公开(公告)号：US20170359370A1

公开(公告)日：2017-12-14

申请号：US15179447

申请日：2016-06-10

申请人： Sophos Limited

发明人： Russell Humphries ,  Kenneth D. Ray ,  Anthony John Merry ,  Harald Schutz

IPC分类号： H04L29/06

摘要： A file system extension for an endpoint controls access to files by selectively decrypting files under certain conditions. Where a pattern of access to the files suggests malicious and/or automated file access activity, the file system extension may limit the rate of file access by regulating the rate at which decryption is provided to requesting processes.

公开(公告)号：US10691824B2

公开(公告)日：2020-06-23

申请号：US16248417

申请日：2019-01-15

申请人： Sophos Limited

发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

IPC分类号： G06F21/62 ,  G06F21/55 ,  H04L29/06

摘要： Securing an endpoint against exposure to unsafe content includes encrypting files to prevent unauthorized access, and monitoring an exposure state of a process to potentially unsafe content by applying behavioral rules to determine whether the exposure state is either exposed or secure, where (1) the process is initially identified as secure, (2) the process is identified as exposed when the process opens a network connection to a URL that is not internal to an enterprise network of the endpoint and that has a poor reputation, (3) the process is identified as exposed when it opens a file identified as exposed, and (4) the process is identified as exposed when another exposed process opens a handle to the process. Access to the files may be restricted when the process is exposed by controlling access through a file system filter that conditionally decrypts files for the process according to its exposure state.

公开(公告)号：US10686827B2

公开(公告)日：2020-06-16

申请号：US15098720

申请日：2016-04-14

申请人： Sophos Limited

发明人： Harald Schutz ,  Anthony John Merry ,  Kenneth D. Ray ,  Andreas Berger

IPC分类号： H04L29/06 ,  H04L9/14 ,  H04L9/00 ,  H04L9/30 ,  G06F21/62 ,  G06F21/55

摘要： An endpoint encrypts local files with a key to protect file contents. If the endpoint or processes on the endpoint becomes exposed to potentially harmful locations or resources, the key can be revoked to prevent access to encrypted files on the endpoint. In order to facilitate continued operation of the endpoint, files that are currently open can be encrypted with a second key so that the corresponding data is isolated from the other encrypted files while remaining accessible to current users.

公开(公告)号：US10650154B2

公开(公告)日：2020-05-12

申请号：US15042862

申请日：2016-02-12

申请人： Sophos Limited

发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

IPC分类号： H04L29/06 ,  G06F21/62 ,  G06F21/55

摘要： Securing an endpoint against malicious activity includes encrypting a plurality of files on an endpoint to prevent unauthorized access to the plurality of files, receiving a request to access a file from a process executing on the endpoint, decrypting the file for the process, and monitoring a security state of the process. If the security state becomes a compromised state, a technique involves maintaining access to any open files (including the file decrypted for the process), prohibiting access to other files, and initiating a remediation of the process by facilitating a restart of the process. If the remediation is successful, access by the process to the plurality of files may be restored.

公开(公告)号：US20200036747A1

公开(公告)日：2020-01-30

申请号：US16589489

申请日：2019-10-01

申请人： Sophos Limited

发明人： Russell Humphries ,  Kenneth D. Ray ,  Anthony John Merry ,  Harald Schutz

IPC分类号： H04L29/06 ,  G06F21/62 ,  G06F21/55

摘要： A file system extension for an endpoint controls access to files by selectively decrypting files under certain conditions. Where a pattern of access to the files suggests malicious and/or automated file access activity, the file system extension may limit the rate of file access by regulating the rate at which decryption is provided to requesting processes.

公开(公告)号：US20180276378A1

公开(公告)日：2018-09-27

申请号：US15970846

申请日：2018-05-03

申请人： Sophos Limited

发明人： Kenneth D. Ray ,  Daniel Salvatore Schiappa ,  Simon Neil Reed ,  Mark D. Harris ,  Neil Robert Tyndale Watkiss ,  Andrew J. Thomas ,  Robert W. Cook ,  Harald Schütz ,  John Edward Tyrone Shaw ,  Anthony John Merry

IPC分类号： G06F21/55 ,  G06F21/56 ,  G06F21/62

CPC分类号： G06F21/554 ,  G06F21/552 ,  G06F21/56 ,  G06F21/6218 ,  G06F2221/033 ,  G06F2221/034 ,  G06F2221/2107 ,  G06F2221/2113 ,  G06F2221/2145 ,  H04L63/06 ,  H04L63/1408 ,  H04L63/20

摘要： Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

公开(公告)号：US10979449B2

公开(公告)日：2021-04-13

申请号：US16589489

申请日：2019-10-01

申请人： Sophos Limited

发明人： Russell Humphries ,  Kenneth D. Ray ,  Anthony John Merry ,  Harald Schutz

IPC分类号： H04L29/06 ,  G06F21/62 ,  G06F21/55 ,  G06F21/57

摘要： A file system extension for an endpoint controls access to files by selectively decrypting files under certain conditions. Where a pattern of access to the files suggests malicious and/or automated file access activity, the file system extension may limit the rate of file access by regulating the rate at which decryption is provided to requesting processes.

公开(公告)号：US20190228172A1

公开(公告)日：2019-07-25

申请号：US16248417

申请日：2019-01-15

申请人： Sophos Limited

发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

IPC分类号： G06F21/62 ,  G06F21/55 ,  H04L29/06

摘要： Securing an endpoint against exposure to unsafe content includes encrypting files to prevent unauthorized access, and monitoring an exposure state of a process to potentially unsafe content by applying behavioral rules to determine whether the exposure state is either exposed or secure, where (1) the process is initially identified as secure, (2) the process is identified as exposed when the process opens a network connection to a URL that is not internal to an enterprise network of the endpoint and that has a poor reputation, (3) the process is identified as exposed when it opens a file identified as exposed, and (4) the process is identified as exposed when another exposed process opens a handle to the process. Access to the files may be restricted when the process is exposed by controlling access through a file system filter that conditionally decrypts files for the process according to its exposure state.

公开(公告)号：US10263966B2

公开(公告)日：2019-04-16

申请号：US15098684

申请日：2016-04-14

申请人： Sophos Limited

发明人： Russell Humphries ,  Gordon Sullivan ,  Kenneth D. Ray ,  Anthony John Merry ,  Harald Schutz ,  Andreas Berger

IPC分类号： H04L29/06 ,  H04L9/08 ,  H04L12/58 ,  G06F21/60 ,  H04L9/32

摘要： Rules are applied at a network perimeter to outbound network communications that contain file attachments. The rules may, in a variety of circumstances, require wrapping of an outbound file from the endpoint in a portable encrypted container. The network perimeter may be enforced locally at the endpoint, or at any network device between the endpoint and a recipient.

公开(公告)号：US20170235967A1

公开(公告)日：2017-08-17

申请号：US15042916

申请日：2016-02-12

申请人： Sophos Limited

发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

IPC分类号： G06F21/62 ,  G06F21/55 ,  G06F21/56 ,  H04L29/06

CPC分类号： G06F21/6218 ,  G06F21/52 ,  G06F21/54 ,  G06F21/554 ,  G06F21/56 ,  G06F21/602 ,  G06F2221/033 ,  G06F2221/2107 ,  H04L63/02 ,  H04L63/1408 ,  H04L63/20

摘要： Securing an endpoint against exposure to unsafe content includes encrypting files to prevent unauthorized access, and monitoring an exposure state of a process to potentially unsafe content by applying behavioral rules to determine whether the exposure state is either exposed or secure, where (1) the process is initially identified as secure, (2) the process is identified as exposed when the process opens a network connection to a URL that is not internal to an enterprise network of the endpoint and that has a poor reputation, (3) the process is identified as exposed when it opens a file identified as exposed, and (4) the process is identified as exposed when another exposed process opens a handle to the process. Access to the files may be restricted when the process is exposed by controlling access through a file system filter that conditionally decrypts files for the process according to its exposure state.