# US 2020/0401711 A1 · Dynamically Controlling Access to Linked Content in Electronic Communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401711 A1 - Document ID: US20200401711A1 - Status: Published application - Kind: A1 - Application number: 16/875,216 - Filed: 2020-05-15 - Published: 2020-12-24 - Earliest claimed: 2019-06-20 - Assignees: Proofpoint, Inc. - Applicants: Proofpoint, Inc. - Inventors: Conor Brian Hayes; Michael Edward Jones; Alina V. Khayms; Kenny Lee; David Jonathan Melnick; Adrian Knox Roston - Web page: https://patentgrep.com/patent/US20200401711A1 ## CPC - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/102: {Entity profiles} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/567: {using dedicated hardware} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06N 20/00: Machine learning - H04L 51/08: Annexed information, e.g. attachments - H04L 51/212: using filtering or selective blocking - H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/105: {Multiple levels of security} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0281: {Proxies} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Aspects of the disclosure relate to dynamically controlling access to linked content in electronic communications. A computing platform may receive, from a user computing device, a request for a uniform resource locator associated with an email message and may evaluate the request using one or more isolation criteria. Based on evaluating the request, the computing platform may identify that the request meets at least one isolation condition associated with the one or more isolation criteria. In response to identifying that the request meets the at least one isolation condition associated with the one or more isolation criteria, the computing platform may initiate a browser mirroring session with the user computing device to provide the user computing device with limited access to a resource corresponding to the uniform resource locator associated with the email message. ## Claims ### Claim 1 A computing platform, comprising: at least one processor; a communication interface; and memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: receive, via the communication interface, from a first user computing device, a first request for a first uniform resource locator associated with a first email message; evaluate the first request for the first uniform resource locator associated with the first email message using one or more isolation criteria; based on evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria, identify that the first request meets at least one isolation condition associated with the one or more isolation criteria; and in response to identifying that the first request meets the at least one isolation condition associated with the one or more isolation criteria, initiate a browser mirroring session with the first user computing device to provide the first user computing device with limited access to a first resource corresponding to the first uniform resource locator associated with the first email message. ### Claim 2 (depends on 1) The computing platform of claim 1, wherein receiving the first request for the first uniform resource locator associated with the first email message comprises receiving a request for an embedded link included in the first email message that was rewritten by an email filtering engine hosted on the computing platform to point to the computing platform instead of the first resource. ### Claim 3 (depends on 1) The computing platform of claim 1, wherein evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a file sharing site. ### Claim 4 (depends on 1) The computing platform of claim 1, wherein evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a potentially malicious site. ### Claim 5 (depends on 4) The computing platform of claim 4, wherein determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a potentially malicious site comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a potentially malicious site using a URL defense (UD) tool hosted on the computing platform. ### Claim 6 (depends on 1) The computing platform of claim 1, wherein evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a file having a predetermined file extension. ### Claim 7 (depends on 1) The computing platform of claim 1, wherein identifying that the first request meets the at least one isolation condition associated with the one or more isolation criteria comprises cross-referencing a data table identifying specific resources to be opened using browser mirroring. ### Claim 8 (depends on 1) The computing platform of claim 1, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: after initiating the browser mirroring session with the first user computing device to provide the first user computing device with limited access to the first resource corresponding to the first uniform resource locator associated with the first email message: scan the first resource using a live analysis service that is configured to analyze information received from the first resource while a user of the first user computing device is accessing the first resource and return an indication of whether the first resource is safe or malicious. ### Claim 9 (depends on 8) The computing platform of claim 8, wherein scanning the first resource using the live analysis service comprises scanning user-authenticated content received from the first resource after the user of the first user computing device is authenticated by the first resource. ### Claim 10 (depends on 8) The computing platform of claim 8, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: receive, from the live analysis service, an indication that the first resource is safe; and in response to receiving the indication that the first resource is safe from the live analysis service, provide a user-selectable option to break out of isolation. ### Claim 11 (depends on 8) The computing platform of claim 8, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: receive, from the live analysis service, an indication that the first resource is malicious; and in response to receiving the indication that the first resource is malicious from the live analysis service, store data captured from the first resource. ### Claim 12 (depends on 11) The computing platform of claim 11, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: in response to receiving the indication that the first resource is malicious from the live analysis service, provide the data captured from the first resource to a machine learning engine to train one or more machine learning models to recognize other malicious resources. ### Claim 13 A method, comprising: at a computing platform comprising at least one processor, a communication interface, and memory: receiving, by the at least one processor, via the communication interface, from a first user computing device, a first request for a first uniform resource locator associated with a first email message; evaluating, by the at least one processor, the first request for the first uniform resource locator associated with the first email message using one or more isolation criteria; based on evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria, identifying, by the at least one processor, that the first request meets at least one isolation condition associated with the one or more isolation criteria; and in response to identifying that the first request meets the at least one isolation condition associated with the one or more isolation criteria, initiating, by the at least one processor, a browser mirroring session with the first user computing device to provide the first user computing device with limited access to a first resource corresponding to the first uniform resource locator associated with the first email message. ### Claim 14 (depends on 13) The method of claim 13, wherein receiving the first request for the first uniform resource locator associated with the first email message comprises receiving a request for an embedded link included in the first email message that was rewritten by an email filtering engine hosted on the computing platform to point to the computing platform instead of the first resource. ### Claim 15 (depends on 13) The method of claim 13, wherein evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a file sharing site. ### Claim 16 (depends on 13) The method of claim 13, wherein evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a potentially malicious site. ### Claim 17 (depends on 16) The method of claim 16, wherein determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a potentially malicious site comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a potentially malicious site using a URL defense (UD) tool hosted on the computing platform. ### Claim 18 (depends on 13) The method of claim 13, wherein evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria comprises determining whether the first resource corresponding to the first uniform resource locator associated with the first email message is a file having a predetermined file extension. ### Claim 19 (depends on 13) The method of claim 13, wherein identifying that the first request meets the at least one isolation condition associated with the one or more isolation criteria comprises cross-referencing a data table identifying specific resources to be opened using browser mirroring. ### Claim 20 One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to: receive, via the communication interface, from a first user computing device, a first request for a first uniform resource locator associated with a first email message; evaluate the first request for the first uniform resource locator associated with the first email message using one or more isolation criteria; based on evaluating the first request for the first uniform resource locator associated with the first email message using the one or more isolation criteria, identify that the first request meets at least one isolation condition associated with the one or more isolation criteria; and in response to identifying that the first request meets the at least one isolation condition associated with the one or more isolation criteria, initiate a browser mirroring session with the first user computing device to provide the first user computing device with limited access to a first resource corresponding to the first uniform resource locator associated with the first email message.