Detection and prevention of hostile network traffic flow appropriation and validation of firmware updates

Patent metadata

Field	Value
Publication number	US-2023208854-A1
Application number	US-202318178177-A
Country	US
Kind code	A1
Filing date	Mar 3, 2023
Priority date	Dec 1, 2015
Publication date	Jun 29, 2023
Grant date	—

Abstract

Aspects of the present disclosure relate to systems and methods for partitioning an OS or hypervisor utilized on a computing device from the process of proxy control. For example, a proxy may be installed on a separation kernel or firmware on a computing device that routes all data traffic received via a network connection to a cloud which performs various services such as IP reputation management, URL reputation detection and validation, malicious file filtering through potential malware detection.

First claim

1 . A system, comprising:
a processor; and a non-transitory computer readable medium storing instructions for:
obtaining, by a computing device, a request for web content;
providing web request related data to a partitioned process that is executing on hardware of the computing device and is partitioned from an operating system of the computing device by utilizing a memory space unshared by the operating system and by executing without use of the operating system;
analyzing, utilizing the partitioned process, received web request related data;
modifying, utilizing the partitioned process, web request related data to remove malicious data from the web request related data; and
providing modified web request related data from the partitioned process to the operating system of the computing device for processing of the modified web request related data by the system.

2 . The system of claim 1 , wherein the partitioned process comprises firmware on hardware of the computing device or a separation kernel executing on hardware of the computing device.

3 . The system of claim 2 , wherein the partitioned process comprises a proxy adapted to send web request related data to a virus protection entity.

4 . The system of claim 3 , wherein the virus protection entity is adapted to perform the analyzing of web request related data.

5 . The system of claim 4 , wherein the virus protection entity is adapted to perform Uniform Resource Locator (URL) reputation validation and to provide web request related data to an external data provider associated with the web request related data based on the result of the URL reputation validation.

6 . The system of claim 5 , wherein the virus protection entity is adapted to receive web request related data from the external data provider, perform modification of the web request related data and pass modified web request related data to the proxy of the partitioned process.

7 . The system of claim 6 , wherein the modification is performed using Internet Protocol (IP) reputation validation, or file filtering.

8 . A method, comprising:
obtaining, by a computing device, a request for web content; providing web request related data to a partitioned process that is executing on hardware of the computing device and is partitioned from an operating system of the computing device by utilizing a memory space unshared by the operating system and by executing without use of the operating system; analyzing, utilizing the partitioned process, received web request related data; modifying, utilizing the partitioned process, web request related data to remove malicious data from the web request related data; and providing modified web request related data from the partitioned process to the operating system of the computing device for processing of the modified web request related data by the system.

9 . The method of claim 8 , wherein the partitioned process comprises firmware on hardware of the computing device or a separation kernel executing on hardware of the computing device.

10 . The method of claim 9 , wherein the partitioned process comprises a proxy adapted to send web request related data to a virus protection entity.

11 . The method of claim 10 , wherein the virus protection entity is adapted to perform the analyzing of web request related data.

12 . The method of claim 11 , wherein the virus protection entity is adapted to perform Uniform Resource Locator (URL) reputation validation and to provide web request related data to an external data provider associated with the web request related data based on the result of the URL reputation validation.

13 . The method of claim 12 , wherein the virus protection entity is adapted to receive web request related data from the external data provider, perform modification of the web request related data and pass modified web request related data to the proxy of the partitioned process.

14 . The method of claim 13 , wherein the modification is performed using Internet Protocol (IP) reputation validation, or file filtering.

15 . A non-transitory computer readable medium, comprising instructions for:
obtaining, by a computing device, a request for web content; providing web request related data to a partitioned process that is executing on hardware of the computing device and is partitioned from an operating system of the computing device by utilizing a memory space unshared by the operating system and by executing without use of the operating system; analyzing, utilizing the partitioned process, received web request related data; modifying, utilizing the partitioned process, web request related data to remove malicious data from the web request related data; and providing modified web request related data from the partitioned process to the operating system of the computing device for processing of the modified web request related data by the system.

16 . The non-transitory computer readable medium of claim 15 , wherein the partitioned process comprises firmware on hardware of the computing device or a separation kernel executing on hardware of the computing device.

17 . The non-transitory computer readable medium of claim 16 , wherein the partitioned process comprises a proxy adapted to send web request related data to a virus protection entity.

18 . The non-transitory computer readable medium of claim 17 , wherein the virus protection entity is adapted to perform the analyzing of web request related data.

19 . The non-transitory computer readable medium of claim 18 , wherein the virus protection entity is adapted to perform Uniform Resource Locator (URL) reputation validation and to provide web request related data to an external data provider associated with the web request related data based on the result of the URL reputation validation.

20 . The non-transitory computer readable medium of claim 19 , wherein the virus protection entity is adapted to receive web request related data from the external data provider, perform modification of the web request related data and pass modified web request related data to the proxy of the partitioned process.

21 . The non-transitory computer readable medium of claim 20 , wherein the modification is performed using Internet Protocol (IP) reputation validation, or file filtering.

Assignees

• Webroot Inc

Inventors

• Dufour David

Classifications

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/0281

  Proxies · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title