Virtual browsing environment

• US 9,436,822 B2
• Filed: 09/09/2014
• Issued: 09/06/2016
• Est. Priority Date: 06/30/2009
• Status: Active Grant

• Current Assignee: George Mason Research Foundation Inc.
• Original Assignee: George Mason Research Foundation Inc.
• Inventors: Ghosh, Anup K., Jajodia, Sushil, Huang, Yih, Wang, Jiang
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US14/480,657
• Publication Number:
  US 20160019391A1
• Time in Patent Office: 728 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2209/541 Client-server
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An embodiment for providing a secure virtual browsing environment includes creating a virtual browsing environment with a virtualized operating system sharing an operating system kernel of a supporting operating system and executing the browser application within the virtual browsing environment. Another embodiment includes receiving a website selection within a browser application, determining if the website selection corresponds to a secure bookmark, and creating a second virtual browsing environment and executing the browser application within the second virtual browsing environment to access the website selection when the website selection corresponds to a website specified as a secure bookmark. Yet another embodiment includes monitoring operation of the operating system within the at least one virtual browsing environment, determining when the operation of the operating system includes potential malicious activity, and terminating the virtual browsing environment when the operation includes potential malicious activity.

Claims

1. An apparatus, comprising:

a memory; and

a hardware processor operatively coupled to the memory, the hardware processor configured to execute a control application, the control application configured to receive a request to execute a first browser process, the control application configured to initiate, based on the request, the first browser process within a virtual browsing environment,

the control application configured to receive an identifier associated with a website in response to the first browser process requesting to access the website;

the control application configured to instruct the first browser process to access the website when the identifier is not associated with a secure bookmark; and

the control application configured to instruct a second browser process executing outside the virtual browsing environment to access the website when the identifier is associated with the secure bookmark.

2. The apparatus of claim 1, wherein the control application is configured to initiate the virtual browsing environment in response to receiving the request.

3. The apparatus of claim 1, wherein the website is a first website, the control application is configured to identify potential malicious activity within the virtual browsing environment based on an operation of the first browser process, the control application configured to correlate an indication of the operation with an identifier of a second website based on a time associated with the first browser process accessing the second website and a time associated with the operation.

4. The apparatus of claim 1, wherein the website is a first website, the control application is configured to send, to a collector and in response to identifying potential malicious activity within the virtual browsing environment, an identifier of a second website and an indication of an operation associated with the first browser process accessing the second website.

5. The apparatus of claim 1, wherein the control application is configured to initiate the first browser process using a first operating system, the first operating system being within the virtual browsing environment,

the hardware processor configured to execute a second operating system, the second operating system configured to execute the virtual browsing environment.

20. The apparatus of claim 1, wherein the virtual browsing environment is a first virtual browsing environment, the control application is configured to initiate execution of the second browser process within a second virtual browsing environment distinct from the first virtual browsing environment.

6. A method, comprising:

receiving, at a compute device, a request to execute a first browser process;

initiating, based on the request, the first browser process using an operating system within a virtual browsing environment on the compute device;

receiving, from the first browser process, a request to access a website;

identifying the website as associated with a secure bookmark; and

initiating, in response to the website being associated with the secure bookmark, a second browser process outside the virtual browsing environment to access the website.

7. The method of claim 6, further comprising:

initiating the virtual browsing environment in response to receiving the request to access the first browser process.

8. The method of claim 6, further comprising:

terminating the virtual browsing environment in response to identifying potential malicious activity within the virtual browsing environment based on an operation of the operating system within the virtual browsing environment.

9. The method of claim 6, wherein the website is a first website, the method further comprising:

identifying potential malicious activity within the virtual browsing environment based on an operation of the operating system within the virtual browsing environment; and

correlating an indication of the operation with an identifier of a second website based on a time associated with the first browser process accessing the second website and a time associated with the operating system performing the operation.

10. The method of claim 6, wherein the website is a first website, the method further comprising:

identifying, at a first time, potential malicious activity within the virtual browsing environment based on the first browser process accessing a second website and an operation of the operating system within the virtual browsing environment; and

preventing, at a second time after the first time, the first browser process from accessing the second website based on the identifying the potential malicious activity.

11. The method of claim 6, wherein the operating system is a virtualized operating system, the virtual browsing environment executing under control of a host operating system of the compute device.

12. The method of claim 6, further comprising:

identifying potential malicious activity within the virtual browsing environment based on an operation of the operating system within the virtual browsing environment;

capturing a snapshot of a state of the virtual browsing environment at a time prior to the identifying the potential malicious activity; and

restoring, in response to the identifying the potential malicious activity and using the snapshot, the virtual browsing environment to the state of the virtual browsing environment at the time.

21. The method of claim 6, wherein the virtual browsing environment is a first virtual browsing environment, the initiating the second browser process includes initiating the second browser process within a second virtual browsing environment distinct from the first virtual browsing environment.

13. An apparatus, comprising:

a memory; and

a hardware processor operatively coupled to the memory, the hardware processor configured to execute a control application, the control application configured to receive, from a first browser process executing within a virtual browsing environment, a request to access a website,

the control application configured to identify the website as associated with a secure bookmark,

the control application configured to initiate execution of a second browser process outside the virtual browsing environment in response to the website being associated with the secure bookmark such that the second browser process accesses the website.

14. The apparatus of claim 13, wherein the virtual browsing environment is a first virtual browsing environment, the control application is configured to initiate execution of the second browser process within a second virtual browsing environment distinct from the first virtual browsing environment.

15. The apparatus of claim 13, wherein the control application is configured to identify the website as associated with the secure bookmark based on comparing an identifier associated with the website to a list of secure bookmarks stored in a shared preference directory.

16. The apparatus of claim 13, wherein the control application is configured to terminate the virtual browsing environment in response to identifying potentially malicious activity within the virtual browsing environment based on an operation of the first browser process.

17. The apparatus of claim 13, wherein the control application is configured to receive a request to execute the first browser process, the control application configured to initiate, based on the request, the first browser process within the virtual browsing environment.

18. The apparatus of claim 13, wherein:

the control application is configured to capture a snapshot of a state of the virtual browsing environment at a time,

the control application is configured to identify, after the time, potential malicious activity within the virtual browsing environment based on an operation of the first browser process within the virtual browsing environment, and

the control application is configured to restore, in response to identifying the potential malicious activity and using the snapshot, the virtual browsing environment to the state of the virtual browsing environment at the time.

19. The apparatus of claim 13, wherein the hardware processor is configured to execute a first operating system, the first operating system configured to execute the virtual browsing environment,

the virtual browsing environment configured to include a second operating system, the second operating system configured to execute the first browser process.