US 11,082,445 B1Granted

Preventing phishing attacks via document sharing

AssigneeNetskope, Inc.

InventorsVenkataswamy Pathapati, Anupam Kumar, Prasenna Ravi, Muhammed Shafeek

Life of this patent

Estimating the term…

Loading patent…

Abstract

The technology disclosed includes a system and method for preventing phishing attacks caused by sharing documents with malicious content over a network, where the shared document may include links that redirect users to a malicious websites. The cloud-based method applies a set of rules and policies to allow the shared document or block the shared document from the network, based on identifying the ownership or originator of the shared document. Blocked documents are quarantined, analyzed for threats, and subjected to sandbox methods to determine malicious content that may compromise corporate data. If analysis proves the blocked document to be safe, it may be released into the network along with subsequent documents having the same ownership or originator. The technology disclosed is particularly useful where a malicious attacker creates a malicious file in a cloud-based store such a Google Drive and shares it with endpoint users. When users open the shared document, they are redirected to a malicious website where a corporation's critical data may be compromised.

Claims26

Dependent claims

A method for mitigating phishing attacks against a corporate network via sharing of linked document files from cloud-based applications accessible from the corporate network, wherein a linked document file may include links to malicious content, the method, applied repeatedly to multiple documents, comprising:

intercepting a linked document file, using an inline proxy, responsive to an Application Program Interface (API) access to accept sharing or to access the linked document via a cloud-based application accessible to the corporate network;
determining, for multiple documents, that the linked document is coming from outside the corporate network, and restricting the multiple documents that are coming from the outside, and further processing the restricted documents, including;
determining, for at least one first document, that the linked document is a sanctioned document from a trusted source and allowing the linked document into the corporate network;
determining, for at least a one second document, that the linked document is an unknown or unsanctioned document not from a trusted source, identifying the ownership of the document, and applying a policy rule based on ownership, which determines if the linked document will be allowed into the corporate network or quarantined, further including;
threat scanning the content of the linked document for malicious links;
for at least one third document, blocking the linked document that contains malicious links;
and
for at least one fourth document, accepting the linked document that does not contain malicious links, logging by the Globally Unique Identifier (GUID) the ownership of the accepted document file, and allowing the document file access to the corporate network and continued access based on at least the same GUID.

5 more elements

A system for mitigating phishing attacks against a corporate network via sharing of linked document files from cloud-based applications accessible from the corporate network, wherein a linked document file may include links to malicious content, the system comprising:

a network security system in operative communication with the corporate network, the security system comprising an evaluation engine, a network policy store, a threat scanner, and a sandbox;
an inline proxy in communication with the evaluation engine and a metadata store for intercepting the linked document file when it is being shared or accessed by a cloud-based application accessible to the corporate network;
the in-line proxy and the evaluation engine determining if the linked document file is coming from outside the corporate network and restricting document files coming from outside the corporate network, the system further processing the restricted documents, including;
the in-line proxy, evaluation engine, and metadata store determining, for at least one first document, that the linked document file is a sanctioned document from a trusted source and allowing the linked document into the corporate network;
the in-line proxy, evaluation engine, and metadata store determining, for at least a one second document, that the linked document is an unknown or unsanctioned document not from a trusted source, identifying the ownership of the document, and applying a policy rule based on ownership, which determines if the linked document will be allowed into the corporate network or quarantined, further including;
a threat scanner for scanning the content of the linked document for malicious links for at least one third document, blocking the linked document that contains malicious links;
and
for at least one fourth document, accepting the linked document that does not contain malicious links, the evaluation engine further logging by the Globally Unique Identifier (GUID) the ownership of the accepted document file;
and
allowing the document file access to the corporate network and continued access based on at least the same GUID.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/154,978Filed 21 Jan 2021
Granted: 3 Aug 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06F 16/93
Details of database functions independent of the retrieved data types: document management systems
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/0245
Filtering policies: filtering by information in the payload