US20090178131A1 - Globally distributed infrastructure for secure content management - Google Patents

Abstract

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities—such as anti-virus, spyware and phishing protection, firewall, intrusion detection, centralized management, and the like—that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence (“POPs”). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Description

STATEMENT OF RELATED APPLICATION
• This application claims the benefit of U.S. Provisional Patent Application Ser. No. 61/019,739, filed Jan. 8, 2008, entitled “Globally Distributed Infrastructure for Secure Content Management” the disclosure of which is incorporated by reference with the same effect as if set forth at length herein.
BACKGROUND
• Secure Content Management, or “SCM,” is a term that is commonly used to describe the functionality provided by security products and appliances that are utilized to protect the IT (information technology) assets of an enterprise such as a business, company, or other organization. Such functionality can include, for example, filtering network traffic into and out of the enterprise for malicious code such as viruses and worms, limiting access to inappropriate external content on the Internet from inside the enterprise, and preventing attacks and other intrusions on the enterprise network. SCM can also reduce the vulnerability of the enterprise to client-side exploits, spam e-mail, and phishing schemes where valuable and/or confidential information can be stolen.
• Enterprises will often implement security policies that govern asset utilization to meet their particular business needs. These policies typically cover how information in the enterprise is handled, who may access information, what kinds of information may be accessed and when that information may be accessed, permissible and impermissible behaviors, auditing practices, and the like.
• SCM can generally provide excellent protection against known and unknown Internet-borne threats for IT assets that are located within the perimeter of the enterprise. However, many enterprises are increasingly utilizing mobile IT assets such as laptop computers having, for example, Wi-Fi or other network connectivity functionality. Portable computing devices like smartphones, which may support both voice and wireless data communication features such as e-mail, are also seeing widespread usage.
• Existing SCM solutions typically require roaming users to connect back to their company's enterprise network in order to access the Internet. This is often impractical if the roaming user is not close to the enterprise network because of the high latency that would typically be experienced or for other reasons, such as lack of support for localization of the user experience. As a result, roaming users and other users outside the enterprise network may utilize Internet access provided by Internet service providers (“ISPs”) and use public points of access such as Wi-Fi “hotspots” where security protection may not be as comprehensive as protection provided in the enterprise network. This can be a drawback to existing SCM solutions because such mobile IT assets can become vulnerable to security threats, and are not subject to the enforcement of the company's security policies when operated outside the premises of the protected enterprise network. In addition, while SCM currently provides comprehensive security solutions for business-based users, SCM solutions for the consumer market have not been developed with the same level of effectiveness.
• This Background is provided to introduce a brief context for the Summary and Detailed Description that follow. This Background is not intended to be an aid in determining the scope of the claimed subject matter nor be viewed as limiting the claimed subject matter to implementations that solve any or all of the disadvantages or problems presented above.
SUMMARY
• Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities—such as anti-virus, spyware and phishing protection, firewall, intrusion detection, information leakage prevention, centralized management, and the like—that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence (“POPs”). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration/optimization components, and coupled to hubs which provide configuration management and identity management services such as active directory services.
• The POPs can be distributed on a large scale basis to ensure that users can access the global SCM service virtually anywhere using a co-located POP. Such co-location, where the POP is relatively close to the global SCM service user, enables a high quality user experience with low network latency, while simultaneously providing for localization of the experience so that accessed resources, such as web pages, are appropriately supported in terms of language, characters sets, currency, time zone, and other localization criteria.
• The global SCM service advantageously provides for securing every interaction (e.g., every “click” of a mouse or pointing device) with resources on the Internet regardless of the user's location. The same level of protection, quality of security, and security policies can be applied to all enterprise IT assets, both on-premise and mobile, in exactly the same way. In addition to extending protection beyond the boundaries of the enterprise network, in some implementations, by shifting the focus of security away from SCM appliances to one supported by a service model, the size of the vulnerability window is reduced as malware signatures may be identified and deployed to the POPs quickly. In addition, total costs of ownership can often decrease and deployment of the SCM security solution across all IT assets is simplified when utilized as a service, and bandwidth consumption on target resource servers is reduced because the global SCM service load balances users across the POPs and can also filter traffic to the servers through policy enforcement.
• In various illustrative examples, the global SCM service is arranged to support consumer users who desire to use cloud-based security protection. The global SCM service can protect the consumer's networkable computing devices that may be located in the home, outside the home while roaming, for example at a Wi-Fi hotspot at a public library or shopping center, or outside the home when a family member takes a laptop away to college. In all these scenarios, user preferences, parental controls, and other options can be maintained by the global SCM service, irrespective of where the devices are located, much like policies in a business setting can be enforced. In addition, the global SCM service provides comprehensive security protection against malware, hackers, and other threats.
• A secure search service may be supported by the global SCM service. In this example, the service can check or clean links to the web pages returned as search results to frustrate hackers or spammers who artificially boost rankings of their sites in an attempt to draw users to them.
• In cases where a user experience with an Internet-based resource such as a website requires a particular resource that a user does not have on the user's local IT device or may be prohibited from using it locally due to policy restrictions, the global SCM service can provide the resource on a POP. For example, a user may not have a current version of a needed word processing application on the user's local laptop computer, or policy prevents a word processing document from opening on the laptop due to concerns for macro viruses. The global SCM may be arranged to open the document at the POP and render the user interface to the document using a Microsoft Terminal Services session, HTTP (HyperText Transfer Protocol) rendering, or other remote application deployment.
• The global SCM service may implement an enterprise security assessment sharing (“ESAS”) arrangement in which a semantic abstraction, called a security assessment, is created to enable sharing of security-related information among different ESAS-enabled security endpoints in a POP, or among ESAS-enabled endpoints in different POPs that are deployed with the SCM service. The security assessments existing in the environment function to provide a security context that gives an ESAS-enabled endpoint with a new way to look at its own locally-available information. The security context enables an ESAS-enabled endpoint to combine or correlate evidence from security assessments received from a variety of different sources, and across object types, in order to significantly enhance the quality of its detection of potential security incidents and reduces the level of false-positive and false-negative identifications of security incidents in the enterprise network. The global SCM service can thus extend the advantages and benefits of ESAS to users who are outside the enterprise network while also increasing the number of ESAS-enabled endpoints that are available to detect potential security threats.
• In addition to security functionality, the global SCM service may be arranged for user-profiling where user clicks captured by SCM service enable the generation of user profile. User-specific (or profile-specific) content or processes may then be selected and provided to the user based on the profile.
• The global SCM service may be provided under a variety of business models. For businesses, the global SCM service may be included in the purchase price of on-premise security solutions, or provided as attached service which complements the on-premise solution, typically on a subscription basis. For consumer users, the global SCM service may be integrated as a complementary offering to bundled security services that typically provide anti-virus, anti-spyware, and firewall protection.
• This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
DESCRIPTION OF THE DRAWINGS
• FIG. 1 shows an illustrative business-computing environment in which the present global SCM service may operate;
• FIG. 2 shows an illustrative consumer-computing environment in which the present global SCM service may operate;
• FIG. 3 shows a physical architecture of an illustrative global SCM service which is configured to use a plurality of points-of-presence, hubs, and an operations center;
• FIG. 4 shows an illustrative logical architecture for the global SCM service;
• FIG. 5 shows details of illustrative access arrangements by which global SCM service client devices access the global SCM service;
• FIG. 6 is a flowchart of an illustrative method by which global SCM service client devices access the global SCM service;
• FIG. 7 shows an illustrative enterprise security assessment sharing (“ESAS”) arrangement in an enterprise network;
• FIG. 8 is a diagram of a first illustrative scenario in which a plurality of ESAS-enabled endpoints are coupled to a security assessment channel and a detected incident at one endpoint triggers responses at multiple other endpoints;
• FIG. 9 is a diagram of a second illustrative scenario in which a low fidelity security assessment is sent over the security assessment channel that triggers the generation of a new high fidelity assessment by a receiving ESAS-enabled endpoint which also performs cross-object mapping;
• FIG. 10 is a diagram of a third illustrative scenario that shows the targeted use of remediation techniques;
• FIG. 11 shows an illustrative arrangement in which an ESAS security assessment channel may be extended from an enterprise network using the global SCM service;
• FIG. 12 shows an illustrative extended ESAS architecture in which a local action is triggered in a POP in the global SCM service in response to a security assessment that is generated by an endpoint in the enterprise network;
• FIG. 13 shows an illustrative arrangement in which an ESAS architecture is locally implemented in one or more of the POPs in the global SCM service;
• FIG. 14 shows an illustrative arrangement in which an ESAS global security assessment channel is implemented among POPs in the global SCM service; and
• FIG. 15 shows an illustrative arrangement in which the global SCM service implements a profiling functionality where user-specific or profile-specific content is provided.
• Like reference numerals indicate like elements in the drawings. Elements in the drawings are not drawn to scale unless otherwise indicated.
DETAILED DESCRIPTION
• FIG. 1 shows an illustrative business-computing environment100 in which the presentglobal SCM service105 may operate. In this example, theglobal SCM service105 is provided using a “cloud-based” service paradigm. Here, the cloud is implemented as a network of services and connections that exist on theInternet109. Cloud-based services are anticipated to grow as a source of distributed and programmable services that may provide significant data, resources, software and functionality to users over publically accessible networks such as the Internet. Cloud-based services can be expected to provide significant benefits to users as the service operator can often provide a desired functionality more efficiently and at lower costs through specialization and economy of scale. In addition, by receiving a feature or function as a service, significant responsibilities for IT infrastructure, including acquisition, maintenance, and upgrades, can usually be shifted from a business organization or consumer to the service provider.
• Theglobal SCM service105 is described in more detail in the text accompanyingFIGS. 3 and 4.
• Clients to theglobal SCM service105 establish access, as indicated byreference numerals121_{1, 2 . . . N}, to theInternet109 in order to interact with cloud-basedresources115. These cloud-basedresources115 may include, for example, websites, FTP (file transfer protocol) sites, databases, libraries, and the like. As shown inFIG. 1, this interaction is facilitated by theglobal SCM service105.
• In this illustrative business-computing environment100, three sets of business-oriented users are shown:users121 in anenterprise network125 that generally use fixed IT assets; roamingusers132 using mobile IT assets; and, home-based and/or telecommutingusers135 that can use both fixed and mobile IT assets. The fixed IT assets typically include personal computers (“PCs”), hosts, workstations, and servers. Mobile IT assets may include networkable devices such as laptop PCs, pocket PCs, handheld computers, smartphones, portable e-mail clients like Research In Motion's Blackberry devices, mobile phones, PDAs (personal data assistants), and the like.
• Enterprise network users121 are subject tosecurity policies140 which govern the utilization of assets in theenterprise network125. In particular, thesecurity policies140 are typically enforced, at least in part, by one ormore security appliances145 which are also commonly called security gateways which function as network “endpoints” that operate within theenterprise network125. The security policies typically govern which users may access information, what kinds of information may be accessed and when, permissible and impermissible behaviors, auditing practices in the enterprise, etc.
• Theappliances145 may include, for example, security products that monitor, assess, and take action with respect to different parts of security-related data within the enterprise. For example, theenterprise network125 may utilize a combination of security products such as a product that protects host computers in the enterprise, an edge firewall product, a network intrusion detection system (“NIDS”) product, a network access protection (“NAP”) product, one or more specialized line-of-business security gateways, information leakage protection gateways, and other discrete security products in order to provide security for the various different parts of theenterprise network125.
• A commercial example of the host security product is a unified threat management product such as the Microsoft Threat Management Gateway (“TMG”) product which provides unified malware protection for the enterprise's desktops, laptops, and server operating systems. An edge firewall is a security product that is arranged to protect theenterprise network125 from Internet-based threats while providing users with remote access to applications and data. The edge firewall may be embodied by, for example, a Microsoft Internet Security and Acceleration® (“ISA”) server. The NAP security product performs computer health policy validation by ensuring ongoing compliance with health policies defined by an administrator. Typically, access is restricted for computers monitored by the NAP security product that do not comply with system health requirements. The NIDS security product analyzes traffic. The NIDS security product operates to detect malicious activity such as denial of service attacks port scans by monitoring network traffic inside theenterprise network125. The line-of-business security products protect various line-of-business applications including, for example, an e-mail application such as Microsoft Exchange® that is used in the enterprise to provide anti-virus and anti-spam protection.
• Other security products145 that may typically be utilized in theenterprise network125 include web application protection products, UTM (Unified Threat Management) products, SEM/SIM (Security Event Management/Security Incident Management) products, and operational heath monitoring and configuration management products (e.g., Microsoft Windows® Software Update Services).
• Also operating in theenterprise network125 are an identity management service152 (e.g., Microsoft Active Directory) and anoperations management console155. Theoperations management console155 may be implemented, for example, using the Microsoft Operations Manager (“MOM”) to provide event-driven operations monitoring, performance tracking, security policy enforcement, and auditing capabilities. In many implementations theoperations management console155 will be connected to a corresponding functionality that is based in the global SCM service to enable a unified management experience that extends across the local and cloud-based security functionalities.
• In the present global SCM service arrangement, the security functionality provided by thesecurity appliances145 may be supplemented or replaced by security functionality enabled through theglobal SCM service105. The particular balance between local and cloud-based security functionality for a given enterprise network can be selected to meet the needs of that particular implementation.
• FIG. 2 shows an illustrative consumer-computing environment200 in which the presentglobal SCM service105 may operate. There are three sets of consumer users in this example who seek to access, as indicated by reference numerals212_{1, 2 . . . N}, cloud-basedresources215 such as websites on theInternet109,consumer users221 at home using fixed and mobile IT devices such as PCs, laptops, and smartphones; roamingconsumer users232 who may wish, for example, to surf the Internet to compare online pricing for a particular product while shopping at a shopping center; and consumer users outside of thehome235 such as students who are using a family's laptop or smartphone while at a school or library.
• Currently, consumer users typically use host-based security applications such as PC-based firewalls and anti-virus products to provide security protection rather than rely on dedicated security appliances or endpoints that are commonly used in the business-computing environment100 (FIG. 1). By comparison, in the present consumer-computing environment200 shown inFIG. 2, such host-based security may be supplemented or replaced by security protection that is provided via theglobal SCM service105.
• As shown inFIG. 3, theglobal SCM service105 is configured with a multiplicity ofPOPs305_{1, 2 . . . N}that are distributed, in this example, over a comparatively large geographic area. As noted above, and described in more detail below in the text accompanyingFIG. 4, eachPOP305 integrates the security functionalities that are typically provided by theSCM appliances145 in theenterprise network125 into a cloud-based service. Using a multiplicity ofPOPs305 in such a distribution enables diversely-located users of the service to be served by a POP that is substantially co-located. The term “co-location” as used here means that a given POP is close enough to the user to provide a degree of optimization of network operations, to minimize latency for example, while also providing for appropriate localization of the user experience.
• In this example, theglobal SCM service105 is configured to serve multiple users and user types, including both the business-based and consumer users shown respectively inFIGS. 1 and 2. In alternative configurations, it may be desirable to haveSCM service105 serve only a specific user type, or otherwise be tailored to that user type. Users reach theglobal SCM service105 by accessing theInternet109, as indicated by reference numerals312_{1, 2 . . . N}.
• In most implementations of the present global SCM service two ormore POPs305 will be distributed over an area or region that is large enough that a single POP would not provide satisfactory network performance or localization. That is, as the distance to a POP increases, network latency typically increases. In addition, as each POP uses forward proxy servers, it can become difficult to maintain appropriate localization of the user experience when, for example, a user is located in one country while the POP is located in another. Accordingly, the term “global” as used here refers tomultiple POPs305 that are distributed to serve multiple local areas. However, the term does not necessarily imply worldwide or unlimited coverage in all implementations. The size of the footprint for the distribution ofPOPs305, the number of POPs utilized, and their geographic location may vary to meet the requirements of a particular implementation.
• ThePOPs305 are backed by hubs315_{1 . . . N}that provide additional functionality and support for theglobal SCM service105. Typically, the hubs315 will be deployed in fewer numbers compared with thePOPs305 so that each hub will support multiple POPs. While the precise ratio of POPs to hubs can be expected to vary according to the needs of a specific implementation, in a typical large-scale roll out, if hundreds of POPs are utilized, then perhaps dozens of hubs could be deployed. Anoperations center322 is also utilized in theglobal SCM service105. While a single operations center is shown inFIG. 1, this is merely illustrative, as more than one operations center may be utilized depending upon the requirements of a specific application of the present arrangement.
• FIG. 4 is alogical architecture400 for theglobal SCM service105 that shows details of thePOPs305, hubs315, andoperations center322. EachPOP305 supporting theglobal SCM service105 is typically configured to include a suite of security appliances or products410_{1, 2 . . . N}. While the particular mix of security products410 can vary by implementation, typically they will replicate the security functionality provided by similar products that are deployable in an enterprise network (e.g., enterprise network125). For example, the security products410 may include a host security product (e.g., a TMG gateway), an edge firewall, a NIDS product, a NAP product, and one or more specialized security products for typical line of business applications such as e-mail. In addition, UTM, SEM/SIM, information leakage prevention, and operational health monitoring and configuration management products may also be utilized where required. Althoughmost POPs305 will be similarly configured, there is no requirement that the identical mix of security products410 be utilized in each and every POP.
• In this example, eachPOP305 includes a Microsoft ISA server412 that provides integrated firewall, forward proxy, and network performance enhancement features. The firewall function includes, for example, HTTP application layer filtering to govern HTTP inbound and outbound access to the cloud-based resources115 (FIG. 1) according to rules or policies, as described below. URL (Universal Resource Locator) filtering and anti-virus functions may also be directly supported in the firewall. As a forward proxy, the ISA server412 stands in the way of theInternet109 and receives data from users bound for theInternet109 and forwards it on their behalf. The network performance features of the ISA servers412 include, among others, object caching, HTTP compression to eliminate redundant data during transmission of HTTP packets, and packet prioritization using quality of service (“QoS”) enforcement methodologies. Configuration and management information for the ISA servers412 are stored in the enterprise management system (“EMS”) servers414_{1 . . . N}in the hubs315.
• POPs305 are also configured to include policy databases416_{1, 2 . . . N}which contain security policies that govern access to, and interaction with, cloud-based resources by users of theglobal SCM service105. In accordance with the present cloud-based service paradigm, the policies can be tailored to specific users, and groups of users. Thus, for example, a company operating IT assets in the business-computing environment100 shown inFIG. 1 can duplicate its policies from itsown enterprise network125 onto theInternet cloud109 via theglobal SCM service105. The duplicated polices would then be enforced, for example, for roamingusers132 and home-based and/or telecommutingusers135 when they access the cloud-basedresources115 when outside the perimeter of theenterprise network125. In an alternative configuration, the policy databases416, or portions thereof, may be centralized within one or more of the hubs315, as indicated by the dashed lines. The policies in databases416 may also be managed by the EMS servers414 in the hubs. However, thePOPs305 will generally be configured to replicate all functionality necessary to implement security and policy enforcement in case a connection to a hub315 is broken.
• In this example, operations management consoles423_{1, 2 . . . N}are supported in thePOPs305. The functions provided by the consoles423 are essentially similar to those provided by their counterparts in theenterprise network125. Operation management consoles423 enable the security products410 and policies416 in aPOP305 to be configured, monitored, and audited according to an enterprise network administrator's instructions or service agreement with the enterprise. While supported in thePOPs305, the operations management consoles423 can typically be expected to be operated from the hubs315. In some implementations, the operations management consoles423 will either be solely deployed in the hubs, or replicated in the hubs so that the operations management functionality is replicated in both thePOPs305 and the hubs315. As noted above, the operations management console functionalities can be extended and unified to enable administrative functions to be performed on remote devices as if they were co-located on the premises of a given enterprise.
• In some implementations, the operations management functionalities, or subsets thereof, can be configured for remote access by administrators. In other implementations, operations management functionalities in thePOPs305 are reserved for use by global SCM service provider personnel.
• User-profiling426_{1, 2 . . . N}functions are also supported in thePOPs305. User-profiling426 is described in more detail below in the text accompanyingFIG. 15.
• Hubs315_{1 . . . N}may include active directory servers430_{1 . . . N}or other types of identity stores that support respective Active Directory and other identity management services for managing identities and relationships for users in the business-computing environment100 shown inFIG. 1. The Active Directory service enables, for example, user authorization and authentication, as well as single sign-on capabilities for cross-domain resource access. Typically, Active Directory data will be synchronized with theActive Directory server152 in theenterprise network125 to a hub315. In this case, synchronization between the servers can be implemented using a one-way or two-way trust arrangement to enable policies and reports, for example, to be expressed using the same user name and groups.
• Active Directory services may also be utilized to support authentication and authorization for users in theconsumer computing environment200 shown inFIG. 2 who use or subscribe to theglobal SCM service105. Alternatively, user and/or subscription information may be supported in subscriber databases435_{1 . . . N}in the hubs315 as required to implement identity management for theconsumer users450 of theglobal SCM service105 using for example, the Microsoft Live ID service (formerly known as Microsoft .NET Passport), or federated identification services.
• The hubs315 are supported by theoperations center322 which contains one ormore operations servers440 to facilitate the overall configuration, management, and monitoring of theglobal SCM service105 from a central location.
• FIG. 5 shows details of an illustrative access arrangement by which global SCM service client devices access theglobal SCM service105. Two illustrative arrangements are shown: one in which mobile device users access theInternet109 using a wirelessmobile data network515; and, the second in which Internet access is facilitated by anISP522. The methods are generally applicable to both users in the business-computing environment100 and consumer-computing environment200.
• In the first arrangement, roaming users are respectively using asmartphone525 andlaptop531 that uses an intermediate device such as a wireless PC card ormobile phone536, as shown, as a modem. The wireless mobile data network could be, for example, one of GPRS (General Packet Radio Service), EVDO (Evolution Data Optimized), or UMTS (Universal Mobile Telecommunications System). The devices wirelessly connect through anearby cell tower540 to thedata network515 to establish access to theInternet109 as indicated by reference numeral512₁.
• In the second arrangement, a roaminglaptop user543 establishes Internet access, as indicated by reference numeral512_N, through a public Wi-Fi hotspot which provides anetwork bridge548 to anetwork gateway550 operated by theISP522. A home-basedPC user554 on a local area network running Ethernet, for example, makes an Internet connection through anetwork bridge559 like a cable modem or DSL (digital subscriber line) connection to theISP gateway550. Although a single ISP and gateway are shown inFIG. 5, it is noted that the present global SCM service can work with any form of Internet access that a particular IT device or user employs. Accordingly, multiple different ISPs can be utilized depending on the requirements of a given implementation. ISPs commonly provide Internet access to both consumers and businesses, although the equipment, connection type, and service agreements for the service will typically vary.
• As shown in the flowchart shown inFIG. 6, in both access arrangements shown inFIG. 5, once an Internet connection is established (610), a user may access theglobal SCM service105 by pre-provisioning unified host name, for example HTTP://scmproxy.com (620). This host name is resolved, using a DNS (Domain Name System) lookup, to an IP (Internet Protocol) address (630) for a global load balancer (not shown in the drawings). The global load balancer ascertains the geographical location of the user (640) so that the user may be redirected (650) to the an appropriate POP305 (FIG. 3). It is noted that location may be one of several factors that may be utilized in determining to which particular POP a user is redirected. For example, restrictions imposed by licensing and other commercial considerations, security consideration, and other factors may also be used in various implementations.
• The location of the user may be determined in a variety of different ways. For users who gain Internet access using the wirelessmobile data network515 inFIG. 5, the location of the user can be determined by coordinates of thecell tower540. Alternatively, some mobile devices are equipped with GPS (Global Positioning System) features which can also be utilized to identify the location of a user.
• For users gaining access using an ISP, a number of techniques exist for identifying a geographical location of the user based on IP address supplied by the ISP. Typically, a geographical location at the country or region level may be readily determined by mapping the IP address to locations contained in a geo-location database. While location may be resolved with even more specificity (e.g., to the city or ISP), location accuracy typically falls off, and not all geo-location databases are complete and reliable for all locations in the world. However, accuracy is typically sufficient to redirect the user to aco-located POP305 for purposes of network optimization and localization.
• Another technique for locating a user based on IP address uses the LOC record for an ISP's server as described in RFC 1876 (Request for Comment by the Internet Engineering Task Force, or “IETF”). More particularly, location information of a server, including latitude and longitude is often placed on the DNS registration page. By performing a reverse DNS lookup, a server associated with a given IP address can be determined and the LOC record for that server retrieved. While not all servers have LOC records, this technique may still be useful in some implementations or to supplement other IP address geo-location techniques. However, it is noted that such techniques are intended to be illustrative and that other techniques and methods may also be used depending on the requirements of a particular implementation.
• Once redirected to an appropriate POP, the user is authenticated and authorized, for example using the Active Directory service (660), as described above, or via a Live ID service or federated identity management service. The user may then take advantage of the features and functionalities provided by theglobal SCM service105 including, for example, security, policy enforcement, and profiling which can be applied to every user interaction or “click” on the cloud-basedresources115 shown inFIG. 1 (670).
• An illustrative example in which an ESAS arrangement is implemented using the present global SCM service is now presented. In an enterprise computing environment, for example, an office of a business, a number of personal computers, workstations, servers and the like, along with other devices such as mass storage subsystems, internal network interfaces, and external network interfaces, are typically interconnected to provide an integrated environment in which information may be generated, accessed from external sources, and shared among various users. Commonly, users perform a variety of operations including order receipt, manufacturing, shipping, billing, inventory control, document preparation and management, e-mail, web browsing, and other operations in which creation, access, and sharing of data is beneficial.
• Currently, security is typically provided for an enterprise using a variety of different security products (e.g.,security products145 inFIG. 1) that are each normally arranged to monitor only a partial portion of enterprise-wide data. That is, security products are arranged as separate local “islands” where each product monitors, assesses, and takes action with respect to different parts of the data within the enterprise. For example, the host security product, edge firewall product, NIDS product, NAP product, and other discrete security products typically provide security for the various different parts of the enterprise.
• While these security products often perform satisfactorily in many applications, detection of security incidents often suffers from undesirably high levels of false-positive and false-negative occurrences as a result of the monitoring of only partial enterprise security data. It has also been difficult to provide effective common management across all the enterprise security product islands. Current attempts to correlate enterprise-wide security data have high management and maintenance costs and have problems in scaling. Accordingly, ESAS provides a single enterprise-wide view to enable security administrators to define and enforce clear, simple, and unified enterprise-wide policies for automatic responses to security incidents.
• As noted in the Summary section above, ESAS relies upon a semantic abstraction, called a security assessment that enables sharing of security-related information between different security products, called endpoints, in an enterprise security environment. A security assessment is defined as a tentative assignment by an endpoint of broader contextual meaning to information (i.e., data in some context) that is collected about an object of interest in the environment such as a computer, user, service (e.g., a website), data, or the enterprise as a whole. The security assessment utilizes a concise vocabulary for an endpoint to declare that an object in the environment falls into a particular assessment category such as “compromised” or “under attack” along with the severity (e.g., low, medium, high, critical) of the detected incident.
• A security assessment is tentative because it is subject to some uncertainty and is valid for a limited period of time. The tentative nature of a security assessment is reflected in two of its components: a fidelity field which expresses the level of confidence the endpoint has in its assignment of contextual meaning, and a time-to-live (“TTL”) field which reflects the endpoint's estimate of the time period for which the security assessment is expected to be valid. Thus, for example, a security assessment may be used by an endpoint to declare, in light of that endpoint's current understanding of one or more security incidents, that a particular machine is compromised, with a critical level of severity, with medium fidelity, and having a TTL of 30 minutes. A variety of types of security assessments may be used in any given enterprise security environment having, for example, various combinations of assessment category and object type.
• Endpoints are enabled with functionality to publish security assessments onto a security assessment channel operating in the environment, as well as subscribe to a subset of available security assessments published by other endpoints. The security assessments existing in the environment that are active (i.e., those having a TTL which indicates the assessments are still valid) function to provide a security context that gives such ESAS-enabled endpoint a new way to look at its own locally-available information. That is, the security context enables the ESAS-enabled endpoint to combine or correlate evidence from security assessments received from a variety of different sources, and across object types, in order to significantly enhance the quality of its detection of potential security incidents. The ESAS-enabled endpoint then makes a decision as to what local action or response is appropriate for each type of security assessment (whether received from another endpoint or internally generated by the endpoint itself) in accordance with a set of response policies. Incident detection is both efficient and cost-effective because the security context enables distributed processing of enterprise-wide information, in the form of security assessments, without the burden of sharing large amounts of raw data throughout the enterprise (most of which is completely irrelevant due to the lack of any context). ESAS-enabled endpoints are further arranged to roll-back the local action upon expiration of the security assessment that prompted the local action (i.e., when the security assessment exceeds the time-to-live specified in the TTL field).
• In most typical ESAS implementations, a specialized endpoint called an ESAS central server is utilized. The ESAS central server is coupled to the security assessment channel and performs as a centralized audit point by subscribing to all security assessments, logging the security assessments, and also logging the local actions taken by endpoints in response to security incidents in the environment. The ESAS central server provides administrators with a comprehensive view of the history and current status of the enterprise as a whole and of each ESAS-enabled endpoint. The utilization of the security assessments enables an administrator to compactly and efficiently configure response policies to incidents that are detected across the entire enterprise. The security assessments function as natural anchors, or starting points, to define enterprise-wide security response policies. A streamlined and consistent management interface is thus enabled to define the desired responses for each type of security assessment across the entire enterprise.
• The ESAS arrangement provides a number of advantages. By employing a security assessment having a concise vocabulary, overall data complexity in the enterprise is drastically reduced and only meaningful information is shared between endpoints. Use of the security assessment also eliminates the need to collect large amounts of raw data in a central storage location, and thereby enables highly scalable enterprise security solutions to be built on a very cost effective basis. In addition, a new endpoint may be readily deployed with on-demand extensibility. Security assessments may be shared between the new endpoint and existing endpoints without the need to reconfigure any of the response policies within existing endpoints. The new endpoint simply functions as a new source of security assessments using a semantic abstraction that the existing endpoints already understand. The utilization of security assessments also enables enterprise-wide security policies to be established using a very compact and clear methodology, without needing to understand all of the possible security events that every endpoint may generate in the enterprise, and then try to describe the responsive action for each event.
• Turning now toFIG. 7, anillustrative ESAS arrangement700 deployed in theenterprise network125 is shown in which asecurity assessment channel702 is provided to enable a security assessment to be shared among multiple endpoints using a language/protocol that is commonly-utilized at each endpoint. Thesecurity assessment channel702 facilitates a publish/subscribe model used by the endpoints for connecting the sources of security assessments (publishers) to the consumers of the security assessments (subscribers). As shown, both the publishers and subscribers on thesecurity assessment channel702 areendpoints705.
• Theendpoints705 are isolated from the mechanics of the actual transport and management of the publish/subscribe model through a semantic abstraction layer that is arranged to simplify interactions with thesecurity assessment channel702. The abstraction layer comprises tables describing the security assessment types to which the endpoints subscribe, and tables describing the security assessment types that endpoints publish (as described below, not all endpoints generally subscribe to all security assessment types). In addition, the abstraction layer provides an API (application programming interface) for reading received security assessments, and an API for generating security assessments.
• A specialized endpoint, ESAScentral server716, is coupled to thesecurity assessment channel702 and performs as a centralized audit point for theESAS arrangement700. Accordingly, the ESAScentral server716 subscribes to all security assessments and permanently logs them. ESAScentral server716 also receives and logs messages from the endpoints that indicate the local actions that are taken by an endpoint. The ESAScentral server716 thus provides administrators with security assessment monitoring functionality that gives a comprehensive view of the history and current status of the enterprise as a whole, and each ESAS-enabled endpoint.
• FIG. 8 is a diagram of a first illustrative scenario in which a plurality of ESAS-enabled endpoints are coupled to thesecurity assessment channel702, and a detected incident at one endpoint triggers responses at multiple other endpoints. This illustrative scenario is described in three stages. As indicated byreference numeral810, theedge firewall705₂first identifies a potentially compromised client, for example, because it creates so many connections to the perimeter network that the most likely explanation for the behavior is the existence of a security compromise. Second, theedge firewall705₂sends a security assessment that indicates the particular client is “compromised” with high severity and high fidelity, as indicated byreference numeral820, over thesecurity assessment channel702 to subscribing endpoints.
• Third, the subscribingendpoints705_{1, 2, 3 . . . N}and the ESAScentral server716 which receive the security assessment apply their specific security expertise through the application of their own correlation rules and locally-available data to trigger an appropriate action. As collectively indicated byreference numeral830 inFIG. 8, thehost security endpoint705₁performs an on-demand scan. TheNAP endpoint705₃revokes the IP security certificate for the identified compromised client and implements a port shutdown. The line-of-business security endpoint705_Ntemporarily suspends instant messaging (“IM”) traffic to the compromised client based on the received security assessment. The ESAScentral server716 raises an alert for a security analyst (e.g., an administrator) and also logs all of the security assessments and actions invoked.
• The first illustrative scenario described above provides a case where the endpoint detecting the suspicious incident generates a security assessment with high severity and high fidelity (i.e., the endpoint has a high degree of confidence that it has validly detected a serious incident). By comparison,FIG. 9 is a diagram of a second illustrative scenario in which a low fidelity security assessment is sent over thesecurity assessment channel702 that triggers the generation of a high fidelity assessment by a receiving endpoint which also performs cross-object mapping.
• This second illustrative scenario is also described in three stages. As indicated byreference numeral910, theedge firewall705₂first detects a large number of client connections to the perimeter network112 (FIG. 1). However, unlike the first illustrative scenario shown inFIG. 8 and described in the accompanying text, the number of connections being established by the client is not so high that theedge firewall705₂can be absolutely certain that the client has been compromised. In current enterprise security systems, when an endpoint sees such data it generally just drops the data and takes no action as there is not enough evidence to warrant the typically harsh response such as disconnecting the machine. By comparison, in the present scenario, theedge firewall705₂in the second stage sends asecurity assessment915 over thesecurity assessment channel702 that indicates that the particular client is compromised with medium severity and low fidelity, as indicated byreference numeral920.
• Here, the subscribing endpoints to the particular object referenced in thesecurity assessment915 generated by theedge firewall705₂include thehost security endpoint705₁and the ESAScentral server716. While such a low fidelity data normally does not trigger an action to be taken at an endpoint in current security products, in accordance with the present enterprise security assessment sharing, thehost security endpoint705₁looks at its own local data differently in light of the received security assessment from theedge firewall705₂. In this case, the local data resulting from an on-demand scan at thehost security endpoint705₁and the information contained in the security assessment from theedge firewall705₂are used to generatenew assessments925 and928. Thus, thehost security endpoint705₁has information that, by itself, does not warrant the generation of a new security assessment, but when reinforced with even a low fidelity assessment from another endpoint, as in this case, there is sufficient evidence to justify the creation of thenew security assessments925 and928 which each have high fidelity.
• Thehost security endpoint705₁places thenew security assessments925 and928 onto thesecurity assessment channel702. Thenew security assessments925 and928 are received over thesecurity assessment channel702 by the subscribing endpoints which, in this illustrative scenario, include theedge firewall705₂, and the ESAScentral server716 forsecurity assessment925 and line-of-business endpoint705_Nforsecurity assessment928.
• Note that the line-of-business endpoint705_Nwas not a subscriber to theoriginal security assessment915 produced by theedge firewall705₂because the reference object type is a machine and the line-of-business endpoint705_N, by virtue of its role in protecting e-mail, is typically concerned with the users. However, in this second illustrative scenario thehost security endpoint705₁maps from a host object type to a user object type when it generates anew security assessment928. Such cross-object mapping capability may be beneficial in many scenarios as it is contemplated that a high severity incident, such as malware or malicious activity that potentially compromises the data confidentiality or integrity of a host computer, may also potentially compromise the user as well. A security assessment may be generated that cross-maps the high severity incident from the host object type to a user object type with a certain degree of fidelity. Similarly, a critical severity incident in which malware or malicious activity has actually caused a loss of data integrity on a host computer, a security assessment for a user object type may be generated with even higher fidelity.
• In stage three, thenew security assessments925 and928 trigger a variety of respective actions at the receiving endpoints, as collectively indicated byreference numeral930. Specifically, theedge firewall705₂blocks all access by the compromised client with the exception of software updates and/or mission-critical access. The line-of-business endpoint705_Ntemporarily suspends outgoing e-mails. And, as with the first illustrative scenario, the ESAScentral server716 continues to log all assessments and actions. As noted above, such restrictions are enforced only during the period of time for which the TTL associated with thenew security assessments925 and928 remains valid. When the new security assessments expire, the actions taken by the respective endpoints are rolled-back unless the TTL is extended or a new security assessment which invokes the restrictive actions is received.
• FIG. 10 is a diagram of a third illustrative scenario that shows the targeted use of remediation techniques. This third illustrative scenario is described in three stages. As indicated byreference numeral1010, theedge firewall705₂first detects a large number of client connections to the perimeter network. Second, theedge firewall705₂sends asecurity assessment1015 that indicates the particular client is “compromised” with high severity and high fidelity, as indicated byreference numeral1020, over thesecurity channel702 to subscribing endpoints. The subscribing endpoints include thehost security endpoint705₁theNAP endpoint705₃and the ESAScentral server716.
• Thehost security endpoint705₁reviews the received security assessment and applies its specific security expertise using correlation rules and any relevant locally-available data. In this illustrative example, thehost security endpoint705₁responsively generates anew security assessment1025 containing a user object type to which the line-of-business security endpoint705_Nsubscribes.
• In the third stage of the scenario, the remediation techniques employed by the endpoints are considered expensive in terms of their potential impact on business operations within the enterprise100 (FIG. 1). For example, as indicated byreference numeral1030, the line-of-business security endpoint705_Nimplements a response policy that entails temporarily suspending outgoing e-mail. In addition, thehost security endpoint705₁performs an on-demand scan and if no results are achieved, performs a deep scan. While such remediation techniques can be very effective in addressing malware, malicious users, and other problems, they typically impart significant expense to the enterprise. For example a user whose outgoing e-mail is suspended will be less productive, and deep scanning typically requires one or more reboots which will remove the machine from service for a period of time.
• The ESAS arrangement advantageously enables these effective, albeit expensive, remediation techniques to be applied in a targeted manner and not merely in a general way or across-the-board which can be unjustified for some machines and/or users. Only objects in the environment that are deemed suspicious, using pre-defined criteria, will be subject to these particular remediation techniques.
• As shown inFIG. 11, theglobal SCM service105 may be advantageously utilized to optionally extend and expand theESAS security channel702 shown inFIGS. 7-10 and described in the accompanying text. In particular, the security assessment channel may be extended into the Internet cloud to couple to security endpoints (i.e., security products) that are located in thePOPs305 as indicated byreference numeral1105. WhileFIG. 11 shows thePOPs305_{1 . . . N}being coupled to the extended ESAS security channel1105, there is no requirement that each and every POP used in a particular implementation of theglobal SCM service105 be so coupled. In addition, it may also be possible to use a dedicated ESAS security channel that is not an extension from an existing ESAS security channel in an enterprise.
• Theglobal SCM service105 enables the extension of ESAS to include security assessments to be both sent and received by security endpoints that are located in thePOPs305. The enhanced security that ESAS provides can thus be applied to the enterprise's IT assets that are located outside the perimeter of theenterprise network125 including the home-based and/or telecommutingusers135 and roamingusers132. In addition, the ESAS system itself may be enhanced by increasing the number of deployed sensors that are available to detect potential security threats.
• In this illustrative example, the ISA server412₁inPOP305₁generates asecurity assessment1112 when it detects, for example, a potentially compromised laptop being operated by one of the roamingusers132. Thesecurity assessment1112 indicates that the laptop is “compromised” with high severity and high fidelity with a TTL value of 30 minutes. The security assessment is published into the extended ESASsecurity assessment channel1105 and received by the subscribingendpoints including endpoints705 and the ESAScentral server716 in theenterprise network125, as well as those in other POPs as indicated by the arrows inFIG. 11. Thesecurity assessment1112 will also typically be shared locally among endpoints in thePOP305₁over a locally deployed security assessment channel as shown in more detail inFIG. 13 and described in the accompanying text. Endpoints receiving thesecurity assessment1112 will take responsive local actions, perform cross-object mapping, implement targeted remediation, etc . . . as described above in the text accompanyingFIGS. 7-10, according to local response policies.
• As shown inFIG. 12, endpoints inPOPs305 may use the extendedESAS security channel1105 to subscribe to, and receive security assessments that are generated bysecurity endpoints705 in theenterprise network125. Here, anillustrative security assessment1212 is generated by theedge firewall705₂when a security incident affecting a computer in theenterprise network125 is detected. Thesecurity assessment1212 indicates that the computer is “compromised” with high severity and high fidelity with a TTL value of 30 minutes.
• Subscribing endpoints in theenterprise network125 and in thePOPs305 receive thesecurity assessment1212 from thesecurity assessment channel702, as extended by theglobal SCM service105. In this example, in accordance with response policies, the host security products in theenterprise network125 andPOPs305 perform on-demand scans of the IT assets respectively used byusers121 in theenterprise network125, the home-based and/or telecommutingusers135, and the roamingusers132.
• FIG. 13 shows an illustrative arrangement in which an ESAS architecture is locally implemented inseveral POPs305 in theglobal SCM service105. A securityassessment sharing channel1302 enables security assessments, such as anillustrative security assessment1312, to be generated and shared by security endpoints410 according to the ESAS publish and subscribe model described above.
• In addition to being usable to complement the extended ESAS functionality described above in the text accompanyingFIGS. 11 and 12, the local ESAS arrangement may be used independently of ESAS implementations used in an enterprise network environment. For example, as shown inFIG. 13, multiple households or groups of consumer users1320_{1, 2 . . . N}are connected to theglobal SCM service105. Each household1320 can take advantage of ESAS by virtue of the comprehensive suite of security products in thePOP305 and the widespread distribution of sensors for detecting security incidents that accompanies the global scale of the SCM service.
• As the global SCM infrastructure is shared among the consumer user groups1320, and the individual households can be aggregated as ESAS clients, consumers gain the benefit of improved security incident detection and handling in a cost-effective manner. For example, a security incident detected affecting an IT device in one household1320₁can trigger a scan of IT devices in a second household1320₂. Without the aggregation provided through theglobal SCM service105 and the benefits of ESAS it allows, the IT devices in the second household might otherwise be vulnerable.
• In some implementations where an ESAS architecture is locally implemented in one ormore POPs305 in theglobal SCM service105, security assessments and local responses can take into account such factors or characteristics, for example, as demographics, user-profile, Internet use habits, or user-preferences. Such factors may provide additional security context or affect how a particular local response is implemented. In addition, consumers having similar characteristics may be grouped for purposes of security assessment generation and sharing so that security detection and responses are well tailored to meet particular consumer needs.
• The ESAS architecture that is locally implemented in a POP as shown inFIG. 13 may also be extended to other POPs in theglobal SCM service105, as shown in FIG14. In this illustrative example, a globalsecurity assessment channel1402 is established between two ormore POPs305. Security assessments, such as anillustrative security assessment1412, may be generated and shared among security endpoints410 indifferent POPs305. Utilization of security assessments over the globalsecurity assessment channel1402 enables ESAS to be distributed among users1420_{1, 2 . . . N}over larger geographic area than is served by asingle POP305.
• FIG. 15 shows an illustrative arrangement in which theglobal SCM service105 implements a profiling functionality426 in one ormore POPs305 where user-specific or profile-specific content or processes are provided to users1520_{1, 2 . . . N}. The profiling functionality may be implemented as a complement to the security features described above, or in some applications be used independently or in combination with other features or services (such as Internet or web searching, for example).
• In this example, the user accesses and interacts with cloud-basedresources115 through theglobal SCM service105 as described above. Because each interaction or “click” is monitored by theglobal SCM service105 through thePOP305 as indicated byreference numeral1510, a user-profile for users of the service may be generated and stored. User-specific or profile-specific content may be responsively generated and provided to the user, as indicated byreference numeral1516. Such content and processes may include, for example, targeted advertising and search results, advanced caching such as pre-fetching on a personalized/user-profile basis, or personalized web-based experiences. By having the ability to see every user click on the Internet, more accurate user-profiles can be generated so that the provided content or processes are better suited to the specific user.
• Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims (20)

1. An infrastructure for providing a security protection service to an IT device, comprising:

a plurality of POPs, each POP including a suite of security products, each product in the suite arranged for providing one or more security functionalities, one of the security products comprising a forward proxy server for forwarding traffic from the IT device to resource servers on the Internet;

a hub operatively coupled to one or more POPs, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize a user of the IT device for the security protection service; and

a management operations center operatively coupled to the hub for implementing centralized management for the infrastructure, the centralized management including monitoring and auditing.

2. The infrastructure ofclaim 1 further including at least one of edge firewall, host security gateway product, NIDs security product, NAP security product, SEM product, SIM product, UTM product, operational health monitoring product, configuration management product, anti-virus product, anti-spyware product, anti-malware product, information leakage prevention, or anti-spam product among the security products in the suite.

3. The infrastructure ofclaim 2 further including an administrator console functionality in one or more of the POPs.

4. The infrastructure ofclaim 3 in which the security products in the suite are operated in response to security policies.

5. The infrastructure ofclaim 4 in which the securities policies are disposed in a database located in either a POP or the hub.

6. The infrastructure ofclaim 5 in which the user accesses the security protection service using a connection to the Internet.

7. A method for providing a security protection service for IT devices, the method comprising the steps of:

utilizing an infrastructure that is accessible by users from the Internet, the infrastructure including a plurality of POPs, each POP in the plurality including at least a forward proxy server for forwarding traffic from the IT devices to resource servers that are accessible on the Internet;

authenticating and authorizing users of the IT devices for the security protection service; and

securing user interactions to the resource servers using one or more security products located in the POP.

8. The method ofclaim 7 including a further step of monitoring clicks performed by the user on web content hosted by the resource servers

9. The method ofclaim 8 including a further step of generating a profile of the user based on the monitoring.

10. The method ofclaim 8 including a further step of providing content or processes to the user based on the profile.

11. The method ofclaim 10 in which the content or processes are personalized to the user.

12. The method ofclaim 11 in which the content or processes comprise one of advertising, search results, or web-based experience.

13. The method ofclaim 12 in which the search results are cleaned by the security protection service.

14. The method ofclaim 13 in which the security protection service is subscription based.

15. A method for providing a security protection service for IT devices, the method comprising the steps of:

utilizing an infrastructure that is accessible by users from the Internet, the infrastructure including a plurality of POPs, each POP in the plurality including at least a forward proxy server for forwarding traffic from the IT devices to resource servers that are accessible on the Internet;

authenticating and authorizing users of the IT devices for the security protection service;

redirecting a user to a co-located POP, a POP being co-located when a set of parameters is optimized including network latency compared with non-co-located POPs and localization of a user experience may be implemented; and

managing the forward proxy servers in the POPs using an enterprise management subsystem located in a hub that is coupled to one or more POPs

16. The method ofclaim 15 in which the securing is performed according to predefined security policies, at least a subset of such security policies being part of security policies pertaining to an enterprise.

17. The method ofclaim 15 including a further step of managing the security protection service through one or more centralized management centers, at least one of the centralized management centers being operatively coupled to the hub.

18. The method ofclaim 17 including a further step of performing network optimization in a POP, the network optimization including one of caching, HTTP compression, or QoS enforcement.

19. The method ofclaim 15 including a further step of redirecting a user to a co-located POP, a POP being co-located when network latency is minimized compared with non-co-located POPs and localization of a user experience may be implemented.

20. The method ofclaim 19 in which the localization is performed with at least one of language, time zone, currency, or character set.

Images