利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

22 条记录 (耗时 0.018 秒)

    Key management for compromised enterprise endpoints
    1.
    发明授权
    Key management for compromised enterprise endpoints 有权

    公开(公告)号：US10516531B2

    公开(公告)日：2019-12-24

    申请号：US16111322

    申请日：2018-08-24

    申请人： Sophos Limited

    发明人： Harald Schütz ,  Andrew J. Thomas ,  Kenneth D. Ray ,  Daniel Salvatore Schiappa

    IPC分类号： G06F21/00 ,  H04L29/06 ,  H04L9/08 ,  G06F21/55

    摘要： Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

    Behavioral-based control of access to encrypted content by a process
    2.
    发明授权
    Behavioral-based control of access to encrypted content by a process 有权

    公开(公告)号：US10691824B2

    公开(公告)日：2020-06-23

    申请号：US16248417

    申请日：2019-01-15

    申请人： Sophos Limited

    发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

    IPC分类号： G06F21/62 ,  G06F21/55 ,  H04L29/06

    摘要： Securing an endpoint against exposure to unsafe content includes encrypting files to prevent unauthorized access, and monitoring an exposure state of a process to potentially unsafe content by applying behavioral rules to determine whether the exposure state is either exposed or secure, where (1) the process is initially identified as secure, (2) the process is identified as exposed when the process opens a network connection to a URL that is not internal to an enterprise network of the endpoint and that has a poor reputation, (3) the process is identified as exposed when it opens a file identified as exposed, and (4) the process is identified as exposed when another exposed process opens a handle to the process. Access to the files may be restricted when the process is exposed by controlling access through a file system filter that conditionally decrypts files for the process according to its exposure state.

    Process-level control of encrypted content
    3.
    发明授权
    Process-level control of encrypted content 有权

    公开(公告)号：US10650154B2

    公开(公告)日：2020-05-12

    申请号：US15042862

    申请日：2016-02-12

    申请人： Sophos Limited

    发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

    IPC分类号： H04L29/06 ,  G06F21/62 ,  G06F21/55

    摘要： Securing an endpoint against malicious activity includes encrypting a plurality of files on an endpoint to prevent unauthorized access to the plurality of files, receiving a request to access a file from a process executing on the endpoint, decrypting the file for the process, and monitoring a security state of the process. If the security state becomes a compromised state, a technique involves maintaining access to any open files (including the file decrypted for the process), prohibiting access to other files, and initiating a remediation of the process by facilitating a restart of the process. If the remediation is successful, access by the process to the plurality of files may be restored.

    Key management for compromised enterprise endpoints
    5.
    发明授权
    Key management for compromised enterprise endpoints 有权

    公开(公告)号：US10063373B2

    公开(公告)日：2018-08-28

    申请号：US15360591

    申请日：2016-11-23

    申请人： Sophos Limited

    发明人： Harald Schütz ,  Andrew J. Thomas ,  Kenneth D. Ray ,  Daniel Salvatore Schiappa

    IPC分类号： G06F21/00 ,  H04L29/06 ,  H04L9/08 ,  G06F21/55

    CPC分类号： H04L9/0891 ,  G06F21/552 ,  G06F2221/034 ,  G06F2221/2113 ,  H04L63/06 ,  H04L63/1408

    摘要： Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

    Behavioral-based control of access to encrypted content by a process
    6.
    发明授权
    Behavioral-based control of access to encrypted content by a process 有权

    公开(公告)号：US10657277B2

    公开(公告)日：2020-05-19

    申请号：US15817705

    申请日：2017-11-20

    申请人： Sophos Limited

    发明人： Kenneth D. Ray ,  Andrew J. Thomas ,  Anthony John Merry ,  Harald Schütz ,  Andreas Berger ,  John Edward Tyrone Shaw

    IPC分类号： H04L29/06 ,  G06F21/52 ,  G06F21/54 ,  G06F21/55 ,  G06F21/56 ,  G06F21/60 ,  G06F21/62

    摘要： Securing an endpoint against exposure to unsafe content includes encrypting files to prevent unauthorized access, and monitoring an exposure state of a process to potentially unsafe content by applying behavioral rules to determine whether the exposure state is either exposed or secure, where (1) the process is initially identified as secure, (2) the process is identified as exposed when the process opens a network connection to a URL that is not internal to an enterprise network of the endpoint and that has a poor reputation, (3) the process is identified as exposed when it opens a file identified as exposed, and (4) the process is identified as exposed when another exposed process opens a handle to the process. Access to the files may be restricted when the process is exposed by controlling access through a file system filter that conditionally decrypts files for the process according to its exposure state.