Securing email communication in a networked environment

Abstract

The present invention relates to the field of cybersecurity, and more specifically to systems and methods for securing email communications in a networked environment. An aspect of the present invention relates to a method for securing email communications in a networked environment comprising an email server (1) and a containerized host server (2). The email server (1) receives an incoming email message (3) directed to a user (4), wherein the email message (3) includes at least one link (5) providing reference to a remote environment (6) and / or a downloadable content (7). A secured email message (8) is generated by removing the at least one remote environment link (5) and / or the downloadable content (7) from the incoming email message (3), and including at least one link (9) providing reference to a containerized environment (10). The user (4) is provided with the secured email message (8). Upon activation of the containerized environment link (9) by the user (4), the user (4) is redirected to the containerized environment (10) associated with the containerized environment link (9). Within the containerized environment (10), a content associated with the remote environment (6) and / or the downloadable item (7) is visually rendered in a user-accessible interface, while preventing the user (4) from inputting data and / or transferring of files to a user's device (11).

Description

[0001] SECURING EMAIL COMMUNICATION IN A NETWORKED ENVIRONMENT

[0002] FIELD OF THE INVENTION

[0003] The present invention relates to the field of cybersecurity, and more specifically to systems and methods for securing email communications in a networked environment. The present invention may find application in corporate networks, cloud computing infrastructures, or any interconnected systems enabling data exchange and communication between devices through an email service.

[0004] BACKGROUND

[0005] Email communication has become an indispensable tool in both personal and professional settings, facilitating rapid exchange of information across the globe. As the reliance on email has grown, so too has the sophistication of malicious actors seeking to exploit this medium for fraudulent activities. Phishing attacks, in particular, have emerged as a pervasive threat, wherein attackers deceive users into divulging sensitive information such as login credentials, financial data, or personal details by masquerading as trustworthy entities.

[0006] Phishing emails often masquerade as legitimate communications from trusted entities, enticing users to click on links to counterfeit websites, enter personal data, or download malicious content. Even with the implementation of spam filters, malware detection, and employee training programs, phishing attacks persist and continue to evolve in sophistication. These attacks can bypass technical defenses and exploit human factors, capitalizing on the likelihood that some users may not recognize or may inadvertently interact with malicious content.

[0007] Organizations face significant challenges in protecting users from these threats while maintaining the usability and efficiency of email communications. Reliance on user vigilance and adherence to best practices has proven insufficient, as mistakes can result in significant security breaches. Furthermore, current security measures are incapable of dynamically adjusting to individual user behaviors or risk profiles, leaving certain users more vulnerable to targeted attacks.

[0008] Moreover, the need to access external links and downloadable content for legitimate purposes complicates the ability to enforce strict security protocols without impeding productivity. Balancing the necessity for open communication channels with the imperative to safeguard against malicious activities remains a critical concern.

[0009] Existing systems fail to address these challenges. For example, EP3496343A1 describes an electronic mail security system that enables an administrator to examine email messages, including their contents, and to identify, but disable execution of, potentially malicious artifacts (e.g., Internet links, attachments, macros, headers) in an email message, and investigate each artifact. Despite existing efforts to mitigate risks associated with email-based threats, there remains a need for advancements that enhance the security of email communications. Addressing these challenges is important to protect users and organizations from the increasingly sophisticated tactics employed by malicious actors.

[0010] SUMMARY OF THE INVENTION

[0011] An objective of the present invention is to enhance email security by preventing users from inadvertently disclosing sensitive information to potentially malicious websites and / or interacting with potentially harmful content. Another objective of the present invention is to implement the herein described enhanced email security without significantly impeding user productivity, allowing for the inspection of the potentially malicious websites and / or potentially harmful downloadable content through user interaction to assess their security risks. Yet another objective of the present invention is to implement the herein described enhanced email security in a manner that allows for easy scalability and integration with existing security infrastructure within organizations. These objectives can be achieved through various aspects of the present invention.

[0012] Therefore, the present invention as described herein demonstrates an improved effectiveness in preventing users from falling victim to phishing attempts, malware infections and other exploits enacted by malicious actors. The herein described combination of containerized environments, user input prevention, and dynamic security measures based on user risk profiles provides a comprehensive solution to the critical problem of email-based threats. Further embodiments could explore the scalability of the system and its potential integration with other security technologies to create a robust, multi-layered defense against evolving cyber threats.

[0013] The summary below introduces a selection of key embodiments of the invention in a simplified form. These embodiments are described in further detail throughout the detailed description of the disclosure below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0014] An aspect of the present invention relates to a method for securing email communications in a networked environment, comprising the steps of:

[0015] - receiving an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or a downloadable content,

[0016] - generating a secured email message by removing the at least one remote environment link and / or the downloadable content from the incoming email message, and including at least one link providing reference to a containerized environment, - providing the user with the secured email message, upon activation of the containerized environment link by the user,

[0017] - redirecting the user to the containerized environment associated with the containerized environment link, and,

[0018] - within the containerized environment, rendering a content associated with the remote environment and / or the downloadable content while preventing the user from inputting data and / or transferring of files to a user's device.

[0019] In embodiments, the containerized host may comprise a volatile storage medium, and the containerized host environment may be configured to be implemented on the volatile storage medium, thereby preventing any persistent data from the remote environment content and / or the downloadable content from being stored on any non-volatile storage medium. Preferably, the downloadable content from the remote environment and / or the incoming email message can be stored in an external storage space to facilitate secure access and rendering within the containerized environment.

[0020] In embodiments, terminating the containerized environment by the user may delete all temporary data created during the user's interaction, preferably within 15 seconds after terminating the containerized environment.

[0021] In embodiments, the containerized environment may be further configured to enable the user to download files from the remote environment to the containerized environment on the containerized host server for inspection.

[0022] In embodiments, the containerized environment link may comprise a domain reference configured to associate the containerized environment link with the corresponding incoming email message for the intended user, and a signed encoded token containing the remote environment link, wherein the signed encoded token is configured to be validated upon activation of the containerized environment link, and upon successful validation of the signed encoded token, is configured to retrieve the remote environment link from the token for inspection on the containerized environment.

[0023] In embodiments, the secured email message may be generated by retrieving the source code of the incoming email message, including the text to be displayed, and generating a new email message by including the text from the incoming email message and the at least one containerized environment link, thereby preventing any client-side caching from the email server.

[0024] In embodiments, interaction between the user and the containerized environment may be established through a web browser application configured to create a communication session between the containerized environment and the remote environment, thereby rendering the contents of the remote environment within the web browser application. Preferably, the interaction between the user and the containerized environment may be facilitated through a Virtual Network Computing (VNC) connection. In embodiments, the secured email message may further include one or more security alerts or notifications related to a safety classification of at least one removed remote environment link and / or downloadable content.

[0025] In embodiments, the remote environment may comprise a web page accessible via the Hypertext Transfer Protocol (HTTP) or the Hypertext Transfer Protocol Secure (HTTPS).

[0026] In embodiments, the downloadable content may comprise one or more of the following attachments associated with the incoming email message: an inline attachment, a file attachment, an embedded attachment, and / or a reference attachment. This handles various ways malicious content can be included. In embodiments, the containerized environment may include a unique identifier token that enables logging of the user interactions within the containerized environment.

[0027] In embodiments, the method may further comprise the step of determining, by an administrator, whether the remote environment can be classified as allowable, enabling access to the remote environment link for the user if classified as allowable , or continuing to prevent access for the user if classified as not allowable.

[0028] In embodiments, the method may further comprise the steps of enabling access to the remote environment associated with the remote environment link for the user or any other user of the networked environment if the remote environment is classified as allowable, or preventing subsequent access to the remote environment associated with the remote environment link for the user or any other user of the networked environment if the remote environment is classified as not allowable, by the administrator; for example, if it is considered as not secure and / or it is against company policy.

[0029] In embodiments, the method may further comprise generating an access request from the user for the remote environment link, and transmitting the access request to the administrator to determine whether the remote environment can be classified as allowable.

[0030] In embodiments, the step of determining of whether the remote environment can be classified as allowable may further comprise characterizing the remote environment on the containerized environment through a set of security parameters, including a reputation of the remote environment, an associated safety classification, the presence of known vulnerabilities, and / or an analysis of potential phishing indicators.

[0031] In embodiments, the secured email message includes the same subject line and metadata as the original incoming email message, while replacing any remote links and / or downloadable content with one or more links pointing to a containerized environment.

[0032] In embodiments, the containerized environment is instantiated dynamically upon activation of the containerized environment link by the user, such that a new, isolated environment is created per user session. In embodiments, the containerized environment comprises a browser-based rendering engine configured to visually display the content in a graphical user interface accessible to the user.

[0033] In embodiments, the containerized environment prevents user interaction with the rendered content by blocking one or more of the following: form input submission, script execution, and file downloads to the user's device.

[0034] In embodiments, the containerized environment is automatically terminated after a predefined time period or upon detecting attempted user interaction that violates predefined restrictions.

[0035] In embodiments, access to the containerized environment is granted using a tokenized or time-limited session identifier embedded in the containerized environment link, thereby ensuring secure and sessionspecific rendering.

[0036] In embodiments, the user is distinct from the administrator of the networked environment.

[0037] In embodiments, interaction between the user and the content in the containerized environment occurs prior to generation of the access request from the user to the administrator.

[0038] In embodiments, prior to or during said interaction, the containerized environment is configured to prompt the user to provide a safety assessment of the remote environment link and / or downloadable content, including verifying whether the user was expecting the link, thereby recording user-side validation data usable for security analysis and user training.

[0039] In embodiments, the containerized environment may present to the user a safety verification prompt configured to request confirmation whether the user expected the remote environment link and / or downloadable content, and to collect a user-provided safety assessment, thereby contributing to adaptive user-security training within the networked environment .

[0040] In embodiments, the containerized environment may present to the user a prompt requesting confirmation whether the user was expecting to receive the remote environment link and / or downloadable content.

[0041] In embodiments, the containerized environment may present to the user a prompt instructing the user to assess the tone and urgency of the associated email message; and / or

[0042] In embodiments, the containerized environment may present to the user a prompt instructing the user to verify the sender's email address or domain name associated with the remote environment link and / or downloadable content.

[0043] Another aspect of the present invention relates to a system for securing email communications in a networked environment comprising an email server and a containerized host server, wherein the email server is configured to receive an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or a downloadable content, generate a secured email message by removing the remote environment link and / or the downloadable content from the incoming email message, and including at least one link providing reference to a containerized environment, and provide the user with the secured email message, wherein the containerized host server is configured to host the containerized environment such that upon activation of the containerized environment link by the user, the user is redirected to the containerized environment associated with the containerized environment link, and, within the containerized environment, display a content associated with the remote environment and / or the downloadable content while preventing the user from inputting data and / or transferring of files to a user's device.

[0044] Another aspect of the present invention relates to a computer program product comprising computerexecutable instructions stored on a non-transitory computer-readable medium, which when executed by one or more processors, cause the one or more processors to perform a method for securing email communications comprising the steps:

[0045] - receiving, by an email server, an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or a downloadable content; generating a secured email message by removing the at least one remote environment link and / or the downloadable content from the incoming email message, and including at least one link providing reference to a containerized environment;

[0046] - providing the user with the secured email message;

[0047] - upon activation of the containerized environment link by the user, redirecting the user to the containerized environment associated with the containerized environment link; and,

[0048] - within the containerized environment, rendering a content associated with the remote environment and / or the downloadable content while preventing the user from inputting data and transferring files to a user's device.

[0049] Another aspect of the present invention relates to non-transitory computer-readable storage medium storing computer-executable instructions which, when executed by one or more processors, cause the processors to perform a method for securing email communications comprising the steps:

[0050] - receiving, by an email server, an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or a downloadable content; generating a secured email message by removing the at least one remote environment link and / or the downloadable content from the incoming email message, and including at least one link providing reference to a containerized environment;

[0051] - providing the user with the secured email message;

[0052] - upon activation of the containerized environment link by the user, redirecting the user to the containerized environment associated with the containerized environment link; and, - within the containerized environment, rendering a content associated with the remote environment and / or the downloadable content while preventing the user from inputting data and transferring files to a user's device.

[0053] Another aspect of the present invention relates to a containerized host server for securing email communications, comprising: a network interface configured to receive a secured email message, wherein the secured email message includes a link to a containerized environment; a processor configured to execute a containerization module that, upon activation of the link by a user, redirects the user to a containerized environment associated with the link; the containerized environment being hosted by the containerized host server and configured to display content associated with the email while preventing the user from inputting data and / or transferring files to a user's device; a security module configured to enforce restrictions within the containerized environment, ensuring that no unauthorized actions, including data input or file transfers, are performed by the user.

[0054] Another aspect of the present invention relates to a containerized host server configured to secure email communications, the containerized host server comprising:

[0055] - a network interface module configured to receive a request for access to a containerized environment from a user, wherein the request is triggered by activation of a link in a secured email message;

[0056] - a containerization module configured to provide the user with access to the containerized environment associated with the link, wherein the containerized environment is hosted by the containerized host server and is configured to display content associated with a remote environment and / or downloadable content from an email message associated with the secured email message;

[0057] - a security module configured to prevent the user from inputting data and / or transferring files to a user's device within the containerized environment.

[0058] Another aspect of the present invention relates to a method for securing email communications in a networked environment comprising an email processing server and a containerized host server, the method comprising the steps of:

[0059] - integrating with an existing email server to retrieve an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or downloadable content;

[0060] - analyzing the retrieved email message to identify the at least one remote environment link and / or downloadable content;

[0061] - generating a secured email message by replacing the identified at least one remote environment link and / or downloadable content with at least one link providing reference to a containerized environment; - delivering the secured email message to an email account of the user on the existing email server;

[0062] - upon activation of the containerized environment link by the user, redirecting the user to the containerized environment associated with the containerized environment link hosted on the containerized host server; and

[0063] - within the containerized environment, rendering content associated with the remote environment and / or downloadable content while preventing the user from inputting data or transferring files to the user's device.

[0064] Another aspect of the present invention relates to a method for securing email communications in a networked environment comprising an email server and a containerized host server, the method comprising the steps of:

[0065] - receiving, by the email server acting as a mail exchanger for a recipient domain, an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or downloadable content;

[0066] - analyzing the incoming email message to identify the at least one remote environment link and / or downloadable content;

[0067] - generating a secured email message by replacing the identified at least one remote environment link and / or downloadable content with at least one link providing reference to a containerized environment;

[0068] - relaying the secured email message to the recipient mail exchanger associated with an email account of the user on the recipient mail exchanger;

[0069] - upon activation of the containerized environment link by the user, redirecting the user to the containerized environment associated with the containerized environment link hosted on the containerized host server; and

[0070] - within the containerized environment, rendering content associated with the remote environment and / or downloadable content while preventing the user from inputting data or transferring files to the user's device.

[0071] Another aspect of the present invention relates to an email server configured to secure email communications, the email server comprising:

[0072] - a receiver module configured to receive an incoming email message directed to a user, wherein the email message includes at least one link providing reference to a remote environment and / or a downloadable content;

[0073] - a processing module configured to generate a secured email message by removing the at least one remote environment link and / or the downloadable content from the incoming email message, and including at least one link providing reference to a containerized environment; and / or

[0074] - a transmitter module configured to provide the user with the secured email message; wherein the email server is further configured to cooperate with a containerized host server such that upon activation of the containerized environment link by the user, the user is redirected to the containerized environment associated with the link, and within the containerized environment, a content associated with the remote environment and / or the downloadable item is displayed while preventing the user from inputting data and / or transferring files to a user's device.

[0075] Aspects of the invention are detailed in the accompanying independent and dependent claims. Features in the dependent claims may be freely combined with those of the independent claims, as well as with features from other dependent claims, where appropriate, and not solely in the explicit combinations set forth in the claims. Specifically, any embodiments of the method for securing email communications in a networked environment, as described herein, also serve as embodiments of the system for securing email communications in a networked environment, and vice versa. These considerations similarly apply to other aspects of the present invention.

[0076] DESCRIPTION OF THE FIGURES

[0077] The following description of the figures relates to specific embodiments of the disclosure which are merely exemplary in nature and not intended to limit the present teachings, their application or uses. In the different figures, the same reference signs refer to the same or analogous elements.

[0078] Figure 1 shows a flowchart illustrating the steps of a method (100) for securing email communications according to an embodiment of the present invention implemented through an interface connection with an existing mail server.

[0079] Figure 2 shows a flowchart illustrating the steps of a method (200) for securing email communications according to another embodiment of the present invention implemented through a mail exchange server. Figure 3 shows a flowchart illustrating the steps of a method (300) for determining the allowability of external content.

[0080] Figure 4 shows a schematic diagram of a system (500) for securing email communications according to aspects of the present invention.

[0081] DETAILED DESCRIPTION

[0082] It will be readily understood that the aspects of the present disclosure, as generally described herein, and illustrated in the figures, can be arranged, substituted, combined, and designed in a wide variety of different configurations, all of which are explicitly contemplated and make part of this disclosure. This description is meant to aid the reader in understanding the technological concepts more easily, but it is not meant to limit the scope of the present disclosure, which is limited only by the claims. As outlined above, the present invention generally relates to systems and methods for securing email communications in a networked environment. The systems and methods employ an email server configured to receive an email directed to an email user and secure the incoming email by removing any potentially harmful items. The user is then provided with a secure version of the email containing new links redirecting the user to a secure environment hosted on a containerized host server where the user can inspect and interact with potentially harmful items without risking e.g. sensitive information being accessed by untrusted entities or damaging the user's devices.

[0083] As used herein, and unless otherwise specified, the term "networked environment" refers to a system comprising interconnected computing devices and servers that communicate over network protocols, such as the Internet, intranets, or local area networks (LANs). Generally, the networked environment includes at least one, but typically a plurality, of email users, an email server configured as specified hereafter, and a containerized host server configured as specified hereafter. Specific embodiments of a networked environment may include corporate networks, cloud computing infrastructures, or any interconnected systems enabling data exchange and communication between devices.

[0084] As used herein, and unless otherwise specified, the term "user" refers to any individual, entity, or mailbox configured to receive and interact with email communications within the networked environment as defined herein. A user may include an email recipient accessing email services to view, respond to, or otherwise interact with incoming email messages and content embedded or linked within those messages. For example, the user may include employees within a corporate network, individual users of a managed email service, or any authorized individuals within an organization's networked environment. The user also explicitly encompasses shared mailboxes, distribution lists, and other types of mailboxes accessible by multiple individuals or automated systems within an organization. The user may thus also refer to a group of users.

[0085] As used herein, and unless otherwise specified, the term "administrator" is used to distinguish individuals responsible for managing or monitoring user activities for compliance with security protocols It should be noted, however, that an administrator can also act as a user of the networked environment in other contexts.

[0086] As used herein, and unless otherwise specified, the term "email server" refers to a server or platform responsible for managing the sending, receiving, routing, and storage of email messages using standard email protocols such as SMTP (Simple Mail Transfer Protocol), IMAP (Internet Message Access Protocol), or POP3 (Post Office Protocol version 3). In an embodiment the email server can be configured to operate as a mail transfer agent (MTA) directly receiving incoming email messages via the Mail Exchange (MX) record for a domain. In this configuration, the email server processes the email message, applies any necessary modifications or security measures, and forwards the updated message to the recipient's mail server for delivery. In another embodiment the email server can be configured as an integrated component within an existing mail system interacting via an API. In this setup, the email server performs processing and modifications on email messages within the existing system infrastructure, such as replacing links or attachments, without altering the mail flow via the MX records. Exemplary embodiments of email server configurations can include Microsoft Exchange Server, Google Workspace, Postfix, Sendmail, and other mail transfer agents or messaging platforms that facilitate email communication. The email server may operate independently or as part of a larger email infrastructure, such as a corporate or cloud-based messaging system, to ensure reliable delivery and access to email messages.

[0087] As used herein, and unless otherwise specified, the term "email message" refers to any electronic message received within a networked environment herein to an intended user or group of users as defined. This encompasses email messages received through multiple pathways. In an embodiment the incoming email message may be received directly by an email server functioning as a MX for the recipient domain. In this case, the method includes the step of intercepting and processing the email message before it is delivered to the user's mail system, ensuring that harmful elements are replaced or secured as specified in the claimed method as will be set out below. In another embodiment the incoming email may be processed through integration with an existing mail server infrastructure. Here, the system interacts with the mail server via an API to retrieve email content for processing. After applying the necessary security measures, the modified email is delivered to the intended recipient. The present invention is thus not limited to a specific email server implementation and covers diverse operational configurations for securing incoming email communications.

[0088] As used herein, and unless otherwise specified, the term "remote environment" refers to any computing resource, website, server, or network-accessible service that is outside the herein defined networked environment. Typically the remote environment is referenced by a link within an email message and is accessible over a network connection such as the Internet. Exemplary embodiments may include internet websites hosted on external servers, cloud-based applications, file servers, or any online resources identified by URLs or network addresses.

[0089] Conversely, as used herein, the term "link providing reference to a remote environment," or simply "remote environment link," refers to a hyperlink or reference within an email that directs the user to content located in the herein defined remote environment. Specific embodiments of a remote environment link may include any reference accessible via the Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) protocols, as well as links associated with other network protocols or applications facilitating access to remote resources.

[0090] As used herein, and unless otherwise specified, the term "downloadable content" refers to any file or digital asset that can be transferred from a remote environment to a user's device, typically initiated by the user interacting with an email attachment or hyperlink. Specific embodiments of downloadable content include inline attachments, file attachments, embedded attachments, and / or reference attachments. Exemplary embodiments may include documents (e.g., PDFs, Word files), executable programs, media files (e.g., images, videos), spreadsheets, or any other files intended for download. Such documents may contain hidden or embedded elements that are potentially harmful, designed to compromise network security or otherwise introduce security risks.

[0091] As used herein, the term "email processing server" refers to a server or computing system configured to perform the analysis and replacement of potentially harmful content within incoming email messages. This server is responsible for generating a secured email message by removing or neutralizing harmful elements, such as links to remote environments or downloadable content, and replacing them with secure links to a containerized environment in accordance with embodiments of the present invention.

[0092] The email processing server may function as an independent component of the system or as part of the email server infrastructure. In configurations where the email server operates as a mail exchanger (MX) for the recipient domain, the email processing server may be integrated directly with the email server to perform its operations. Alternatively, in configurations where the system integrates with an external or preexisting email server (e.g., Microsoft Exchange, Google Workspace), the email processing server may be optional. In such cases, the processing tasks may be executed within the external email server itself, facilitated via an API or similar communication interface.

[0093] As used herein, and unless otherwise specified, the term "containerized host server" refers to a server or computing system configured to host and manage one or more isolated computing environments, herein referred to as containerized environments, where applications or processes are run in isolated user spaces, herein referred to as containers, leveraging operating-system-level virtualization. Exemplary embodiments include servers running containerization platforms such as Docker, Kubernetes, or Linux Containers (LXC).

[0094] Conversely, as used herein, the term "containerized environment" refers to an isolated computing environment created within a containerized host server that allows for secure interaction with content associated with the remote environment and / or secure execution of downloadable content as defined herein. The containerized environment is advantageously segregated from the user's device and network to mitigate potential security risks such as unauthorized access or malware propagation.

[0095] Exemplary embodiments of a containerized environment include Docker containers running one or more specific applications, sandboxed browser instances, or isolated microservices within a cloud infrastructure. For example, remote environment links may be rendered or interacted with using emulated versions of web browsers such as Chrome, Chromium, Edge, Brave, or Firefox. Similarly, downloadable content can be securely processed using emulated browser environments (e.g., Chrome or Chromium for media-related attachments) or Linux-based containers configured for handling executables or other file types.

[0096] As used herein, and unless otherwise specified, the term "link providing reference to a containerized environment," or simply "containerized environment link," refers to a hyperlink or reference within an email that directs the user to access the containerized environment as defined herein, instead of directly accessing the remote environment or downloadable content. Specific embodiments include URLs containing tokens or parameters that route the user to a secure container session, or links pointing to a web application that loads content within an isolated environment.

[0097] As used herein, and unless otherwise specified, the term "remove environment content", or simply content when used in association with the remote environment, refers to any data, webpages, applications, or resources originating from the remote environment and displayed or made accessible within the containerized environment. Exemplary embodiments include web pages rendered within a containerized browser, documents opened in a secure viewer, or media files played within an isolated media player. The remove environment content may further include any downloadable content as previously defined when originating from user interaction with the remove environment as opposed to from an email attachment.

[0098] As used herein, and unless otherwise specified, the term "file transfer" when used in association with the remote environment and / or email attachments, refers to the act of copying, downloading, or transmitting files or data from a computing environment to the user's local environment, specifically the user's device. Examples of file transfer include downloading content from the containerized environment to the local file system, saving an image or media file to the user's device, or any action that moves files from the secure container to the user's local environment.

[0099] As used herein, and unless otherwise specified, the term "user data input" refers to the user's action of providing information to a system through text entry, file uploads, selections, or any other forms of data submission. Examples of data input include typing into text fields, filling out and submitting forms, uploading documents or images, selecting options from drop-down menus, or any interaction where data is sent from the user to the system

[0100] As used herein, and unless otherwise specified, the term "secured email message" refers to an email message that has been modified to remove and / or replace remote environment links and / or downloadable content with containerized environment links as defined herein. In one embodiment, the secured email message may comprise the original incoming email message where hyperlinks are replaced with secure access links to a sandboxed environment, or attachments are replaced with links to securely preview files within a container. An example of a secured email message includes an email where the original hyperlinks or attachments have been replaced with links to the containerized environment. As used herein, and unless otherwise specified, the term "user interface" refers to any graphical, textual, or interactive interface configured to enable the user as defined herein to access, view, and interact with email communications and associated content within the networked environment. A user interface may include, for example, a web-based email portal, a dedicated email client, or a secure content viewer, and is designed to facilitate user interaction with email messages, links, attachments, and any redirected or containerized environments. The user interface may be presented on a user's computing device or via a remote access session, and may also encompass embedded modules or rendered displays generated by external services. The user interface may support various modes of input and output, including, for example, mouse, keyboard, or touchscreen interactions, subject to the restrictions as defined herein (e.g., blocked input or disabled file transfer).

[0101] As used herein, and unless otherwise specified, the term "administrative user interface" refers to any graphical, textual, or interactive interface configured to enable an administrator as defined herein to monitor, manage, or control aspects of user activity, email communications, or content access within the networked environment. In embodiments the administrative user interface may provide tools or modules for reviewing access requests, inspecting potentially malicious content, classifying links or attachments as allowable or not allowable, and enforcing security policies. For example, the administrative user interface may include dashboards, control panels, logging views, or approval modules accessible through webbased platforms, standalone applications, or system-integrated environments. The administrative user interface may be distinct from or embedded within standard user interfaces, and may be accessible only by individuals with appropriate administrative privileges.

[0102] An embodiment of the present method will be discussed further with reference to Figure 1, which shows a flowchart of the method (100) for integration with existing email server infrastructures through an interface (e.g. API). It is understood that additional steps can be provided before, during, and after the steps of the method, and that some of the steps described can be replaced or eliminated for other implementations of the method.

[0103] The present embodiment of the method (100) offers advantages for environments where interface connections, such as an API, are available. This integration minimizes disruption to existing email workflows, allowing the email security features to be implemented without requiring changes to MX records or the underlying email infrastructure. By leveraging APIs, the method ensures seamless compatibility with enterprise-grade mail servers such as Microsoft Exchange or Google Workspace, enabling the integration of the security measures directly into the email service's operational flow. Additionally, this approach offers scalability across both cloud-based and on-premise infrastructures, providing flexibility for organizations of various sizes while reducing operational overhead. This API-based implementation enhances security without requiring significant changes to existing infrastructure, providing a balance between ease of integration and robust email protection.

[0104] The method (100) begins at step (101) where an incoming email message (2) directed to a user (3) within the networked environment is received. The incoming email message (2) may be retrieved by integrating with an existing email server through an interface, such as an Application Programming Interface (API), after the message has been initially received and stored by the existing mail server. This integration allows the email server to function as a relay between the incoming email and the system processing the email message for processing purposes.

[0105] The incoming email message (2) may include at least one link (5) providing reference to a remote environment (50) and / or downloadable content (4), which could pose a security risk if accessed directly by the user (3). These links may be presented in various formats, such as hyperlinks embedded in the email body or attachments containing references to external resources. To prevent the user from directly accessing the incoming message (2), the incoming message (2) is advantageously received and processed by the email server (30) within the networked environment (10) before the user is made aware of the incoming message (2), as outlined next. Once the incoming email is retrieved via the interface (e.g. API), the method (100) continues in step (102), by processing the incoming email message (2) to generate a secured email message (7). This processing may involve identifying and removing the original remote environment links (5) and / or downloadable content (4) embedded within the email. In place of these elements, at least one containerized environment link (6) can be inserted, which provides secure access to a containerized environment (60) described below. This "replacement" ensures that any potentially harmful interactions with the remote environment (50) or the downloadable content (4) occur within an isolated and secure containerized environment, thereby safeguarding the user's device (20) and other components of networked environment (10).

[0106] In certain embodiments, the method may comprise inserting a plurality of containerized environment links (6), each containerized environment links (6) corresponding to at least distinct remote environment link (5) and / or downloadable content (4). In this way, the user can select which remote environment link (5) and / or downloadable content (4) to interact with first or at all.

[0107] In embodiment, processing the incoming email message (2) may comprise identifying include links such as URL links embedded or otherwise included in the email messages. While an URL link has been explicitly disclosed, the present technology can be used to evaluate any similar link, such as a clickable email address or other clickable object that launches a program such as a web browser, an email program, or other similar resource.

[0108] In embodiments, the containerized environment link may comprise a domain reference configured to associate the containerized environment link with the corresponding incoming email message for the intended user, and a signed encoded token containing the remote environment link, wherein the signed encoded token is configured to be validated upon activation of the containerized environment link, and upon successful validation of the signed encoded token, is configured to retrieve the remote environment link from the token for inspection on the containerized environment. This provides a secure way to pass the original link for rendering in the safe environment.

[0109] In embodiments, the secured email message may be generated by retrieving the source code of the incoming email message, including the text to be displayed, and generating a new email message by including the text from the incoming email message and the at least one containerized environment link. By generating an altogether new messages any client-side caching from the email server can be securely prevented, avoiding the storing of potentially malicious hidden code.

[0110] In embodiments, the method may include the step of ignoring predefined downloadable content that has been previously classified as "allowable," as defined herein. For example, if the downloadable content consists of non-threatening resources such as images, this step can help minimize unnecessary processing. The method may involve examining the downloadable content for specific resource information, such as file extensions like ".jpg," ".png," ".gif," or similar formats, but also other benign file types such as plain text files (".txt"), PDF documents that meet specific safety criteria (".pdf"), or spreadsheet files without macros (",xls" or ".xlsx"). This information is then compared against a predefined list of allowable content types. By focusing only on content that poses increased potential risks, such as, for example, executable files (".exe"), script files (".js" or ".vbs"), or documents with embedded macros (".docm" or ".xlsm"), the method optimizes system efficiency while ensuring that routine or benign files are excluded from further scrutiny. This selective processing allows the system to allocate resources effectively while maintaining robust security measures.

[0111] In step (103), once the secured email message (7) is created, it can be provided to the user (3) by the email server (30). This secured email message (7) advantageously retains the original format, information (e.g. text) and appearance of the incoming email (2) but replaces the original links and content with secure containerized environment links (6). This allows the user (3) to interact with the email without being exposed to direct risks from potentially malicious remote environments or files. Embodiments of this step may include delivering the secured email message (7) to the user through an email client application, webmail interface, or mobile email platform configured to interact with the email server (30).

[0112] In embodiments, the secured email message may further include one or more security alerts or notifications related to a safety classification of at least one removed remote environment link and / or downloadable content. This informs the user about potential threats and risks.

[0113] In step (104), upon the user's activation of the containerized environment link (6), the user (3) is redirected to the containerized environment (60) advantageously hosted on a containerized host server (40). Embodiments of the containerized environment can include an isolated computing environment designed to safely manage interactions with the content (8) associated with the remote environment (50) and / or downloadable content (4). Redirecting the user (3) to the containerized environment ensures that all interactions occur in a controlled setting, segregated from the user's local environment, thus reducing the risk of unauthorized data access or malware execution.

[0114] In embodiments, the containerized environment may include a unique identifier token that enables logging of the user interactions within the containerized environment. This allows monitoring user activity in the safe environment, which can be reported to an administrator for assessing the allowability of the content as will be outlined further below.

[0115] Step (105) involves rendering the content (8) associated with the remote environment (50) and / or the downloadable content (4) within the containerized environment (60). In certain embodiments this may include rendering a web page in a sandboxed browser, previewing an attachment in a secure viewer, or executing potentially harmful files in an isolated container.

[0116] As used herein "rendering" refers to the process of interpreting, processing, and presenting data or resources into a visually or interactively consumable format. Rendering often involves converting raw or encoded data (e.g., HTML, JSON, image files, or video streams) into a displayable output that adheres to the required format, structure, or design for end-user interaction. This process may include tasks such as decoding, applying styles, integrating scripts, or assembling multiple data sources into a cohesive and functional presentation. It should be appreciated that rendering as defined herein is distinct from merely displaying the content, which typically refers to the action of showing pre-processed or pre-rendered data directly on a user interface, preventing any further user interaction with the displayed content.

[0117] Additionally, the system prevents the user (3) from inputting sensitive data, such as login credentials, or transferring files from the containerized environment to the user's device (20), thereby mitigating the risks of data breaches or malware propagation. Embodiments of this step may involve additional security measures, such as restricting clipboard access, disabling file downloads, or monitoring user activity within the containerized environment for signs of anomalous behaviour.

[0118] In embodiment, the containerized environment may be further configured to enable the user (3) to download files or other content (8) from the remote environment to the containerized environment (60) on the containerized host server for further inspection. This allows safe analysis of suspicious or hidden files while still ensuring the security provided by the containerized environment (60).

[0119] In embodiments, interaction between the user (3) and the containerized environment (60) may be established through a web browser application configured to create a communication session between the containerized environment (60) and the remote environment (50), thereby rendering the contents of the remote environment (50) within the web browser application. This allows safe viewing of the remote site without requiring the user from installing or updating software application on the user device, ensuring compatibility and comfort of use.

[0120] In a further embodiment the interaction between the user and the containerized environment may be facilitated through a Virtual Network Computing (VNC) connection. This configuration enables the user to securely interact with the containerized environment by providing a remote desktop-like interface, where the containerized environment is rendered and controlled via the VNC protocol. For example, the user's device acts can act as a client, connecting to the containerized environment hosted on the server, which acts as the VNC server. The implementation of a VNC connection achieves a secure and seamless method for users to interact with external content without compromising the integrity of the user device or the networked environment.

[0121] In a further embodiment, the interaction between the user and the containerized environment may include generating one or more visual prompts aimed at promoting user education and awareness. For example, the prompt may ask whether the user was expecting to receive the remote environment link and / or downloadable content. In another example, the prompt may instruct the user to evaluate the tone and urgency of the message accompanying the remote environment link and / or downloadable content, and / or to verify the email address or domain name associated with the remote environment link and / or downloadable content. In this manner, the user inspection process supports the development of user vigilance and critical assessment skills.

[0122] In this way, an additional layer of email security is realized by actively involving the user in the verification process of potentially unsafe content. By prompting the user, within the containerized environment, to provide a safety assessment of the remote environment link and / or downloadable content, such as confirming whether the user was expecting the received link, the system enables contextual and userspecific validation that cannot be achieved through automated inspection alone.

[0123] Advantageously the validation process occurs within the isolated containerized environment, ensuring that no interaction or user input can compromise the user's device, while still allowing the system to record validation data associated with the unique identifier token of the session. In this way, continuous user education and awareness is promoted by prompting users to reflect on the origin and legitimacy of received content, thereby improving long-term cybersecurity behaviour and creating a self-reinforcing learning mechanism within the networked environment.

[0124] Advantageously, the VNC client can be embedded in a web browser or provided as a standalone application on the user's device. Security measures, such as encrypted VNC sessions (e.g., via SSL / TLS), can be implemented to protect communication between the user and the containerized environment. This method ensures that all rendering and execution of the remote environment content occurs within the containerized environment, isolated from the user's device. The VNC connection allows the user to view and interact with the containerized environment in real-time while preventing direct data transfer or local execution of potentially harmful files.

[0125] The above-described method (100) in step (106) provides the user with the ability to interact with the remote environment content (8) and / or downloadable content (4) in a secure, controlled environment. One aspect of this interaction may involve enabling the user to inspect the available content to assess the security of the remote environment (50) and / or the downloadable content (4).

[0126] Embodiment of this user interaction can include evaluating the nature of the content, identifying potential risks, or verifying its legitimacy based on visible characteristics. However, the specific implementation of the interaction process, as well as the handling and interpretation of security-related information once the inspection is completed by the user, may vary depending on the technical configuration of the method and the particular characteristics of the networked environment. The steps described below, therefore, represent an optional yet logical extension of the above-listed method, providing additional functionality for security assessment while remaining adaptable to different embodiments.

[0127] An embodiment of the present method will be discussed further with reference to Figure 2, which shows a flowchart of the method (200) for implementation through an existing mail service via an email server, such as one designated by the MX record associated with an external recipient domain. It is understood that additional steps may be provided before, during, and after the steps of the method, and that some of the steps described herein can be replaced or omitted for other implementations of the method.

[0128] The present embodiment (200) offers significant advantages in environments where direct control over the email server (e.g., through MX records) is available. By centralizing email security at the domain level, this implementation can ensure that all incoming emails are screened before reaching the end-user's mail server, providing a robust first line of defense against malicious content. Moreover, centralizing processing at the email server level simplifies the enforcement of organization-wide security policies and facilitates streamlined management of inbound email traffic. This approach may thus enhance security while maintaining full compatibility with standard email delivery protocols, ensuring seamless integration with existing systems.

[0129] The method (200) begins at step (201), where the email server receives an incoming email message (2) directed to a user (3) within the networked environment. This may occur when an email is sent to a recipient within the domain, and the Domain Name System (DNS) MX records for the recipient domain route the email to the designated email server. This configuration can ensure that all emails addressed to the domain's users are routed through the email server for initial screening and processing. The incoming email message (2) may include at least one link (5) referencing a remote environment (50) and / or downloadable content (4), as previously described. The method (200) begins at step (201), where the email server (30) receives an incoming email message (2) directed to a user (3) within the networked environment. This occurs when an email is sent to a recipient within the domain, and the Domain Name System (DNS) MX records for the recipient domain route the email to the designated email server. This configuration ensures that all emails addressed to the domain's users are routed through the email server for initial screening and processing. The incoming email message (2) may include at least one link (5) referencing a remote environment (50) and / or downloadable content (4), as previously described.

[0130] In step (202), the incoming email message (2) is forwarded to an email processing server as defined herein for processing in accordance with the present invention. To ensure the user does not directly access the unprocessed incoming message (2), the email server (30) within the networked environment (10) advantageously forwards the message to the processing server prior to user notification of its arrival. This isolation is an advantageous security measure to prevent harmful content from reaching the user unprocessed.

[0131] At step (203), the email processing server analyzes the incoming email message (2) and generates a secured email message (7). This email processing involves identifying and removing the original remote environment links (5) and / or downloadable content (4) embedded within the email. Additionally, other processing steps as described in previous embodiments may be applied.

[0132] In step (204), the secured email message (7) is sent back to the email server for further handling. This reintegration into the email server workflow ensures that the secured message seamlessly replaces the original email message in the delivery pipeline.

[0133] Next, in step (205), the email server forwards the secured email message (7) to the user (3). This step may involve delivering the email through various client interfaces, such as desktop email applications, webmail portals, or mobile platforms, all of which are configured to interact with the email server (30).

[0134] At step (206), when the user activates a containerized environment link (6) embedded in the secured email message (7), the user is redirected to a containerized environment (60) hosted on a containerized host server (40). This redirection isolates the user's interaction with the email content, ensuring that any potentially harmful elements are securely contained.

[0135] Step (207) involves rendering the content (8) associated with the remote environment (50) and / or the downloadable content (4) within the containerized environment (60). This rendering occurs in a controlled, secure manner that prevents direct interaction with the user's device or network.

[0136] Finally, in step (208), the method allows the user to interact with the rendered remote environment content (8) and / or downloadable content (4) securely. The containerized environment provides tools and interfaces to enable the user to inspect the available content. One aspect of this interaction may involve inspection of the rendered content to assess the security of the remote environment (50) and / or the downloadable content (4).

[0137] It should be appreciated that any embodiments of the method (200) described herein may also incorporate features and embodiments of the method (100) discussed with reference to Figure 1, provided there is no technical incompatibility. This flexibility ensures that the invention can accommodate varying configurations while maintaining robust security and operational efficiency.

[0138] Figure 3 illustrates a flowchart of a method (300) for determining the allowability of the remote environment (50) and / or downloadable content (6), particularly focusing on enabling controlled access to potentially secure content. This method involves additional steps that may take place after the inspection of remote environment content (50) and / or downloadable content (6) by incorporating administrative review and broader access control measures.

[0139] In step (301), the user (3) inspects the remote environment (50) and / or downloadable content (6) within a secure containerized environment (8). This inspection may involve manually reviewing the content's characteristics, such as its behaviour, metadata, or visual appearance, to assess potential risks. Optionally, logging activations of the containerized environment link (6) and interactions with the content can later be reviewed by an administrator (9).

[0140] In step (302), after inspection, the user (3) can submit a request to access the remote environment link (5) and / or downloadable content (6). This request triggers an administrative review process. In an embodiment, the request is transmitted to an administrator (9), who can assess the remote environment (50) to classify it as allowable or not allowable. As used herein, the term "allowable" means that the remote environment link (5) and / or downloadable content (6) has been deemed accessible by the user. However, since the process does not necessarily include a security check, there remains a risk— such as the possibility of human error on the part of the administrator (9).

[0141] In an embodiment, the user (3) may submit the access request through a dual-pane interface, where the containerized environment and the request access interface are visually stacked for the user. For example, the upper pane can display the request access interface, rendered securely on the system's regular servers, while the lower pane can render the containerized environment. This separation ensures that the request process occurs entirely outside the containerized environment while maintaining a seamless visual experience for the user.

[0142] In another embodiment the user (3) may submit the access request directly through the containerized environment (60) after inspecting the remote environment content (8) and / or downloadable content (6). For example, a secure interface, integrated into the containerized environment, may allow the user to fill out a standardized request form detailing the reason for access. The request can then be transmitted to an administrative dashboard hosted on the containerized host server (40) for review. This approach ensures that all interactions remain securely isolated within the containerized environment.

[0143] As used herein, the term "inspecting" when referring to content rendered through the containerized environment refers to the process by which a user interacts with and evaluates the potentially harmful content including the remote environment (e.g., a website) and / or downloadable content (e.g., files or attachments). This inspection process may include, but is not limited to, actions such as navigating hyperlinks, viewing embedded content, previewing documents, executing scripts in a controlled manner, and interacting with form elements or dynamic user interfaces. This controlled inspection enables users to perform necessary evaluations without exposing the underlying network or device to harm, ensuring both usability and security.

[0144] In an alternative or complementary embodiment, the access request can be submitted through a separate application installed or accessible on the user device (20). After inspecting the content in the containerized environment, the user is prompted by the application to generate a request. The application communicates with the containerized environment to link the request with the relevant content and transmits it to the administrative review system. This method provides a lightweight solution, allowing for additional features such as request tracking or notifications, without overburdening the containerized environment.

[0145] In yet another alternative or complementary embodiment, the access request functionality can be integrated into the email client accessible on the user device (20). After inspecting the content in the containerized environment, the user can submit the request directly from the email client, for example, using a dedicated button or menu option. The request can be linked to the original email and transmitted to the administrative review system on the host server (40). This embodiment streamlines the process, embedding it within the user's existing workflow for convenience and efficiency.

[0146] Step (303) involves the classification process conducted by the administrator (9). Using the inspection data and optional security parameters stored during the inspection, the administrator (9) may evaluate the remote environment (50) based on various factors, such as its reputation, safety classification, known vulnerabilities, or potential phishing indicators. If the remote environment (50) is classified as not allowable, access is denied for the requesting user (3) and, optionally, for any other user within the networked environment (10).

[0147] In another embodiment, backend analysis of the content may include automated scanning for malware, verifying the authenticity of remote servers, or assessing the risk level of external links. These steps can be performed by the host server (40). If the content is determined to be unsafe, access can be restricted and / or the user can be notified of the potential security risk. Embodiments may include automated threat detection algorithms, integration with security information and event management (SIEM) systems, or manual review by security administrators.

[0148] Finally, in step (304), if the administrator (9) determines that the associated content, including the remote environment (50) and / or downloadable content (6), is classified as allowable, direct user access to the remote environment (50) and / or downloadable content (6) is allowed. Additionally, access may be extended to other users within the networked environment (10) or applied to new incoming email messages containing the same link or content, hereinafter referred to as "allowlisted." This approach promotes streamlined workflows and enhances the efficiency of future interactions within the networked environment by pre-emptively approving allowable content.

[0149] Conversely, if the administrator (9) determines that the associated content, including the remote environment (50) and / or downloadable content (6), is classified as not allowable, direct user access remains restricted. This restriction may also apply to other users within the networked environment (10) or future incoming email messages containing the same link or content, hereinafter referred to as "not allowlisted." This ensures that potentially harmful external content is consistently blocked, safeguarding the networked environment from potential risks.

[0150] In embodiments, upon the user's activation of a new containerized environment link, for example generated from a new incoming email message comprising content, including a remote environment (50) and / or downloadable content (6), that corresponds or is otherwise associated with content that has been previously "allowlisted," direct user access to the remote environment (50) and / or downloadable content (6) may be permitted. This approach promotes streamlined workflows and enhances the efficiency of future interactions within the networked environment by approving previously classified allowable content.

[0151] According to some embodiments, the method may involve checking links and / or downloadable content against a Uniform Resource Identifier Blacklist (URIBL) or similar threat intelligence databases. If the URL matches an entry in the URIBL, the email message may be automatically discarded, further enhancing security.

[0152] In embodiments, the method may further comprise the step of logging activations of remote environments associated with the containerized environment link by the user, wherein the activation and optional interaction data is stored and configured to be displayed to the administrator to determine whether the remote environment can be classified as secure. This provides the administrator with behavioural data to inform their decision.

[0153] In embodiments, the step of determining whether the remote environment can be classified as secure may further comprise characterizing the remote environment on the containerized environment through a set of security parameters, including a reputation of the remote environment, an associated safety classification, the presence of known vulnerabilities, and / or an analysis of potential phishing indicators. This automates some aspects of link risk assessment.

[0154] The inclusion of administrative oversight ensures that access to external content is granted based on rigorous evaluation, leveraging both user input and predefined security parameters. Additionally, logging and storing activation and interaction data provide a robust framework for informed decision-making and future audits. This extended methodology highlights a collaborative approach to securing email communications, combining user-driven inspection with administrative review and system-level monitoring.

[0155] Figure 4 illustrates a schematic diagram of a system (500) configured to secure email communications and manage user interactions within a networked environment (10) with external content through a containerized environment. It provides an overview of the hardware and communication architecture underlying the described method for securing email communications in a networked environment. It is understood that additional hardware components can be provided, and that the described components can be configured for implementation of the aspects of the herein described method.

[0156] The networked environment (10) comprises at least a user device (20), an email server (30), and a host server (40). These components collectively enable the secure handling of email messages containing links to remote environments (50) or downloadable content.

[0157] The user device (20) includes a memory (21) and a processor (22), which are configured to execute clientside operations such as receiving secured email messages, interacting with containerized environments, and rendering content. The user device (20) serves as the primary interface through which the user interacts with the networked environment (10).

[0158] In an exemplary embodiment, the user device may comprise a computer system equipped with one or more processors, such as a central processing unit (CPU), a graphics processing unit (GPU), or advantageously a combination of both. The device may also include main memory and static memory, which communicate via a bus. The device may be a mobile device such as a smartphone. The device could feature a video display, such as a liquid crystal display (LCD), for visual output. Additionally, the device may support various input methods, including an alphanumeric input device (e.g., a keyboard), a cursor control device (e.g., a mouse), and potentially voice recognition or biometric verification modules for enhanced security. Other components may include a disk drive unit for data storage, a signal generation device (e.g., a speaker) for audio output, and a network interface for connecting to the broader networked environment. To enhance security, the user device may further include a data encryption module to safeguard transmitted or stored data.

[0159] In other embodiments, the user device can establish communication with the described networked environment system through a connective network. This connective network may encompass both private and public communication channels, such as the Internet. Suitable networks can include, or interface with, various types of networking infrastructures, including but not limited to local intranets, personal area networks (PANs), local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs), and virtual private networks (VPNs).

[0160] Additionally, the connective network may integrate specialized configurations such as storage area networks (SANs), frame relay connections, advanced intelligent networks (AINs), synchronous optical networks (SONETs), or digital service connections like Tl, T3, El, or E3 lines. Other potential connections include digital data service (DDS), digital subscriber line (DSL), Ethernet, integrated services digital network (ISDN), analog modem connections (e.g., V.90, V.34, or V.34bis), cable modems, asynchronous transfer mode (ATM), fiber distributed data interface (FDDI), or copper distributed data interface (CDDI). Furthermore, wireless communication options may include technologies such as wireless application protocol (WAP), general packet radio service (GPRS), global system for mobile communication (GSM), code division multiple access (CDMA), time division multiple access (TDMA), cellular phone networks, global positioning system (GPS), cellular digital packet data (CDPD), duplex paging networks (e.g., RIM), Bluetooth, and IEEE 802.11-based wireless local area networks (Wi-Fi).

[0161] The email server (30) is responsible for processing incoming email messages directed to the user. It comprises a memory (31) for storing email messages and associated metadata and a processor (32) for executing operations in accordance with aspects of the method as described herein, such as removing remote environment links and replacing them with containerized environment links. The email server (30) communicates with the user device (20) to deliver secured email messages and interfaces with the host server (40) for further processing.

[0162] In certain embodiments, the email server may operate as part of a distributed system, utilizing redundancy and load balancing mechanisms to ensure high availability and reliability. The server may distribute workloads across multiple servers within the network, supporting a scalable architecture capable of handling increased volumes of email traffic and security inspections.

[0163] In exemplary embodiments, the system comprises one or more email servers, such as a simple mail transfer protocol (SMTP) server (typically associated with the email sources), and mail exchange (MX) server (typically associated with the email users). The functionalities of the system as described herein can be incorporated into any of the SMTP server or the MX server. In other embodiments, the system can be configured to intercept email messages before receipt by the SMTP server from the email sources, or after transmission of the email messages by the SMTP server. In other embodiments, the system can be configured to intercept email messages before receipt by the MX server. In yet other embodiments, the system can be configured to intercept email messages before receipt by the email users, but after transmission by the MX server. In specific embodiments, the MX server can include, for example, an enterprise email server that transmits emails to the system for processing, prior to delivery to individual corporate email users.

[0164] In some embodiments, the email server may be configured to generate a secured email message for every incoming email message directed to the user. In this configuration, all incoming email messages are processed, regardless of whether they include at least one remote environment link and / or downloadable content. If no potentially harmful content is detected, the secured email message is advantageously identical to the original incoming email message, meaning that the same text and supposedly benign content is included in a newly generated message. This methodology enhances the overall safety of the system by reducing the risk of hidden or undetected content bypassing the email server's security configuration.

[0165] In certain other embodiments, the email server may be configured to first detect the presence of at least one remote environment link and / or a downloadable content within each incoming email message directed to the user, and only generate a secured email message for each incoming email message including the presence of the at least one remote environment link and / or a downloadable content. In this configuration, the mail server speed and efficiency can be increased by bypassing the generation step for email messages including only allowable or supposedly benign content.

[0166] The containerized host server (40) acts as the platform for the containerized environment (60). It comprises a memory (41) for storing containerized content and configurations, and a processor (42) for executing tasks in accordance with aspects of the method as described herein, such as redirecting the user to the containerized environment, inspecting external content, and managing security assessments. The host server (40) is also responsible for communicating with the email server (30) and the remote environment (50) as needed.

[0167] In embodiments, the containerized host server may include advanced security features such as intrusion detection systems (IDS), firewalls, and data encryption modules. These features can help protect the host server and containerized environments from unauthorized access, data breaches, or malware infiltration. The server may also implement user authentication protocols, such as two-factor authentication (2FA), to validate access requests to containerized environments.

[0168] In embodiments, the containerized host server may comprise a volatile storage medium as part of its memory, wherein the containerized host may be configured to implement the containerized environment (exclusively) on the volatile storage medium, thereby preventing any persistent data from the remote environment and / or the downloadable item from being stored on any non-volatile storage medium. This can ensure that no malicious data can persist after the session ends.

[0169] Advantageously when terminating the containerized environment by the user, the containerized host may be configured to delete all temporary data created during the user's interaction, preferably within about T1

[0170] 15 seconds or less after terminating the containerized environment, for example 10 seconds or 5 seconds. This may erase any traces of the user interaction and the short termination timing ensures that no communication can be continued between the containerized environment and any external user or malicious content.

[0171] In a further embodiment, the containerized host may also integrate with a private storage service to support user interaction with downloadable content from the remote environment and / or the incoming email message. In this configuration, the downloadable content can be temporarily stored in the private storage service allowing the content to be retrieved and provided to the user via the containerized environment while still adhering to the required security principles. By isolating the storage to a private service linked directly to the containerized host, the risk of data leakage or unauthorized access to the attachments can be minimized. Similarly, after the session ends, all content in the volatile storage medium and private storage service can be automatically purged, ensuring no residual data remains accessible.

[0172] In embodiments, the containerized host server may be designed as part of a scalable and redundant architecture, enabling it to handle large volumes of requests from multiple users simultaneously. Load balancing mechanisms may distribute the creation and management of containerized environments across multiple host servers within the network. This design ensures consistent performance and reliability, even during peak usage periods.

[0173] The remote environment (50) represents the external source referenced in the incoming email message. It may include external links or downloadable content that is processed within the containerized environment to ensure secure interaction. The networked environment (10) is designed to isolate potentially unsafe content from the user device (20) and the broader network while allowing for safe inspection and access where appropriate.

[0174] The arrows in the diagram illustrate communication pathways between the components of the networked environment. For example, the email server (30) can exchange data with the user device (20) to deliver secured email messages and interact with the host server (40) to facilitate content redirection. Similarly, the host server (40) can establish connections with the remote environment (50) to retrieve or containerize external content or retrieve the downloadable content including as attachment from the email server.

[0175] It is understood that although specific embodiments, constructions, configurations, and materials for devices according to the present invention have been discussed herein, various changes or modifications in form and detail may be made without departing from the scope of this invention. For example, any drawings provided are merely representative of possible procedures. Functionality may be added to or removed from block diagrams, and operations may be interchanged among functional blocks. Steps may also be added or omitted in the methods described within the scope of the present invention. Additionally, while certain embodiments, constructions, and configurations are described as providing an "improvement," it should be understood that any such improvement represents a benefit based on a comparison to similar devices, structures, systems, or methods in the art, depending on the context. The degree of improved performance may vary between disclosed embodiments, and no uniformity in the amount, degree, or realization of improved performance should be assumed to apply universally across all embodiments.

[0176] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present disclosure. Thus, appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment.

[0177] As used herein, the terms "comprising", "comprises" and "comprised of" as used herein are synonymous with "including", "includes" or "containing", "contains", and are inclusive or open-ended and do not exclude additional, non-recited members, elements or method steps. The terms "comprising", "comprises" and "comprised of" when referring to recited members, elements or method steps also include embodiments which "consist of" said recited members, elements or method steps. The singular forms "a", "an", and "the" include both singular and plural referents unless the context clearly dictates otherwise.

[0178] As used herein, relative terms, such as "left," "right," "front," "back," "top," "bottom," "over," "under," etc., are used for descriptive purposes and not necessarily for describing permanent relative positions. It is to be understood that such terms are interchangeable under appropriate circumstances and that the embodiment as described herein are capable of operation in other orientations than those illustrated or described herein unless the context clearly dictates otherwise.

[0179] Objects described herein as being "adjacent" to each other reflect a functional relationship between the described objects, that is, the term indicates the described objects must be adjacent in a way to perform a designated function which may be a direct ( / .e. physical) or indirect ( / .e. close to or near) contact, as appropriate for the context in which the phrase is used.

[0180] Objects described herein as being "connected" or "coupled" reflect a functional relationship between the described objects, that is, the terms indicate the described objects must be connected in a way to perform a designated function which may be a direct or indirect connection in an electrical or nonelectrical ( / .e. physical) manner, as appropriate for the context in which the term is used.

[0181] As used herein, the term "substantially" refers to the complete or nearly complete extent or degree of an action, characteristic, property, state, structure, item, or result. For example, an object that is "substantially" enclosed would mean that the object is either completely enclosed or nearly completely enclosed. The exact allowable degree of deviation from absolute completeness may in some cases depend on the specific context. However, generally speaking the nearness of completion will be so as to have the same overall result as if absolute and total completion were obtained. The use of "substantially" is equally applicable when used in a negative connotation to refer to the complete or near complete lack of an action, characteristic, property, state, structure, item, or result.

[0182] As used herein, the term "about" is used to provide flexibility to a numerical value or range endpoint by providing that a given value may be "a little above" or "a little below" said value or endpoint, depending on the specific context. Unless otherwise stated, use of the term "about" in accordance with a specific number or numerical range should also be understood to provide support for such numerical terms or range without the term "about". For example, the recitation of "about 30" should be construed as not only providing support for values "a little above" and "a little below 30," but also for the actual numerical value of "30" as well.

[0183] The recitation of numerical ranges by endpoints includes all numbers and fractions subsumed within the respective ranges, as well as the recited endpoints. Furthermore, the terms first, second, third and the like in the description and in the claims, are used for distinguishing between similar elements and not necessarily for describing a sequential or chronological order, unless specified. It is to be understood that the terms so used are interchangeable under appropriate circumstances and that the embodiments of the disclosure described herein are capable of operation in other sequences than described or illustrated herein.

Claims

CLAIMS1. A method (100) for securing email communications in a networked environment (10) comprising an email server (30) and a containerized host server (40), the method comprising the steps of: receiving (101), by the email server (30), an incoming email message (2) directed to a user (3), wherein the email message (2) includes at least one link (5) providing reference to a remote environment (50) and / or a downloadable content (4); generating (102) a secured email message (7) by modifying the incoming email message (2), comprising: removing the at least one remote environment link (5) and / or the downloadable content (4) from the incoming email message (2), and inserting at least one link (6) providing reference to a containerized environment (60); providing (103) the user (3) with the secured email message (7); upon activation of the containerized environment link (6) by the user (3), redirecting (104) the user (3) to the containerized environment (60) associated with the containerized environment link (6) hosted on the containerized host server (40); and, within the containerized environment (60), visually rendering (105) a content (8) associated with the remote environment (50) and / or the downloadable content (4), in a user-accessible interface, while preventing the user (3) from inputting data and transferring of files to a user's device (20).

2. The method according to claim 1, wherein the containerized host server (40) comprises a volatile storage medium (43), and wherein the containerized host server (40) is configured to implement the containerized environment (60) on the volatile storage medium (43), thereby preventing the remote environment content (8) and / or the downloadable content (4) from being stored on any non-volatile storage medium (44).

3. The method according to claim 2, wherein terminating the containerized environment (60) by the user (3) deletes all temporary data created from an interaction of the user (3) with the content (8); preferably wherein all temporary data is deleted within 15 seconds or less, after terminating the containerized environment (60).

4. The method according to any one of the preceding claims, wherein the containerized environment (60) is further configured to enable the user (3) to download content (8) from the remote environment (50) to the containerized environment (60) on the containerized host server (40) for inspection.

5. The method according to any one of the preceding claims, wherein the containerized environment (60) prevents the user (3) from one or more of: submitting form inputs, executing scripts, downloading files to the user's device (20) and / or uploading files from the user's device (20).

6. The method according to any one of the preceding claims, wherein the containerized environment link (6) comprises a domain reference configured to associate the containerized environment link (6) with the corresponding incoming email message (2) for the intended user (3); and a signed encoded token containing the remote environment link (5), wherein the signed encoded token is configured to be validated upon activation of the containerized environment link (6), and, upon successful validation of the signed encoded token, is configured to retrieve the remote environment link (5) from the token for inspection on the containerized environment (60).

7. The method according to any one of the preceding claims, wherein the secured email message (7) is generated by retrieving the source code of the incoming email message (2), including the text to be displayed, and generating a new email message by including the text from the incoming email message (2) and the at least one containerized environment link (6), thereby preventing any client-side caching from the email server (30).

8. The method according to any one of the preceding claims, wherein the secured email message (7) comprises the same subject line and metadata as the incoming email message (2).

9. The method according to any one of the preceding claims, wherein an interaction between the user (3) and the content (8) is established through a web browser application configured to create a communication session between the containerized environment (60) and the remote environment (50), thereby visually rendering the contents (8) of the remote environment (50) within the web browser application.

10. The method according to any one of the preceding claims, wherein the containerized environment (60) includes a unique identifier token that enables logging of an interaction between the user (3) with and the content (8) within the containerized environment (60).

11. The method according to any one of the preceding claims, further comprising: generating one or more visual prompts for the user, the visual prompts comprising at least one of: a prompt requesting confirmation whether the user was expecting to receive the remote environment link and / or downloadable content; a prompt instructing the user to assess the tone and urgency of the associated email message; and / or a prompt instructing the user to verify the sender's email address or domain name associated with the remote environment link and / or downloadable content.

12. The method according to any one of the preceding claims, further comprising: presenting to an administrator (9), preferably in an administrative user interface, at least one option for classifying the remote environment (50) and / or downloadable content (6) as allowableor not allowable; and, enabling, based on a selection received via the administrative user interface, access for the user (3) or any other user if classified as allowable, or continuing to prevent access for the user (3) or any other user if classified as not allowable; and, presenting to the user (3), preferably in the user-accessible interface, at least one option for generating an access request for the remote environment link (5) and / or downloadable content (6), and transmitting the access request to administrative user interface for the administrator (9) to classify the remote environment (50) and / or downloadable content (6) as allowable or not allowable.

13. The method according to claim 12, wherein the user (3) is distinct from the administrator (9) of the networked environment, and wherein an interaction between the user (3) and the content (8) occurs prior to generating of the access request from the user (3) to the administrator (90)14. The method according to any one of claims 12 or 13, further comprising: logging activations of one or more remote environments (50) associated with the containerized environment link (6) by the user (3); wherein the activation data is stored and configured to be displayed to the administrator (9), preferably in the administrative user interface, to determine whether the remote environment (50) can be classified as allowable or not allowable.

15. The method according to any one of claims 12 to 14 wherein the step of determining of whether the remote environment (50) can be classified as allowable or not allowable, further comprises: characterizing the remote environment (50) within the containerized environment (60) based on a set of security parameters, including one or more of: a reputation score, a safety classification, the presence of a known vulnerability, and / or a phishing indicator.

16. A system for securing email communications in a networked environment (10) comprising an email server (30) and a containerized host server (40); wherein the email server (30) is configured to: receive an incoming email message (2) directed to a user (3), wherein the email message (2) includes at least one link (5) providing reference to a remote environment (50) and / or a downloadable content (4); generate a secured email message (7) by modifying the incoming email message (2), comprising: removing the remote environment link (5) and / or the downloadable content (4) from the incoming email message (2), and including at least one link (6) providing reference to a containerized environment (60); and, provide the user (3) with the secured email message (7); wherein the containerized host server (40) is configured to:host the containerized environment (60) such that, upon activation of the containerized environment link (6) by the user (3), the user (3) is redirected to the containerized environment (60) associated with the containerized environment link (6); and, visually render, within the containerized environment (60), a content (8) associated with the remote environment (50) and / or the downloadable content (4), in a user-accessible interface, while preventing the user (3) from inputting data and transferring of files to a user's device (20).

17. The system according to claim 16, wherein the containerized host server (40) comprises a memory (41) including a volatile storage medium (43), and wherein the containerized host server (40) is further configured to implement the containerized environment (60) on the volatile storage medium (43), thereby preventing any remote environment content (8) and / or downloadable content (4) from being stored on a non-volatile storage medium (44).

18. The system according to claims 16 or 17, wherein the containerized environment (60) comprises a browser-based rendering engine configured to display the content (8) in a graphical user interface.19 The system according to any one of the preceding claims, wherein the user-accessible interface further comprises an request generation module configured to generate, in response to user interaction, an access request from the user (3) for the remote environment link (5) and / or downloadable content (4); and, an administrative user interface comprising an access control module configured to receive the access request and enable the administrator (9) to classify the remote environment (50) and / or downloadable content (4) as allowable or not allowable, and to grant access to the user (3) or any other user if classified as allowable, or to continue preventing access if classified as not allowable.

20. A computer program product comprising computer-executable instructions stored on a non- transitory computer-readable medium, which when executed by one or more processors, cause the one or more processors to perform a method for securing email communications, the method comprising the steps: receiving, by an email server (30) , an incoming email message (2) directed to a user (3), wherein the email message (2) includes at least one link (5) providing reference to a remote environment (50) and / or a downloadable content (4); generating a secured email message (7) by modifying the incoming email message (2), comprising: removing the at least one remote environment link (5) and / or the downloadable content (4) from the incoming email message (2), and including at least one link (6) providing reference to a containerized environment (60); providing the user (3) with the secured email message (7);upon activation of the containerized environment link (6) by the user (3), redirecting the user (3) to the containerized environment (60) associated with the containerized environment link (6); and, within the containerized environment (60), visually rendering a content (8) associated with the remote environment (50) and / or the downloadable content (4), in a user-accessible interface, while preventing the user (3) from inputting data and transferring files to a user's device (20).

Images