# US 9,882,928 B2 · Secure browsing via a transparent network proxy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,928 B2 - Document ID: US9882928B2 - Status: Granted - Kind: B2 - Application number: 15/353,174 - Filed: 2016-11-16 - Published: 2017-03-09 - Granted: 2018-01-30 - Earliest claimed: 2013-12-02 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Paul Giura; Jeffrey E. Bickford; Donald E. Hendrix; Howard F. Shirokmann; Thomas A. Anschutz; Ching C. Shih - Web page: https://patentgrep.com/patent/US9882928B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0281: {Proxies} - H04L 63/101: {Access control lists [ACL]} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for providing secure browsing via a transparent network proxy is disclosed. The system may receive, from a client, a request to access a resource. The request may include an identifier that may be utilized to locate the resource. Once the request is received, the system may determine if the resource is not trusted, such as if the identifier is determined to be unknown or suspicious. If the resource is determined to not be trusted by the system, the system may forward the request to a virtual machine manager that may select a browser virtual machine from a pool of browser virtual machines. After the browser virtual machine is selected, the browser virtual machine may stream a rendering of the resource to the client based on the request. The rendering of the resource may be provided in lieu of the actual resource. ## Claims ### Claim 1 A system, comprising: a non-transitory memory that stores instructions; a computer processor that executes the instructions to perform operations, the operations comprising: receiving, from a browser on a device, a request to access a resource; determining that the resource is not trusted based on an analysis of an identifier included with the request, wherein the resource is determined to not be trusted based on determining that the identifier has not been previously used; redirecting the browser on the client device to a browser virtual machine via a desktop virtualization technology connection; removing a virtual browser control bar from the browser virtual machine; filtering, by utilizing the browser virtual machine, malicious content from the resource; rendering strictly a viewable window of the browser virtual machine, wherein the viewable window includes a rendering of the resource; and streaming, after filtering the malicious content from the resource, the rendering of the viewable window of the browser virtual machine rendering the resource from the browser virtual machine to a viewable window of the browser on the client device based on the request, wherein controls in a control bar of the browser are utilized to control the browser virtual machine displayed within the viewable window of the browser. ### Claim 2 (depends on 1) The system of claim 1, wherein the operations further comprise forwarding, after determining that the resource is not trusted, the request to a virtual machine manager for selecting the browser virtual machine from a plurality of browser virtual machines. ### Claim 3 (depends on 1) The system of claim 1, wherein the operations further comprise selecting, by utilizing the virtual machine manager, the browser virtual machine from the plurality of browser virtual machines. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise determining that the resource is not trusted when the identifier or the resource is determined to be attempting to redirect the browser on the device to a malicious resource. ### Claim 5 (depends on 1) The system of claim 1, wherein the operations further comprise providing a warning to the device after determining that the resource is not trusted. ### Claim 6 (depends on 1) The system of claim 1, wherein the operations further comprise updating a blacklist to include the identifier after determining that the resource is not trusted. ### Claim 7 (depends on 1) The system of claim 1, wherein the operations further comprise downloading the resource. ### Claim 8 (depends on 1) The system of claim 1, wherein the operations further comprise providing the device with an option to securely access the resource. ### Claim 9 (depends on 8) The system of claim 8, wherein the operations further comprise receiving, from the device, a selection of the option to securely access the resource. ### Claim 10 (depends on 1) The system of claim 1, wherein the operations further comprise receiving feedback from the device. ### Claim 11 (depends on 10) The system of claim 10, wherein the operations further comprise determining that the feedback indicates that the determining that the resource is not trusted is not accurate. ### Claim 12 (depends on 11) The system of claim 11, wherein the operations further comprise trusting the resource based on the feedback. ### Claim 13 A method, comprising: receiving, from a browser on a device, a request to access a resource; determining, by utilizing instructions from a memory that are executed by a processor, that the resource is not trusted based on an analysis of an identifier included with the request, wherein the resource is determined to not be trusted based on determining that the identifier has not been previously used; redirecting the browser on the client device to a browser virtual machine via a desktop virtualization technology connection; removing a virtual browser control bar from the browser virtual machine; removing, by utilizing the browser virtual machine, malicious content from the resource; rendering strictly a viewable window of the browser virtual machine, wherein the viewable window includes a rendering of the resource; and streaming, after filtering the malicious content from the resource, the rendering of the viewable window of the browser virtual machine rendering the resource from the browser virtual machine to a viewable window of the browser on the client device based on the request, wherein controls in a control bar of the browser are utilized to control the browser virtual machine displayed within the viewable window of the browser. ### Claim 14 (depends on 13) The method of claim 13, further comprising replacing an original image of the browser virtual machine when the browser on the device is closed. ### Claim 15 (depends on 13) The method of claim 13, further comprising determining that the resource is trusted if the identifier has been previously used. ### Claim 16 (depends on 13) The method of claim 13, further comprising providing the device with an option to securely access the resource. ### Claim 17 (depends on 13) The method of claim 13, further comprising updating a blacklist to include the identifier after determining that the resource is not trusted. ### Claim 18 (depends on 13) The method of claim 13, further comprising determining that the resource is not trusted if the identifier or resource is uncategorized. ### Claim 19 (depends on 13) The method of claim 13, further comprising determining that the resource is not trusted if the identifier or resource is utilized less than a predetermined number of times. ### Claim 20 A non-transitory computer-readable device comprising instructions, which when loaded and executed by a processor, cause the processor to perform operations, the operations comprising: receiving, from a browser on a device, a request to access a resource; determining, by utilizing instructions from a memory that are executed by a processor, that the resource is not trusted based on an analysis of an identifier included with the request, wherein the resource is determined to not be trusted based on determining that the identifier has not been previously used; redirecting the browser on the client device to a browser virtual machine via a desktop virtualization technology connection; removing a virtual browser control bar from the browser virtual machine; filtering, by utilizing the browser virtual machine, malicious content from the resource; rendering strictly a viewable window of the browser virtual machine, wherein the viewable window includes a rendering of the resource; and providing, after filtering the malicious content from the resource, the rendering of the viewable window of the browser virtual machine rendering the resource from the browser virtual machine to a viewable window of the browser on the client device based on the request, wherein controls in a control bar of the browser are utilized to control the browser virtual machine displayed within the viewable window of the browser.