Protected environments for protecting users against undesirable activities

• US 8,028,335 B2
• Filed: 06/19/2006
• Issued: 09/27/2011
• Est. Priority Date: 06/19/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Thane, Anthony G, Starbuck, Bryan T, De Raad, Geurt B, Udezue, Ojiakonobi, Struthers, Daniel S
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Nguyen; Trong
• Application Number:
  US11/424,971
• Publication Number:
  US 20070294763A1
• Time in Patent Office: 1,926 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Various embodiments protect against undesirable activities, in at least some embodiments, by combining the protection of a data or message filter with the user'"'"'s own knowledge and judgment. In at least some embodiments, data or a message that is suspected of being associated with an undesirable activity is identified and indicia is provided to a user that the message is suspect. The data or message is presented to the user in a protected environment that allows the user to access the data or message in full fidelity, but prevents them from interacting with the data or message in a manner which would expose them to the undesirable activity. After reviewing the data or message in the protected environment, the user can decide how the message should thereafter be treated.

Claims

1. A computer-implemented method comprising:

storing, in a memory communicatively coupled to a processor, computer-executable instructions for performing a method of protecting users against undesirable activities;

executing the instructions on the processor;

according to the instructions being executed;

identifying an email message that is suspected of being associated with one or more undesirable activities, the identifying comprising;

receiving input from a remote filter having an updated list of uniform resource locators (URLs) known to be associated with phishing; and

action by a local filter acting on a list of message characteristics deemed suspicious with respect to a device upon which the processor operates;

providing indicia in a user interface that the email message is suspected of being associated with one or more undesirable activities, the user interface comprising a delete button, to delete the email message, and an unlock button, to allow a user full access to the email message, the providing of the indicia being performed by an email application, the email application, upon identifying the email message that is suspected of being associated with one or more undesirable activities, notifies a browser application of the email message and notifies the browser application that the email message is deemed suspicious, the email application and browser application both operated on a computer operated by the user; and

presenting the email message in a visually-distinctive protected environment, the protected environment allowing the email message to be scrutinized in full fidelity and prevents user activities with respect to the email message that can expose a user to the one or more undesirable activities, wherein said protected environment comprises a transparent window which encases the email message shown in a message list and preview window pane behind a watermark which contributes to an appearance of a shrink-wrap covering, the appearance of the shrink-wrap covering created by watermarks, textures, gradients and lighting effects to simulate a tactile aspect of the shrink-wrap covering.

2. The computer-implemented method of claim 1, wherein the unlock button operates to remove said protected environment, and wherein such removal will allow the user to click a link or enter information.

3. The computer-implemented method of claim 1, wherein at least one of said one or more undesirable activities is associated with phishing.

4. The computer-implemented method of claim 1, wherein email messages are divided by a filter into those within the visually-distinctive protected environment and those not within the visually-distinctive protected environment.

5. A computer-implemented method comprising:

storing, in a memory communicatively coupled to a processor, computer-executable instructions for performing a method of protecting users against undesirable activities;

executing the instructions on the processor;

according to the instructions being executed;

determining whether an email message is suspected of being associated with one or more undesirable activities, the determining being performed by an email application, the email application, upon identifying the email message that is suspected of being associated with one or more undesirable activities, notifying a browser application of the email message and notifies the browser application that the email message is deemed suspicious, the email application and browser application both operated on a computer operated by a user, and the determining comprising;

receiving input from a remote filter having an updated list of uniform resource locators (URLs) known to be associated with phishing, the updated list adapted for testing for similarity to a suspicious message and testing for receipt from a source suspected of phishing and testing for a number of recipients of the email message; and

action by a local filter acting on a list of message characteristics deemed suspicious with respect to a device upon which the processor operates; and

encasing the email message, if suspected of being associated with one or more undesirable activities, in a transparent protective window that allows the email message to be scrutinized in full fidelity but prevents the user from engaging in activities with respect to the email message that can expose the user to the one or more undesirable activities, wherein a delete button, to delete the email message, and an unlock button, to allow a user full access to the email message, are defined within the transparent protective window, and wherein the transparent protective window encases the email message shown in a message list and preview window pane behind a watermark which contributes to an appearance of a shrink-wrap coating, the appearance of the shrink-wrap coating created by watermarks, textures, gradients and lighting effects to simulate a tactile aspect of the shrink-wrap coating.

6. The computer-implemented method of claim 5, wherein the unlock button operates to provide the user with an option of removing said transparent protective window, and wherein such removal will allow the user to click a link or enter information.

7. The computer-implemented method of claim 5, wherein at least one of said one or more undesirable activities is associated with phishing.

8. The computer-implemented method of claim 5, wherein allowing the email message to be scrutinized in full fidelity comprises permitting a user to view data associated with the email message.

9. The computer-implemented method of claim 5, further comprising providing a notification that said email message is suspected of being associated with one or more undesirable activities.

10. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, implement the computer-implemented method of claim 5.

11. A system comprising:

one or more computer-readable media; and

an executable email application that resides on the one or more computer-readable media and which is configured to receive email messages, process the email messages to identify suspicious email messages and provide a user interface that encases any suspicious email messages in a transparent, visually distinctive wrap that can allow a user to read content of any wrapped email messages, but which prevents the user from directly interacting with content of any wrapped email messages until the user specifically chooses to remove the transparent, visually distinctive wrap, the identifying suspicious email messages comprising;

receiving input from a remote filter having an updated list of uniform resource locators (URLs) known to be associated with phishing; and

action by a local filter acting on a list of message characteristics deemed suspicious with respect to a device upon which a processor operates;

the user interface comprising a delete button, to delete a suspicious email message, and an unlock button, to allow the user full access to the suspicious email message; and

the email application, upon identifying the email message that is suspected of being associated with one or more undesirable activities, notifying a browser application within the system of the email message and notifying the browser application that the email message is deemed suspicious, the email application and browser application both operated on a computer operated by the user, wherein the transparent, visually distinctive wrap encases the suspicious email message shown in a message list and preview window pane behind a watermark which contributes to an appearance of a shrink-wrap covering, the appearance of the shrink-wrap covering created by watermarks, textures, gradients and lighting effects to simulate a tactile aspect of the shrink-wrap covering.

12. The system of claim 11, wherein operation of the unlock button removes said transparent, visually distinctive wrap.

13. The system of claim 11, wherein said email application is further configured to provide the user with information about one or more undesirable activities associated with said suspicious email messages.

14. The system of claim 11, wherein said email application is further configured to provide indicia that an email message is identified as a suspicious email message.

15. The system of claim 14, wherein said indicia includes one or more visual features associated with said transparent, visually distinctive wrap.

16. A computing device embodying the system of claim 11.