US 2019/0098020 A1 · SYSTEMS AND METHODS FOR COMMAND AND CONTROL PROTECTION

Abstract

A host computer system may be configured to connect to a network. The host computer system may be configured to implement a workspace and an isolated computing environment. The host computer system may be configured to isolate the isolated computing environment from the workspace using an internal isolation firewall. The internal isolation firewall may be configured to prevent data from being communicated between the isolated computing environment and the workspace, for example, without an explicit user input. The host computer system may be configured to implement one or more mechanisms that prevent malware received by the host computer system from receiving external communications from an external source. The one or more mechanisms may be configured to prevent control of the malware by the external source. The one or more mechanisms may be configured to prevent the malware from establishing a command channel with the external source.

Claims20

Dependent claims

A host computer system configured to connect to a network, wherein the host computer system comprises:

a memory;
and
a processor configured to:
implement a workspace, wherein the workspace is configured to enable operation of a first set of one or more applications or processes via a first memory space;
implement an isolated computing environment, the isolated computing environment being configured to enable operation of a second set of one or more applications or processes via a second memory space, the isolated computing environment configured to authenticate with an authorization device;
isolate the isolated computing environment from the workspace using an internal isolation firewall, the internal isolation firewall being configured to prevent data from being communicated between the isolated computing environment and the workspace without an explicit user input;
and
implement one or more mechanisms that prevent malware received by the host computer system from receiving external communications from an external source, the one or more mechanisms configured to prevent control of the malware by the external source.

5 more elements

A system comprising:

a local network having a first device and a second device connected thereto, the first device and the second device each configured to:
isolate, using an internal isolation firewall, an isolated computing environment from a workspace, the internal isolation firewall being configured to prevent data from being communicated between the isolated computing environment and the workspace without an explicit user input;
and
implement a host-based firewall configured to block incoming traffic;
an authorization device configured to:
receive authentication credentials from the isolated computing environment;
and
authenticate the isolated computing environment using the received authentication credentials;
a border firewall configured to prevent unauthorized communication between the local network and untrusted network destinations;
and
a proxy device configured to proxy communications between the untrusted network destinations and the respective authenticated isolated computing environments of the first and second devices,
wherein when malware is received by the first device or the second device, the system configured to implement one or more mechanisms that prevent malware received by the first device or the second device from receiving external communications from an external source, the one or more mechanisms configured to prevent control of the malware by the external source.

9 more elements

Dependencies are inferred from the claim text.

Systems and methods for command and control protection

Life of this patent

Systems and methods for command and control protection

Life of this patent

Abstract

Claims20