Granted Patent B2

US 10,491,566 · App. 15/636,148 · Granted Nov 26, 2019

Abstract

Claims (55)

1. A method for controlling access to unauthorized digital content, the method comprising:

forwarding a request originating at a client computer regarding access to digital content hosted at a content server;

receiving a response to the request from the content server, wherein the response includes undetected malware that triggers the client computer to request content from a malware server;

intercepting the triggered request from the client computer, wherein the triggered request is addressed to the malware server, the triggered request associated with retrieving data of a specified type;

identifying that the malware server designated in the triggered request is an unauthorized data source in accordance with one or more security policies associated with authorizing or not authorizing the client computer to access data sources via a computer network, wherein at least one of the security policies specifies blocking data requests from being sent to the unauthorized data source by identifying that the triggered request is inconsistent with one or more authorized data sources cross-referenced to one or more authorized types of data;

blocking the triggered request from being sent to the malware server based on the identification that the triggered request is inconsistent with the at least one security policy that cross-references the one or more authorized data sources with the one or more authorized types of data;

sending the client computer an error message based on the identification that the triggered request is associated with the unauthorized data source in accordance with the one or more security policies;

receiving a request regarding accessing data from a second content server;

identifying that the request for data from the second content server is associated with a first type of file data that matches a specified data type; and

removing the first type of file data from a response from the second content server based on the identified match in accordance with the at least one security policy based on the request being inconsistent with the at least one security policy that cross-references the one or more authorized data sources with the one or more authorized types of data.

2. The method of claim 1 , further comprising:

sending a domain name service (DNS) query to a DNS server regarding a domain name of the content server; and

receiving a DNS response from the DNS server that identifies an Internet Protocol (IP) address of the content server.

3. The method of claim 2 , wherein the IP address of the content server corresponds to the at least one security policy.

4. The method of claim 3 , further comprising sending a request to a security policy server to obtain the one or more security policies.

5. The method of claim 1 , wherein the one or more security policies define at least one type of authorized resources that can be accessed according to the at least one security policy.

6. The method of claim 1 , wherein the one or more policies identify at least one authorized device.

7. The method of claim 1 , wherein the one or more policies identify at least one unauthorized device.

8. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for controlling access to unauthorized digital content, the method comprising:

forwarding a request originating at a client computer regarding access to digital content hosted at a content server;

receiving a response to the request from the content server, wherein the response includes undetected malware that triggers the client computer to request content from a malware server;

intercepting the triggered request from the client computer, wherein the triggered request is addressed to the malware server, the triggered request associated with retrieving data of a specified type;

identifying that the malware server designated in the triggered request is an unauthorized data source in accordance with one or more security policies associated with authorizing or not authorizing the client computer to access data sources via a computer network, wherein at least one of the security policies specifies blocking data requests from being sent to the unauthorized data source by identifying that the triggered request is inconsistent with one or more authorized data sources cross-referenced to one or more authorized types of data;

blocking the triggered request from being sent to the malware server based on the identification that he triggered request is inconsistent with the at least one security policy that cross-references the one or more authorized data sources with the one or more authorized types of data;

sending the client computer an error message based on the identification that the triggered request is associated with the unauthorized data source in accordance with the one or more security policies;

receiving a request regarding accessing data from a second content server;

identifying that the request for data from the second content server is associated with a first type of file data that matches a specified type; and

removing the first type of file data from a response from the second content server based on the identified match in accordance with the at least one security policy based on the request being inconsistent with the at least one security policy that cross-references the one or more authorized data sources with the one or more authorized types of data.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the program further comprises instructions executable to:

send a domain name service (DNS) query to a DNS server regarding a domain name of the content server; and

receive a DNS response from the DNS server that identifies an Internet Protocol (IP) address of the content server.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the IP address of the content server corresponds to the at least one security policy.

11. The non-transitory computer-readable storage medium of claim 10 , the program further includes instructions executable to send a request to a security policy server to obtain the one or more security policies.

12. The non-transitory computer-readable storage medium of claim 8 , wherein the one or more security policies define at least one type of authorized resources that are accessible in accordance with the at least one security policy.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the one or more security policies identify at least one authorized device.

14. The non-transitory computer-readable storage medium of claim 8 , wherein the one or more security policies identify at least one unauthorized device.

15. An apparatus for controlling access to unauthorized digital content, the apparatus comprising:

a communication interface that communicates over a communication network to:

forward a request originating at a client computer regarding access to digital content hosted at a content server,

receive a response to the request from the content server, wherein the response includes undetected malware that triggers the client computer to request content from a malware server, and

intercept the triggered request from the client computer, wherein the triggered request is addressed to the malware server, the triggered request associated with retrieving data of a specified type;

a memory; and

a hardware processor that executes instructions stored in the memory, wherein execution of the instructions by the hardware processor:

identifies that the malware server designated in the triggered request is an unauthorized data source in accordance with one or more security policies associated with authorizing or not authorizing the client computer to access data sources via a computer network, wherein at least one of the security policies specifies blocking data requests from being sent to the unauthorized data source by identifying that the triggered request is inconsistent with one or more authorized data sources cross-referenced to one or more authorized types of data,

blocks the triggered request from being sent to the malware server based on the identification that the triggered request is inconsistent with the at least one security policy that cross-references the one or more authorized data sources with the one or more authorized types of data, wherein the communication interface:

sends the client computer an error message based on the identification that the triggered request is associated with the unauthorized data source in accordance with the one or more security policies, and

receives a request regarding accessing data from a second content server; and

wherein the processor:

identifies that the request for data from the second content server is associated with a first type of file data that matches a specified type; and

removes the first type of file data from a response from the second content server based on the identified match in accordance with the at least one security policy based on the request being inconsistent with the at least one security policy that cross-references the one or more authorized data sources with the one or more authorized types of data.

16. The apparatus of claim 15 , wherein the communication interface sends a domain name service (DNS) query to a DNS server and receives a DNS response from the DNS server that identifies an Internet Protocol (IP) address of the content server.

17. The apparatus of claim 16 , wherein the IP address of the content server corresponds to the at least one security policy.

18. The apparatus of claim 15 , wherein the communication interface further sends a request to a security policy server to obtain the one or more security policies.

19. The apparatus of claim 15 , wherein the one or more security policies define at least one type of authorized resources that can be accessed according to a first security policy of the at least one security policy.

20. The method of claim 15 , wherein the one or more security policies identify at least one authorized device or one unauthorized device.

Assignments (8)