Sandbox environment for document preview and analysis
AssigneeSophos Limited
InventorsRoss McKerchar, John Edward Tyrone Shaw, Andrew J. Thomas, Russell Humphries, Kenneth D. Ray, Daniel Salvatore Schiappa
Life of this patent
Estimating the term…
Abstract
Attachments or other documents can be transmitted to a sandbox environment where they can be concurrently opened for remote preview from an endpoint and scanned for possible malware. A gateway or other intermediate network element may enforce this process by replacing attachments, for example, in incoming electronic mail communications, with links to a document preview hosted in the sandbox environment.
Claims21
A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:
- receiving an electronic mail communication addressed to an endpoint and containing a document as an attachment;
- adding a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in a sandbox environment from the endpoint by connecting the endpoint to a document preview rendered from the sandbox environment;
- communicating the electronic mail communication to the endpoint;
- receiving a request from the endpoint to open the document by detecting a selection of the link;
- forwarding the document to a sandbox environment, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering the document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint;
- and
- transmitting a presentation of the document from the sandbox environment, as opened within the sandbox environment, to the endpoint for display on a monitor of the endpoint.
A method for accessing a document sent as an attachment, the method comprising:
- transmitting an electronic mail communication to an endpoint, the electronic mail communication including a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in a sandbox environment from the endpoint by connecting the endpoint to a document preview rendered from the sandbox environment;
- receiving a request from the endpoint to open the document by detecting a selection of the link;
- forwarding the document to a sandbox environment, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering the document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint;
- and
- transmitting a presentation of the document from the sandbox environment, as opened within the sandbox environment, to the endpoint for display on a monitor of the endpoint.
A system for securing an endpoint against malware contained in documents opened on the endpoint, the system comprising:
- a computing device coupled to a network;
- a processor;
- and
- a memory bearing computer executable code configured to perform the steps of transmitting an electronic mail communication containing a document as an attachment to an endpoint, the electronic mail communication including a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in a sandbox environment from the endpoint by connecting the endpoint to a document preview rendered from the sandbox environment, receiving a request from the endpoint to open the document by detecting a selection of the link, forwarding the document to the sandbox environment, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering the document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint, and transmitting a presentation of the document from the sandbox environment, as opened within the sandbox environment, to the endpoint for display on a monitor of the endpoint.
A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on a gateway of an enterprise network, performs the steps of:
- receiving an electronic mail communication containing a document as an attachment;
- removing the document;
- forwarding the document to a sandbox environment for interactive access from an endpoint, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering a document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint;
- adding a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in the sandbox environment from the endpoint by connecting the endpoint to the document preview rendered from the sandbox environment;
- and
- forwarding the electronic mail communication with the link to the endpoint.
Dependencies are inferred from the claim text.