due to a problem with the delay in updating (which is related to testing and distribution of the update), it may happen that a private cloud service 105 does not have the most up-to-date information on threats (like as a rule, this is the latest update of anti-virus databases) and there is a risk of missing an unknown malware program or detecting the executable file of a legitimate application as malicious (false positive). Thus, it is required to use a more flexible solution based on combining both private and public cloud services. The advantage of using a private cloud service 105 is the convenience of setting it up and, as a result, possibly the cheaper cost of use.

FIG. Figure 3 describes the operation of a computer on a network with both private and public cloud services of a computer security service provider (antivirus company). In contrast to FIG. 2, in this drawing, a decision module 125 is added, which determines where to send a request from computer 100 to either private cloud service 105 or public cloud service 120. The main criteria for choosing a cloud service are related to the following parameters (cloud selection policies service):

- The date of the last update of the private cloud service is 105. The more obsolete anti-virus databases are used by the private cloud service 105, the more likely it is that an unknown malicious program will be skipped or a false positive will be allowed.

- Types of connected services in private cloud service 105. The types will be discussed in more detail in FIG. 4, an example is the need to redirect a request to a public cloud service 120 due to the fact that the verification of objects of a certain type (for example, URL) is not supported within a private cloud service 105.

- Check the type of data transmitted. For example, the transfer of information on files of a certain format (for example, PDF files) may be prohibited by the privacy policy of a client company using both private cloud service 105 and public cloud service 120, as a result of which, a request to check such a file will be redirected to a private cloud service 105. The technical result of the present invention in this case is to prevent the transfer of confidential data of the client company.

- Traffic quota. In the event that there is a limit on the amount of data transferred to the public cloud service 120, upon reaching this limit all requests will be redirected to the private cloud service 105. Within other implementation options, it is possible to analyze each request from the side of the computer 100 for the amount of transmitted data, above which the request is redirected to the side of the private cloud service 105. The technical result of the present invention in this case is to reduce the volume of Let's Internet data, as in the case of a private cloud service 105 data transfer is carried out only within the client company.

We also note that decision-making module 125 can be implemented both as a separate client on the side of computer 100 and as a proxy server on the side of the Internet gateway of the client company of the antivirus company.

FIG. 4 illustrates an example embodiment of the types of connected security services that are used both in the public cloud service 120 and in the private cloud service 105. As an example of the connected security services, one can cite:

- File reputation service. The specified service allows you to determine whether an unknown file is malicious or not. In one embodiment, the service works by comparing the hash of the unknown by files with the hash of known malicious files. Additionally, the category of the file can be determined if it has been identified as legitimate (for example, the file may be classified as a browser).

- Reputation service links. This service allows you to determine whether an unknown link (URL) is malicious or not. In one embodiment, the service works by comparing the hash of an unknown link with the hash of known malicious links. In another implementation, either the entire link or its normalized value (for example, the site address or IP address) is compared. In addition, the category of the link can be determined if it was determined to be legitimate (for example, the link can be classified as online stores).

- Behavioral Discovery Service. The proposed service allows you to determine the harmfulness of an already running file based on the behavior of the process launched from this file. The mentioned process makes calls to system API functions, the call log of which can be compared with the call log of already known malicious processes. The implementation of such a technology is described in US Pat. No. 8,566,943.

- Certificate Reputation Service. A service that processes certificates of both sites and files to ensure that they are used by attackers. The implementation consists in sending the certificate and its metadata for analysis to the side of the computer security service provider company and is described in detail in patent US 8732472.

- False positive control service. This service allows you to test and revoke anti-virus signatures in case of false positives. The technology is described in more detail in patent US 8732836.

- Data transfer service. This service deals with file transfer using, for example, technologies such as P2P.

- Content filtering service. The proposed service is responsible for checking email messages for spam. The essence of his work is to create a hash sum (or a set of hash sums) from a letter (or its components) to compare it with a cluster of similar chem sums of other letters, while a large cluster of identical letters means spam mailing. The technology can be implemented in the same way as described in patent US 8738721.

- Parental control service. This service is responsible for checking the operation of the parental control module.

- Phishing service. This service allows you to detect possible phishing web pages and links (for example, in a browser).

The proposed services operate with various data (data of various types) - files, links, hash sums from various objects (such as the same files or links), as well as various metadata from the specified objects (size, creation time, type of object, etc. .). The administrator of the network where the computer 100 is located may impose various restrictions on the transmission of this data, which leads to the fact that some services will not work from the public cloud service 120, but rather use the private cloud service 105.

FIG. 5 illustrates the method of operation of the present invention. At step 510, a request is made from the user's computer 100 to the cloud service. It should be noted that on the side of computer 100 (more precisely, on the side of the anti-virus application installed on computer 100) there is no information about which service it is accessing at a particular moment — public 120 or private 105. At step 520, the acceptance module intercepts the request decisions 125. In one embodiment, the decision module 125 can be implemented as a proxy server on the Internet gateway side of the client company of the antivirus company. Another implementation option includes the presence of decision module 125 on the computer 100, and in this case there will be logic to determine which service should be accessed. Decision module 125 determines the parameters of the request at step 530 — to which security service it addresses, what data (more precisely, its type, for example, file, link, hash sum) transmits and / or requests and compares it with the established cloud selection policies service (more detailed policies are described in the framework of Fig. 3). If the politicians allow the request to be redirected to the side of the public cloud service 120, then the request is redirected in this direction at step 550, otherwise the request is redirected to the private cloud service 105 at step 540.

Here are examples of redirecting a request to various service options.

Example 1

The request from the user's computer 100 contains the type of data transferred (the format of the analyzed file is pdf), which is prohibited from being transferred outside the company by the cloud service selection policies. Private cloud service 105 will be selected.

Example 2

The request from the user's computer 100 exceeds the size of the established data transfer quota determined by the cloud service selection policies. Private cloud service 105 will be selected.

Example 3

The request from the user's computer 100 contains the permitted type of transmitted data (information about the Internet link), but the databases of the private cloud service 105 were updated more than 12 hours ago. 120 public cloud service will be selected.

FIG. 6 is an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating system using ROM 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 6. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims.

Claims (1)

A method of redirecting a request from a user's computer to a public or private cloud service, while the user’s computer is located within the company’s network, the method itself comprising the steps of:
a) they intercept the request from the user's computer to the cloud service, while the cloud service includes both public and private cloud services, while both cloud services are cloud security services provided by the computer security service provider company, and the private cloud service is located in company network;
b) determine the request parameters from the user's computer to the cloud service, while the request parameters include at least the type of data transmitted in the request;
c) determine the cloud service selection policies, which include at least the following parameters:
i. date of the last update of the private cloud service;
ii. types of connected services in a private cloud service, which include file reputation service, link reputation service, behavior detection service, certificate reputation service, false positive control service, data transfer service, content filtering service, parental control service, phishing service;
iii. type of data transmitted in the request;
iv. traffic quota;
d) choose a public cloud service if certain cloud service selection policies allow data transfer outside the company, and choose a private cloud service if certain cloud service selection policies prohibit data transfer outside the company;
e) redirect the request from the user's computer to the selected cloud service.

Images