Granted Patent B1

US 12,373,559 · App. 18/479,666 · Granted Jul 29, 2025

Inventors: Stephen John Stanley Thornhill (Chalfont St. Giles, GB); Michael Leslie Gardner (Bristol, GB); Todd Ignasiak (Mountain View, CA); David Jonathan Lee (Reading, GB)

Assignee: Menlo Security, Inc.

G06F21/565G06F16/113G06F21/602G06F2221/034

Abstract

Claims (25)

1. A system, comprising:

a processor configured to:

determine, at a browser isolation system, that a user has selected, from an interface rendered in a browser executing on a client device, an archive comprising at least one file, wherein the browser isolation system is configured to provide a surrogate browser to facilitate communications between the client browser and the archive, and wherein the archive is hosted by a remote site;

determine, by the browser isolation system, that at least one of the selected archive or a subcomponent of the selected archive is encrypted and in response to determining that the at least one of the selected archive or the subcomponent of the selected archive is encrypted, prompt the user for a credential in the browser; and

selectively providing access to the archive, or providing access to a modified version of the archive based at least in part on a security policy applicable to the user and based on the user's response to the prompt; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the subcomponent is a file.

3. The system of claim 1 , wherein the subcomponent is an additional archive.

4. The system of claim 1 , wherein the user is prompted to select a sub-portion of content to download.

5. The system of claim 1 , wherein providing access to the modified version of the archive includes determining, for at least some files, which files do not pose a security threat, and offering those files which do not pose a security threat for download to the user.

6. The system of claim 1 , wherein, in the event the user's response does not include decryption information, the user is offered the ability to download unencrypted files.

7. The system of claim 1 , wherein the processor is further configured to provide a document viewer usable to view the at least one file.

8. The system of claim 1 , wherein in the event the system determines that the full contents of the archive do not pose a security threat, the user is provided an ability to download the archive.

9. The system of claim 1 , wherein in the event the system determines that the archive includes a file of a prohibited file type, the user is provided an ability to download a portion of the archive that excludes the file of the prohibited file type.

10. The system of claim 1 , wherein the processor is further configured to associate the archive with a unique identifier.

11. The system of claim 10 , wherein the unique identifier is associated with the user.

12. The system of claim 11 , wherein in the event a second user requests the same archive, the same archive will be assigned a second unique identifier, wherein the second unique identifier is associated with the second user.

13. A method, comprising:

determining, at a browser isolation system, that a user has selected, from an interface rendered in a browser executing on a client device, an archive comprising at least one file, wherein the browser isolation system is configured to provide a surrogate browser to facilitate communications between the client browser and the archive, and wherein the archive is hosted by a remote site;

determining, by the browser isolation system, that at least one of the selected archive or a subcomponent of the selected archive is encrypted and in response to determining that the at least one of the selected archive or the subcomponent of the selected archive is encrypted, and based at least in part on a security policy applicable to the user, prompting the user for a credential in the browser; and

selectively providing access to the archive, or providing access to a modified version of the archive based at least in part on a security policy applicable to the user and based on the user's response to the prompt.

14. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

determining, at a browser isolation system, that a user has selected, from an interface rendered in a browser executing on a client device, an archive comprising at least one file, wherein the browser isolation system is configured to provide a surrogate browser to facilitate communications between the client browser and the archive, and wherein the archive is hosted by a remote site;

determining, by the browser isolation system, that at least one of the selected archive or a subcomponent of the selected archive is encrypted and in response to determining that the at least one of the selected archive or the subcomponent of the selected archive is encrypted, and based at least in part on a security policy applicable to the user, prompting the user for a credential in the browser; and

selectively providing access to the archive, or providing access to a modified version of the archive based at least in part on a security policy applicable to the user and based on the user's response to the prompt.

Assignments (1)

Continuity (1)

References Cited (39)