Systems and methods for cloud sandboxing with browser isolation for immediate content access

Patent metadata

Field	Value
Publication number	US-2024419780-A1
Application number	US-202318334200-A
Country	US
Kind code	A1
Filing date	Jun 13, 2023
Priority date	Jun 13, 2023
Publication date	Dec 19, 2024
Grant date	—

Abstract

Systems and methods include responsive to a user attempting to access content in a cloud-based system, obtaining the content associated with the user; sending the content to a sandbox for processing; rendering the content within an isolated browser, thereby allowing the user to interact with the content during the processing; and receiving a verdict from the sandbox, wherein the verdict labels the content as one of malicious, benign, and unknown, and performing an action based thereon.

First claim

What is claimed is:

1 . A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
responsive to a user attempting to access content in a cloud-based system, obtaining the content associated with the user; sending the content to a sandbox for processing; rendering the content within an isolated browser, thereby allowing the user to interact with the content during the processing; and receiving a verdict from the sandbox, wherein the verdict labels the content as one of malicious, benign, and unknown, and performing an action based thereon.

2 . The non-transitory computer-readable storage medium of claim 1 , wherein responsive to the verdict labeling the content as benign, allowing the user to download the content.

3 . The non-transitory computer-readable storage medium of claim 1 , wherein responsive to the verdict labeling the content as malicious, preventing the user from downloading the content, and providing the user a flattened version of the content.

4 . The non-transitory computer-readable storage medium of claim 1 , wherein prior to the receiving, the steps further comprise:
sending an Application Programming Interface (API) call to the sandbox to check a status of the processing.

5 . The non-transitory computer-readable storage medium of claim 4 , wherein the sandbox responds to the API call by indicating that the content is still under processing, and the steps further comprise:
waiting for a preconfigured time and repeating the API call until the sandbox responds with the verdict.

6 . The non-transitory computer-readable storage medium of claim 1 , wherein the content is password protected, and sending the content to the sandbox is performed responsive to the user providing the password through the isolated browser.

7 . The non-transitory computer-readable storage medium of claim 1 , wherein the content is an archive file, and the steps further comprise:
responsive to the user unarchiving the content in the isolated browser, sending dropped files to the sandbox for processing; and allowing the user to download one or more of the dropped files based on a verdict of each of the dropped files.

8 . The non-transitory computer-readable storage medium of claim 1 , wherein the steps further comprise:
utilizing a combination of policy for the user and machine learning to determine whether to send the content to the sandbox and render the content in the isolated browser.

9 . The non-transitory computer-readable storage medium of claim 8 , wherein the machine learning includes a trained machine learning ensemble model configured to determine whether the content is malicious.

10 . The non-transitory computer-readable storage medium of claim 1 , wherein the obtaining is based on inline monitoring of the user by the cloud-based system.

11 . A method comprising steps of:
responsive to a user attempting to access content in a cloud-based system, obtaining the content associated with the user; sending the content to a sandbox for processing; rendering the content within an isolated browser, thereby allowing the user to interact with the content during the processing; and receiving a verdict from the sandbox, wherein the verdict labels the content as one of malicious, benign, and unknown, and performing an action based thereon.

12 . The method of claim 11 , wherein responsive to the verdict labeling the content as benign, allowing the user to download the content.

13 . The method of claim 11 , wherein responsive to the verdict labeling the content as malicious, preventing the user from downloading the content, and providing the user a flattened version of the content.

14 . The method of claim 11 , wherein prior to the receiving, the steps further comprise:
sending an Application Programming Interface (API) call to the sandbox to check a status of the processing.

15 . The method of claim 14 , wherein the sandbox responds to the API call by indicating that the content is still under processing, and the steps further comprise:
waiting for a preconfigured time and repeating the API call until the sandbox responds with the verdict.

16 . The method of claim 11 , wherein the content is password protected, and sending the content to the sandbox is performed responsive to the user providing the password through the isolated browser.

17 . The method of claim 11 , wherein the content is an archive file, and the steps further comprise:
responsive to the user unarchiving the content in the isolated browser, sending dropped files to the sandbox for processing; and allowing the user to download one or more of the dropped files based on a verdict of each of the dropped files.

18 . The method of claim 11 , wherein the steps further comprise:
utilizing a combination of policy for the user and machine learning to determine whether to send the content to the sandbox and render the content in the isolated browser.

19 . The method of claim 18 , wherein the machine learning includes a trained machine learning ensemble model configured to determine whether the content is malicious.

20 . The method of claim 11 , wherein the obtaining is based on inline monitoring of the user by the cloud-based system.

Assignees

• Zscaler Inc

Inventors

• Rao Sumukh Radhakrishna
• Polurouthu Vinay
• Jain Amit
• Dhakal Kripesh
• Dedhia Yaamika
• Sainion Parnit

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title