MEDIATED ACCESS TO RESOURCES

• US 20170180378A1
• Filed: 03/03/2017
• Published: 06/22/2017
• Est. Priority Date: 09/15/2015
• Status: Active Grant

• Current Assignee: Mimecast Services Limited (Mimecast Limited)
• Original Assignee: Mimecast North America, Inc. (Mimecast Limited)
• Inventors: Tyler, Simon Paul, Malone, Steven, Maylor, Jackie, Van Ry, Wayne, Ribeiro, Francisco
• Granted Patent: US 10,728,239 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Today'"'"'s user is facing an ever increasing number of cyber threats from infectious software to scam artist phishing for their passwords and other personal information. Accordingly, a technique is provided to mediate a user'"'"'s access to electronic resources, which can include malware and sites that trick the user into giving their password. Based on information known about the resource at the time the user accesses it, the technique can warn the user that the resources is suspicious and it is not safe to provide their password. Even if the resource is safe, the technique can warn the user not reuse their password, thereby promoting good password hygiene.

Claims

1. A method for mediating a user'"'"'s access to a resource, the method comprising:

provided with a resource that has been rewritten by a pre-delivery threat analysis and intervention system, the resource rewritten as a protected resource prior to being delivered to a user based on information known about the resource at the time of delivery, querying for updated information about the resource in response to the user accessing the protected resource; and

mediating the user'"'"'s access to the protected resource based on the updated information.

2. The method of claim 1, wherein mediating the user'"'"'s access further includes creating an intermediary page that:

i) warns the user which user action is allowed or banned with respect to the protected resource or ii) warns the user that the protected resource is suspicious based on the updated information; and

returning the intermediary page to the user prior to connecting the user to the protected resource.

3. The method of claim 1, wherein mediating the user'"'"'s access includes blocking the user'"'"'s access to the protected resource based on the updated information.

4. The method of claim 1, wherein querying for the updated information includes looking up a list of known resources in which each resource is associated with an allowed user action and/or banned user action.

5. The method of claim 1, wherein querying for the updated information includes looking up the updated information about the protected resource using a wildcard.

6. The method of claim 1, wherein querying for the updated information includes looking up the updated information about the protected resource using subdomain matching.

7. The method of claim 1, wherein querying for the updated information includes comparing a suspicion score associated with the protected resource to a threshold value;

and

mediating the user'"'"'s access to the protected resource based on the comparison.

8. The method of claim 7 further comprising:

graphically comparing a screen image of the protected resource to screen images of trusted resources; and

determining the suspicion score based, at least in part, on the graphical comparison.

9. The method of claim 1, in an event the protected resource is a form from a site asking the user to provide a password, the method further comprising:

determining whether the password entered by the user is allowed or banned for the site; and

blocking the user from submitting the password to the resource when the entered password is banned for the site.

10. The method of claim 9, wherein determining whether the password entered by the user is allowed or banned includes determining whether the entered password is associated with a known resource;

and

based on the determination, identifying the entered password as a banned password.

11. The method of claim 1, wherein the protected resource is delivered to the user in an electronic message.

12. The method of claim 1, wherein the resource is a reference to a resource.

13. A system for mediating a user'"'"'s access to a resource, the system comprising:

a decoder for decoding a resource that has been rewritten by a pre-delivery threat analysis and intervention system prior to being delivered to a user, the resource rewritten as a protected resource based on information known about the resource at the time of delivery;

a mediation mechanism communicatively coupled to the decoder, the mediation mechanism configured to query a database for updated information about the resource in response to the user accessing the protected resource, and to mediate the user'"'"'s access to the protected resource based on the updated information.

14. The system of claim 13, where the mediation mechanism is further configured to:

create an intermediary page that;

i) warns the user which user action is allowed or banned with respect to the protected resource or ii) warns the user that the protected resource is suspicious based on the updated information; and

return the intermediary page to the user prior to connecting the user to the protected resource.

15. The system of claim 13, wherein the mediation mechanism mediates the user access by blocking the user'"'"'s access to the protected resource based on the updated information.

16. The system of claim 13, wherein the mediation mechanism queries the database by looking up a list of known resources in which each resource is associated with an allowed user action and/or banned user action.

17. The system of claim 13, wherein the mediation mechanism queries the database by looking up the updated information about the protected resource using a wildcard.

18. The system of claim 13, wherein the mediation mechanism queries the database by looking up the updated information about the protected resource using subdomain matching.

19. The system of claim 13, wherein the mediation mechanism queries the database by comparing a suspicion score associated with the protected resource to a threshold value, and mediates the user'"'"'s access to the protected resource based on the comparison.

20. The system of claim 19, wherein the mediation mechanism is further configured to:

graphically compare a screen image of the protected resource to known screen images of trusted resources; and

determine the suspicion score based, at least in part, on the graphical comparison.

21. The system of claim 13, in an event the protected resource is a form from a site asking the user to provide a password, the mediation mechanism is further configured to:

determine whether the password entered by the user is allowed or banned for the site; and

block the user from submitting the password to the resource when the entered password is banned for the site.

22. The system of claim 21, wherein the mediation mechanism determines whether the password entered by the user is allowed or banned by determining whether the entered password is associated with a known resource, and based on the determination, identify the entered password as a banned password.

23. The system of claim 13, wherein the protected resource is delivered to the user in an electronic message.

24. The system of claim 13, wherein the resource is a reference to a resource.

25. A non-transitory computer readable medium storing instructions executable by at least one processor to execute a method for mediating a user'"'"'s access to a resource, the instructions being coded to instruct the at least one processor to:

provided with a resource that has been rewritten by a pre-delivery threat analysis and intervention system, the resource rewritten as a protected resource prior to being delivered to a user based on information known about the resource at the time of delivery, query for updated information about the resource in response to the user accessing the protected resource; and

mediate the user'"'"'s access to the protected resource based on the updated information.