Network security method and system

Abstract

A method of controlling access to a digital resource in a group of digital resources, the method comprising: determining an information-sensitive feature included in information content of the resource, where access to the feature is limited to a user selected from a group of users associated with the group of resources; determining whether the content of the digital resource includes at least one of the information sensitive features; determining whether a user in the user group has authorization to access at least a portion of the resource based on at least one information sensitive feature; and enabling the user to access only at least a portion of the resource for which the user is determined to have authorization.

Description

[0001] Related Applications

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 354,896, filed on June 23, 2022, under 35 U.S.C. 119(e), the disclosure of which is incorporated herein by reference. Technical Field

[0003] Embodiments of the present disclosure are directed to providing network secure access channels and workspaces for communication networks and digital resources. Background Art

[0004] Various computer and communication technologies that provide modern communication networks and the Internet include a large number of various virtual and bare metal network elements (NEs) that support the operation of communication networks and fixed and / or mobile user equipment (UEs) that provide access to the network. Various technologies have made information technology (IT) and operational technology (OT) the cornerstone of today's society and provide excessive methods, equipment, infrastructure and protocols for controlling industrial equipment, supporting business operations and generating and disseminating data, voice and video content via the Internet. For most of the global population (independent of physical location), all types of information can be easily obtained through the Internet. And now most of the global community regularly uses their personal bring your own device (BYOD) UE (such as their personal smart phone, laptop, tablet computer and home desktop computer) to work remotely from their home, coffee shop and vacation location via connection with their employer and work group. The network democratizes the consumption of information and accelerates the change of social infrastructure.

[0005] However, the benefits provided by computer and communication technologies are not without their costs. The same technologies and benefits have greatly increased the difficulty in providing and maintaining legitimate individual and collective confidentiality rights, as well as protecting the integrity and security of the very same industrial and commercial operations that the technologies have enabled to protect from intrusion and damage from cyber attacks.

[0006] For example, a fingerprint of a cyber attack surface characterizes each UE, whether it is a personal, spatially unrestricted BYOD or an enterprise, workplace user equipment (WPUE), and provides vulnerabilities for malicious hackers to exploit, potentially causing serious damage to the UE and, more often, to the entities and systems to which the UE is connected. Each UE, and especially a BYOD, in addition to being a personal communication node, is also a potential cyber attack node for any communication network to which the UE is connected. For enterprises that must keep in touch with customers, employees, and / or colleagues who at least partially use their personal BYODs to work remotely, the vulnerability to cyber attacks is magnified due to the number of their remote contacts, the software configuration in the contacts' respective BYODs, and the variety of non-enterprise communications that the contacts participate in using the UE. The trend of enterprise data and storage resources moving to the cloud, and the proliferation of technologies such as infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS) for remote contact access and use further increase the complexity of providing appropriate cyber protection. Summary of the invention

[0007] An aspect of an embodiment of the present disclosure is directed to providing a network security communication system, optionally referred to as a CyberSafe system or simply "CyberSafe," that provides enhanced visibility and management of communication traffic propagated by the system. CyberSafe utilizes the enhanced visibility to provide improved network protection and secure access to digital resources of a resource subject for authorized users of a UE (BOYD or WPUE) associated with the resource subject.

[0008] Digital resources include any information (static or motion) in digital format, and include, for example, electronic documents, images, files, data, databases and / or software, where software refers to executable code and / or data. Digital resources also include any software and / or hardware that can be used to operate or generate digital resources on digital resources. Motion digital resources are digital resources that are being used, and / or operated, and / or transmitted between nodes of a communication system. Static digital resources are digital resources that are in storage and are not in motion.

[0009] For ease of presentation, it is assumed that the subject of the digital resource is owned by an enterprise, which is optionally referred to as "MyCompany", which employs a user or participates in a task with the user, and the user is authorized to access MyCompany resources using a UE associated with the subject of the resource. The UE associated with the subject of the resource is a UE that has been configured according to an embodiment of the present disclosure to enable authorized users to access MyCompany resources, and the UE may be referred to as a MyCompany UE. A user who is authorized to use the MyCompany UE to access MyCompany resources may be referred to as a MyCompany user or simply a user.

[0010] In an embodiment, CyberSafe includes an optionally cloud-based data and processing security concentrator (also referred to as a CyberSafe concentrator) and a web browser (also referred to as a CyberSafe secure web browser (SWB)) that resides in a CyberSafe isolated secure environment (CISE) of a MyCompany UE configured by or according to CyberSafe. In an embodiment, the CISE operates to isolate software included in the SWB and other applications that may reside in the CISE from software in the UE, also referred to as UE background software, and software external to the UE, the software in the UE being used for tasks not associated with MyCompany resources. In an embodiment, the SWB monitors and controls the movement of data into and out of the CISE and between applications in the CISE, as well as access to MyCompany resources, in order to implement CyberSafe and / or MyCompany security policies. In an embodiment, Cybersafe supports high-resolution monitoring and control of data movement and data propagation into and out of the CISE by the communication system by configuring the SWB to provide high visibility into the movement of data. Providing high visibility includes making communications outgoing from CISE visible before SWB encrypts outgoing communications, and making communications incoming to CISE visible after SWB decrypts incoming communications. Isolation and control of movement and access to data and enforcement of security policies according to embodiments of the present disclosure operate to provide enhanced protection against network compromise and to provide security against data leakage leaving and / or entering MyCompany resources that may result from communications with and via MyCompany UE.

[0011] In an embodiment, monitoring and controlling the movement of digital data includes reviewing the information content of the data and controlling the movement of the data in response to the reviewed content. Reviewing the content may include determining the text, image, audio and / or video components of the data, and processing these components to determine their corresponding information content. Controlling the movement of the data in response to the data content may include denying access to the data, masking or deleting a portion of the data, and / or optionally watermarking the data in response to an evaluation of the confidentiality of the data and the permission of the user to engage with the data.

[0012] Monitoring and controlling data movement may include monitoring user behavior of operating and using MyCompany UE to determine user key performance indicators (U-KPIs) that characterize user behavior when interacting with MyCompany UE and MyCompany digital resources, and using the U-KPIs to control data movement. Optionally, monitoring user behavior includes recording and storing at least a portion of a communication session in which the user participates using MyCompany UE.

[0013] Optionally, monitoring data movement may include determining and recording the trajectory of digital resources between communication nodes included in CyberSafe and / or between CyberSafe nodes and nodes external to CyberSafe, and changes that resources may undergo at the nodes. Communication nodes include, for example, UEs, websites, and / or CCaaS (Cloud Computing as a Service) resources. Communication nodes internal or external to CyberSafe are nodes that are controlled or not controlled by CyberSafe, respectively.

[0014] This summary is provided to introduce a selection of concepts in a simplified form that are further described in the Detailed Description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Non-limiting examples of embodiments of the present invention are described below with reference to the accompanying drawings listed after this paragraph attached hereto. The same features appearing in more than one drawing are generally marked with the same reference numerals in all drawings in which they appear. The reference numerals marking the icons representing given features of embodiments of the present invention in the drawings may be used to refer to the given features. The dimensions of the features shown in the drawings are selected for convenience and clarity of presentation and are not necessarily shown to scale.

[0016] Figure 1 Schematically illustrates a MyCompany UE according to an embodiment of the present disclosure, which is configured with a CyberSafe CISE and a SWB for providing cybersecurity to an enterprise called MyCompany;

[0017] Figure 2A-2C A flowchart showing a process according to an embodiment of the present disclosure, through which: Figure 1 The SWB shown in can participate in a handshake with the CyberSafe concentrator to obtain a token for accessing MyCompany resources;

[0018] Figures 3A-3C A flow chart illustrating a process by which access and movement of MyCompany resources may be controlled in response to the data content of the resources, according to an embodiment of the present disclosure;

[0019] Figures 4A-4B A flowchart showing a process according to an embodiment of the present disclosure, through which: Figure 1 The SWB shown in is operable to implement a high-resolution observation process for observing the activities of MyCompany users interacting with MyCompany resources; and

[0020] Figure 5 A flowchart showing a process according to an embodiment of the present disclosure, through which: Figure 1 The SWB shown in can be operated to provide browsing isolation for MyCompany users. DETAILED DESCRIPTION

[0021] In this discussion, unless otherwise specified, adjectives (such as "substantially" and "approximately") that modify the condition or relationship characteristics of one or more features of an embodiment of the present disclosure are understood to mean that the condition or characteristic is limited to an acceptable tolerance for the operation of the embodiment for its intended application. In all cases where a general term in the present disclosure is explained by reference to an example instance or a list of example instances, the one or more instances involved are non-limiting example instances as general terms, and the general term is not intended to be limited to the one or more specific example instances involved. The phrase "in an embodiment", whether or not associated with a claim (such as "may", "optionally" or "for example"), is used to introduce an example for consideration, but not necessarily the required configuration of a possible embodiment of the present disclosure. Unless otherwise indicated, the word "or" in the specification and claims is considered to be an inclusive "or" rather than an exclusive "or", and indicates at least one item or any combination of more than one item combined by the word. Although the features and actions of the flowcharts shown in the drawings and discussed in the specification are substantially presented and discussed in a sequential order specified by the sequential frame numbers referring to the frames in the drawings, the actions presented in the frames may be performed simultaneously or in an order not specified by the frame numbers.

[0022] Figure 1Schematically illustrates a CyberSafe system 50 according to an embodiment of the present disclosure, which operates to provide network security communications for a communication network of an enterprise 20 (also referred to as MyCompany 20 or simply MyCompany) and MyCompany users 10 using the communication network. MyCompany may have cloud-based digital resources 22, a business premises 24 that houses a local deployment server (not shown) for storing and processing MyCompany local deployment (on-premise) digital resources 28, and a WPUE 30 for MyCompany users 10 to access, use and process cloud-based and local deployment resources to conduct MyCompany business when they are locally deployed. MyCompany can allow users 10 to access MyCompany resources from various locations using any of various types of BYOD 32 when they are off-premise. It is assumed that MyCompany users 10 can use their corresponding BYOD 32 for personal activities, and according to the permissions defined by the MyCompany policy, MyCompany users may be allowed to use WPUE 30 for personal activities when they are locally deployed. Personal activities may include web browsing, social networking, uploading and downloading materials via the communication nodes 41 and the cloud infrastructure of the website 40. As schematically indicated by the double-arrow dashed line 43, the MyCompany network may be required to support communications between any of various combinations of the following: MyCompany on-premises digital resources 28, cloud-based digital resources 22, on-premises users 10 using WPUE 30 installed in the MyCompany premises 24, and off-premises users 10 using BYOD 32 at various off-premises locations.

[0023] According to an embodiment of the present disclosure, CyberSafe 50 includes an optional cloud-based CyberSafe processing and data concentrator 52 and a software architecture 60 that operates to cyber-protect MyCompany communications and digital resources in each of a plurality of MyCompany UEs, BYODs 32, and / or WPUEs 30 used by MyCompany users 10 to access and use MyCompany resources. The CyberSafe concentrator 52 includes and / or has access to cloud-based and / or bare metal processing and memory resources required to implement and support the functionality provided by the concentrator to CyberSafe 50 and the components of CyberSafe.

[0024] For example, Figure 1Schematically illustrated is a CyberSafe software architecture 60 that configures a MyCompany UE 33 to protect MyCompany digital resources at rest and / or in motion and to provide network-secure access to resources for users 10 who may use the MyCompany UE 33. The MyCompany UE 33 may be a BYOD or WPUE and is referred to as My-WorkStation 33.

[0025] The architecture 60 includes a CyberSafe isolation environment CISE 62, which is isolated from the background software 35 residing in My-WorkStation 33, and includes a SWB 64 residing in CISE 62. The background software 35 may generally include data and applications that are not intended to be used for MyCompany business. For example, the background software 35 may include a browser, an office application suite, a clipboard, an album of family images, a photo album, and WhatsApp. CISE 62 may also include a collection 65 of applications, which may be optionally imported from the background software 35 and packaged and optionally containerized by CyberSafe to associate the network security features required by CyberSafe and / or MyCompany policy features with the applications. In an embodiment, CISE includes a series of shared security services 66, which may be accessed for use by SWB 64 and for use by applications in the collection 65 via SWB 64. The shared security services 66 may optionally include a secure clipboard and a secure encrypted file system.

[0026] CISE 62 provides an isolated security domain defined by a substantially continuous security perimeter generated and supported by the security applications, features and functions of SWB 64, shared security services 66 and the packaging of packaging applications 65. According to an embodiment, CISE 62 can be configured to provide network security and isolation using methods and in accordance with standards such as PCI DSS (Payment Card Industry Data Security Standard), HIPAA (Health Insurance Portability and Accountability Act) and / or SOC2 (American Institute of Certified Public Accountants Service Organization Control). Optionally, CISE 62 is isolated from background software at the network level.

[0027] In an embodiment, to provide isolation and security, SWB 64 is configured to monitor and control the entry and exit of data into and out of CISE 62 and between CyberSafe wrapped applications, shared security services 66, and / or applications in SWB 64, respectively. SWB 64 is advantageously configured by CyberSafe to enforce CyberSafe and / or MyCompany security policies related to access to MyCompany data and the movement of data within and into and out of CISE. Isolation and control of the movement and access of data and enforcement of policies operate to provide enhanced protection against network compromise and to provide security against leakage of data that may leave and / or enter MyCompany resources as a result of communications with and via MyCompany UEs.

[0028] In an embodiment, monitoring the ingress and egress of data includes monitoring communications supported by SWB 64, storing and processing data included in the monitored communications, and making the data available to the CyberSafe concentrator and MyCompany. In an embodiment, in the CyberSafe isolation environment CISE 62 ( Figure 1 ) Outgoing communications are handled by SWB b Monitoring is performed on the outgoing communications prior to encryption, and monitoring is performed on the incoming communications after the communications into CISE are decrypted by SWB 64. Thus, user browsing is essentially fully visible to CyberSafe and MyCompany, and can be processed locally or remotely.

[0029] Monitoring may be substantially continuous, random, or periodic. Random monitoring includes monitoring communications during a monitoring period of limited duration that begins at a randomly determined start time, optionally based on a predetermined probability function or in response to a "trigger" event, such as an event that is considered abnormal and requires attention. Periodic monitoring includes continuously monitoring communications during a monitoring period at a periodic start time. The monitored communications may be mirrored by SWB 64 to a destination in the CyberSafe concentrator and / or MyCompany for storage and / or processing, or may be filtered for data of interest before being transmitted to a destination in the CyberSafe concentrator and / or MyCompany for storage and / or processing. The features and constraints that configure how SWB 64 handles monitored communications may be determined based on CyberSafe and / or MyCompany policies. Such policies may specify how data is shared between a local SWB and a CyberSafe concentrator.

[0030] In an embodiment, the SWB 64 may be a standalone application that includes CyberSafe features and / or functionality, or an existing web browser (such as Google Chrome, Microsoft Edge, Apple Safari, Mozilla Firefox, Opera, or Brave) that is modified and provided with additional CyberSafe features and / or functionality through changes and / or additions to the browser code and / or through integration with a CyberSafe extension. The features and functionality may be incorporated into an existing browser and the browser converted into a CyberSafe SWB by: interfacing with the input and output of the existing browser using operating system hooks; patching the original binary of the browser; building a dedicated extension on top of the browser's API and / or SDK; and / or dynamically modifying the browser's memory while the browser is in operation.

[0031] By way of example, features and / or functions, hereinafter collectively referred to as functionalities, may include at least one function or any combination of more than one function that enables SWB 60 to: collaborate with MyCompany IDP to authenticate and authorize user 10 to access CISE 62 and MyCompany resources; obtain data characterizing websites visited by MyCompany users, which data can be used to classify cyber risks associated with the websites; obtain data characterizing browser extensions that may compromise SWB 64 security features; obtain data that can be processed to determine normal behavior and use of MyCompany resources by MyCompany users as a group and / or as individuals; monitor the engagement of MyCompany users with MyCompany resources and control that engagement to enforce CyberSafe and / or MyCompany security constraints.

[0032] In an embodiment, enforcing CyberSafe and / or MyCompany security constraints includes requiring that all communications between UE 33 and MyCompany resources be transmitted via SWB 64 and a CyberSafe tunnel connecting the SWB to the resources, and enforcing CyberSafe and / or MyCompany permissions on the resources. Optionally, enforcing security constraints includes identifying anomalies in communications between UE 33 and company resources, and operating to eliminate or ameliorate damage from the identified anomalies, and generating alerts for their occurrence.

[0033] According to an embodiment, Figure 2A-5The flowchart presented in FIG. 1 shows elements of a process performed by a CyberSafe system and a SWB (such as CyberSafe system 50 and SWB 64) that demonstrates and illustrates the functionality of the CyberSafe system and the SWB. This discussion assumes that the CyberSafe system provides cybersecurity services to a given MyCompany enterprise, which has a user ID (U-ID) associated with it. n (1≤n≤N)) identifies multiple users U n (1≤n≤N). Assume that the user can access and use the user equipment ID (UE-ID e (1≤e≤E)) identified by the user equipment, and CyberSafe has configured CISE for the UE and the browser ID (B-ID b ) logo CyberSafe Browser SWB b ((1≤b≤B)).

[0034] Figure 2A-2C A flowchart 100 is shown of a process by which a user equipment UE e For a given user U n Contact the CyberSafe security concentrator 52 to request authorization to access and use the UE e CISE in the CISE, and let the SWB resident in the CISE b Issues a security token for accessing MyCompany resources.

[0035] In block 102, user U n Operating UE e To log in to the CyberSafe security concentrator 52 and submit a request for a security token, the request includes an extended ID, which includes: User ID (U-ID n );User Equipment ID (UE-ID e );and the identification is installed on the UE e SWB in SWB b ID(B-ID b ). U-ID n This may include a username, password, and / or e SWB b and / or MyCompany-related data, such as the date the user first registered as a MyCompany user. e Any suitable identifier may be included, such as a MAC (Media Access) address, a UUID (Universally Unique Identifier) ​​or an IMSI (International Mobile Subscriber Identity), and / or the UE e With user Un SWB b and / or MyCompany-related information. b Can include browser user agent string, CyberSafe assigned to SWB b Any suitable identifier, and / or SWB b With UE e , U n and / or information associated with MyCompany.

[0036] It should be noted that given user U n Can communicate with more than one UE e and / or more than one SWB b associated, and the user ID (U-ID n ) may include data identifying the association. Similarly, for a given user UE e Can be used with more than one U n and / or more than one SWB b associated, and a given SWB b Can be used with more than one U n and / or more than one UE e Associated and corresponding ID, UE-ID e and B-ID b Data mapping the association may be included. n ,UE e and / or SWB b Any combination of one or more of may include a time of day (ToD) for each of at least one previous login to CyberSafe.

[0037] Optionally, in block 104, the CyberSafe security concentrator authenticates the extension ID. Authenticating the extension ID may include the participating user U n Multi-factor (optionally three-factor) authentication and confirming the U-ID n ,UE-ID e or B-ID b The association and / or ToD consistency between any combination of two or more of the.

[0038] In decision box 106, if the extension ID is not OK, the concentrator proceeds to box 142 to reject the requested token and optionally send a rejection notification to the CyberSafe concentrator. On the other hand, if the extension ID is OK, the concentrator optionally proceeds to decision box 108 to decide whether to grant the SWB bThe decision to run or not run an integrity test on the software may depend on the MyCompany and / or CyberSafe testing policy. The policy may depend on when the CyberSafe concentrator has tested the SWB b and / or UE e Run the final integrity test, characterize user U n User profiles of browsing behavior and Internet usage patterns, and / or characteristics of the network attack landscape. For example, MyCompany may have a policy that the delay between integrity tests is not less than or greater than certain lower and upper delay limits. The decision may depend on the user U n Whether a network risky website listed in a risky website list is browsed at a frequency greater than a predetermined frequency or whether the user tends to neglect updating passwords or patching applications. The network attack situation may include the frequency and / or severity of network attacks that have been experienced recently by MyCompany or other enterprises, and / or the types of network attacks that have been encountered. Optionally, if the decision in decision box 108 is to skip the integrity test, the concentrator proceeds to box 140 and issues the desired token. If the decision is to perform the integrity test, the concentrator can proceed to box 110 and retrieve at least one software integrity test "sit" from a database included in the concentrator or accessible to the concentrator. i " set "SIT", where SIT = {sit i |1≤i≤I}, which can be used to determine SWB b Software integrity. An exemplary SIT may include at least one or any combination of more than one of the following:

[0039]

[0040] In block 112, the CyberSafe concentrator determines a weight vector WIT, which includes a weight vector WIT for each sit i The weight wit i , the weight wit i Provides support for test sit i To determine SWB b An estimate of the appropriate level of integrity of the software. In an embodiment, for a given sit i wit i is a function of:

[0041] UE e Hardware type, for example, if the UE e If it is a mobile device, tablet or desktop, it may limit the e What type of given sit to perform i;

[0042] Sensitivity, given sit i The true positive rate

[0043] Specificity, given sit i True negative rate;

[0044] Nuisance rating, which provides a test of the user UE e The measure of inconvenience caused;

[0045] Past performance of the test; and / or

[0046] The current cyber attack landscape, which identifies the current prevalence and severity of cyber attack types.

[0047] In block 114, the CyberSafe concentrator selects the corresponding weight greater than the median weight wit i Integrity test sit i In response to the integrity test sit i The corresponding weight wit i (For example, the weight wit i The larger the value, the greater the correlation). b Run a series of tests on the software sit i .

[0048] In block 116, the CyberSafe concentrator responds to each selected test site i The integrity metric returned determines the UE e Medium SWB b A measure of the QoI(e,b) (quality of integrity) of the software. In an embodiment, QoI(e,b) is determined by sit i Through their corresponding weights wit i The weighted average of the integrity metrics provided. Optionally, in decision block 118, the CyberSafe concentrator 52 determines whether the QoI value is satisfactory. If the QoI is not satisfactory, the concentrator proceeds to block 142 and refuses to issue a token and optionally sends a reminder. On the other hand, if the QoI is satisfactory, the concentrator proceeds to decision block 120 to determine whether to e Run background software environment tests on.

[0049] Software environment testing is to determine the UE e A test of the extent to which, if any, background software in the UE is compromised by network corruption or is not adequately protected against network corruption. eThe decision to perform environmental testing on the UE can be based on many of the same considerations that are weighed when making a decision about whether to perform integrity testing. For example, the decision may depend on MyCompany and / or CyberSafe policies and factors such as: e Hardware (such as UE e whether it is a mobile phone or a laptop), in UE e The time of the last environment test run on the n browsing behavior patterns and / or characteristics of network attack postures.

[0050] Alternatively, if the decision in decision block 120 is to skip the software environment test, the CyberSafe concentrator may proceed to block 140 and issue the desired token. On the other hand, if the decision is to perform the environment test, the concentrator may optionally proceed to block 110 and retrieve from the database at least one network attack vulnerability feature hvf to be determined to be present or absent. e,j The set "HVF(e)", where HVF(e) = {hvf e,j |1≤j≤J}. HVF(e) may include static and / or dynamic vulnerability features. Static vulnerability features are included in the UE e Characteristics of code and / or data elements in the background software that are believed to make the background software and / or digital resources not included in the background software (such as CyberSafe and / or MyCompany resources) vulnerable to cyber attacks. Dynamic vulnerability characteristics are characteristics of UE e The currently used temporary vulnerability features, such as UE e Whether connected to public WiFi or a dangerous website on the Internet. An exemplary HVF (e) may include at least one vulnerability feature or any combination of more than one vulnerability features, and the presence or absence of a vulnerability feature may be determined by optionally responding to the following query:

[0051] hvf e,1 =Is AV (anti-virus) / EDR (endpoint detection and response) installed? ;

[0052] hvf e,2 =Is a firewall installed and enabled? ;

[0053] hvf e,3 =Patch the OS (operating system) to the latest version? ;

[0054] hvf e,4 =Patch the application to the latest version? ;

[0055] hvf e,5 =Access UE e Requires certification? ;

[0056] hvf e,6 = Dangerous software defaults? ;

[0057] hvf e,7 =Using public Wi-Fi? ;

[0058] hvf e,8 =UE e Connected to a VPN (Virtual Private Network)?

[0059] hvf e,9 = What is the security level of the connected network? ;

[0060] hvf e,10 = Security misconfiguration? ;

[0061] hvf e,11 =Cross-site scripting?;

[0062] hvf e,12 =Unstable power supply? ;

[0063] hvf e,J

[0064] Optionally, in block 124, the CyberSafe concentrator scans for UE e Background software environment to detect each hvf e,j , and determine the risk vector HVR(e), which includes each hvf e,j Cyber ​​attack risk estimation hvr e,j , where HVR(e) = {hvr e,j |1≤j≤J)}. Determine the given vulnerability hvf e,j The risk estimate of a vulnerability often depends on the type of vulnerability and the cyberattack landscape. For example, determining a risk estimate for a given public Wi-Fi may depend on the physical location of the Wi-Fi, the current traffic being carried by the Wi-Fi at the time the estimate is made, and the recent history of attempted cyberattacks via that Wi-Fi. The risk associated with a patch may be a function of the type of patch being requested or installed.

[0065] In block 126, CyberSafe may scan the UE e Background software to determine the damaged components of the background software hcc k The set HCC(e), where HCC(e) = {hcc e,k|1≤k≤K}. And in block 128, CyberSafe may retrieve a user profile U-PRF(n) from the CyberSafe and / or MyCompany databases, which may be used to characterize the user U n Behavioral characteristics when interacting with MyCompany and / or non-MyCompany digital resources. In an embodiment, U-PRF(n) includes: Key Performance Indicator (KPI) value of user key performance indicator ukpi n,k The set U-KPI(n), where U-KPI(n)={ukpi n,k |1≤k≤K}; and including the user risk component ucrp n,r The value of the user network risk profile U-CRP (n), where U-CRP (n) = {ucrp n,r |1≤r≤R}. U-KPI(n) may include values ​​for any combination of at least one or more of the following: user keyboard typing patterns; user mouse activity patterns; user response time to digital resource actions, use of packaged applications; use of shared security services; data patterns used by the user during a session, including data typed locally in the SWB; uploaded and downloaded files, file names; interruptions in the use of background software; and / or dwell time at a particular web page. The values ​​of the CRP(n) components may include risk estimates (optionally derived from the U-KPI(n) component values) for any combination of at least one or more of the following: careless password management; careless permission management; reckless clicking on actionable content; lack of susceptibility to phishing baits; or a risk estimate of a user abusing privileges of MyCompany resources.

[0066] In block 130, CyberSafe processes HVR(e), HCC(e), U-PRF(n), and / or a set of values ​​CPA(b) that provide a measure of security provided by software (such as anti-injection and / or anti-exploitation software, optionally referred to as cladding) to protect the SWB b Protected from network compromise. For example, for a user with high privileges, access to MyCompany resources may be required by CPA(b) to run additional security checks and install additional security controls (such as EDR) to allow the user to access MyCompany resources. In addition, if the user is accessing unknown websites or websites with low security reputation and therefore high risk, CPA(b) may limit or disable some functions that affect the system's vulnerability to network attacks. In an embodiment, processing is performed by a neural network configured to operate on an input feature vector that includes component features based on components of HVR(e), HCC(e), U-PRF(n) and / or CPA(b).

[0067] Optionally, in block 132, if the CyberSafe concentrator determines that the packet protection is favorable, the concentrator proceeds to block 140 and issues the requested token. On the other hand, if the packet protection is not favorable, the concentrator may proceed to block 134 to determine whether to modify the packet protection to improve protection. If the concentrator decides not to modify, the concentrator may proceed to block 142 and reject the token and issue an alert. On the other hand, if the decision is to modify the packet, the concentrator proceeds to block 136, modifies the packet and optionally proceeds to decision block 138 to determine whether the modification has resulted in a sufficient improvement in network protection. If the improvement is not sufficient, the CyberSafe concentrator proceeds to block 142 and rejects the token.

[0068] In an embodiment, according to an embodiment of the present disclosure, once the MyCompany user U n , User UE e and browser SWB b Having been provided with a token for presentation to interact with MyCompany resources (optionally as illustrated by flowchart 100), the SWB may be configured to provide review of access to resources and control of movement of resources based on the information content of the resources. Figures 3A-3C 200 is shown, which illustrates a process, optionally referred to as the Information Content Authorization Process (ICAP), by which CyberSafe, MyCompany, and / or SWB b Can cooperate to provide users n Attempting to engage access and movement control of MyCompany resources.

[0069] In block 202, user U n Optionally submit including U-ID n ,UE-ID e and B-ID b , to request a MyCompany security token from the CyberSafe concentrator 52. In decision block 204, CyberSafe reviews the extension ID to determine if the security concentrator requirements are met, and in block 206, if the requirements are met, the requested token is granted.

[0070] Optionally, in block 208, the SWB downloads and / or is able to access the user U n The MyCompany user profile U-PRF(n) = (U-KPI(n)∪U-CRP(n)), the confidentiality level CON of the information sensitive characteristics of the MyCompany resources, and the user U including the user permission level CLRn A user permission profile CLR(n,e,b) for accessing information-sensitive features. An information-sensitive feature (also called a confidentiality-sensitive feature) is any information characteristic of a resource that MyCompany deems advantageous to require restricted distribution to MyCompany users based on user permission levels. Restricted distribution may be determined and implemented by assigning a confidentiality level CON to each information-sensitive feature, and assigning a corresponding permission level CLR for the information-sensitive feature to each MyCompany user. Optionally, CON may assume that the value of the confidentiality level for a given information-sensitive feature is equal to a favorable integer range (1-C m ), where a larger value indicates a higher confidentiality level, requiring stricter constraints on access to the feature, compared to a lower value. The CLR permission level can assume any value within the same range of values ​​as CON. A user may be allowed access to a given confidentiality-sensitive feature only if the CLR level assigned to the user is greater than or equal to the CON level of the feature. For example, the CON and CLR levels may be determined by considering MyCompany employees or by using artificial intelligence (AI) (e.g., a machine learning algorithm trained by supervised and / or unsupervised learning, such as a decision tree or clustering algorithm, or a convolutional neural network (CNN)).

[0071] The confidentiality level may include a collection of confidentiality levels STF, SIF, and SAF for confidentiality sensitive text features, which are strings, optional regex strings, image features, and audio features that the MyCompany digital resource may include. The confidentiality level of video material may be determined based on related material from STF, SIF, and / or SAF, using appropriate processing to account for temporal correlation, and the video material includes a series of images typically associated with audio material and / or text material, such as, for example, receipts or explanatory or marking signs.

[0072] The set STF optionally includes a number of m ) and at least one data category CLS to which the text feature belongs η (1≤η≤η m ) for each of the confidentiality sensitive text features stf α,η The confidentiality level CON((stf αη). A confidentiality-sensitive text feature may be any text object or function of a text object that is considered to include confidentiality-sensitive information by itself or in combination with at least one other text object. For example, a confidentiality-sensitive text feature may be or include a string, such as a regex string, an N-gram, a pattern of text features (e.g., a cluster of at least two associated text phrases that are spatially distanced from each other in a resource), or a confidentiality-sensitive text feature from a cluster of confidentiality text features that are related to each other by a text similarity distance. For example, a confidentiality-sensitive text feature may include or otherwise indicate or disclose marketing data (such as new product launch data or features of a new advertising campaign), financial data (such as profit or loss statements), management data (such as employee evaluations), and / or technical data (such as details of a chemical formula or a manufacturing process). Data Category CLS η May be any of a number n of categories that MyCompany may deem useful for classifying information for limited distribution. And as indicated by the above example of confidentiality sensitive text features, the data categories may, for example, include categories for each of marketing data, financial data, management data, technical data, and / or RnD data. In an embodiment, for example, the data categories may be determined by considering MyCompany employees or by using artificial intelligence (AI), for example, a machine learning algorithm (such as a decision tree or clustering algorithm) or a convolutional neural network (CNN) trained by supervised and / or unsupervised learning.

[0073] Similarly, the set SIF optionally includes a number of β (1≤β≤β m ) and at least one data CLS for classifying confidentiality sensitive text feature data η Each confidentiality sensitive image feature sif β,η The confidentiality level CON((sif βη ), the image feature is considered to belong to the data CLS η . A confidentiality-sensitive image feature may be any image feature or function of an image feature that is considered, by itself or in combination with at least one other image feature, to include confidentiality-sensitive information. For example, a confidentiality-sensitive image feature may be an image of a new product (such as a new pair of sneakers), a revenue graph, or a management chart. A confidentiality-sensitive image feature may be a feature derived from an image. For example, a new armored personnel carrier (APC) may not itself be confidential, but a feature such as a vertical tire deformation derived from an image of the APC may be considered confidentiality-sensitive because the weight or load of the APC may be derived from the deformation.

[0074] Similarly, the set SAF optionally includes a number of γ (1≤γ≤γ) for tracks. m ) and at least one data category CLS to which the audio feature is considered to belong η Each confidentiality-sensitive audio feature saf γ,η The confidentiality level CON((saf γη ).

[0075] The permission profile set CLR(n,e,b) optionally includes the confidentiality sensitive information feature stf α,η 、sif β,η 、saf γ,η The permission level of the CLR n (stf α,η ), CLR n (sif β,η ), CLR n (saf γ,η ), these permission levels are often referred to as the CLR n (α,βγη or CLR for short.

[0076] In block 210, user U n Using SWB b To request access to a particular MyCompany digital resource, to obtain authorization to interact with the resource for any of a variety of activities (such as, for example, navigating, viewing, downloading, uploading, copying, or modifying information). In decision box 212, MyCompany and / or the particular resource may determine that the SWB is authorized to use the resource by presenting the appropriate standard MyCompany permissions for accessing the resource and satisfying the associated ID authentication constraints. b U n Whether standard authorization requirements are met. Standard authorization requirements do not include reviewing the resource for confidentiality sensitive information characteristics and configuring access to documents based on the confidentiality level of the characteristics and the user's permission level in addition to the standard MyCompany permissions. If standard authorization requirements are not met, ICAP proceeds to block 244 to deny user U n The resource is accessed and the process ends.

[0077] On the other hand, if the standard authorization process associated with block 212 is successful, ICAP may proceed to decision block 214 to determine whether the resource is a "permitted resource" that requires processing of user U. n The permission CLR and the confidentiality level CON determined for the sensitive information characteristics in the resource are checked to approve the authorization. If the resource is not a permitted resource, ICAP proceeds to block 242, approves the request and ends.

[0078] On the other hand, if the resource is a permitted resource, ICAP optionally proceeds to block 216 to determine in the user profile U-PRF(n) and / or in the UE e and SWB b For example, the anomaly in the user U-PRF(n) can be the user key performance indicator ukpi in the set U-KPI(n). n,k The change in the value of the ukpi (such as user typing patterns, data usage patterns, or response times) is greater than the change in the ukpi downloaded or accessed in block 208 n,k For example, an anomaly in U-PRF(n) could be a user risk estimate (such as the risk estimate for reckless clicking on actionable content or careless rights management) of the set U-CRP(n). n,r For example, anomalies in the operating environment may include excessive or insufficient use of MyCompany network bandwidth, abnormally unstable communication traffic on the network, or network or user UE e Frequent interruptions of electricity supply.

[0079] If an anomaly is detected, ICAP may optionally proceed from block 216 to block 218 to adjust the confidentiality level CON and / or the user permission level CLR. For example, for harmful changes, ICAP may increase the CON level and / or reduce the user ULR. n For favorable changes, ICAP can reduce the CON level and / or increase the user U n CLR level. After adjustment, ICAP may proceed to block 220 to determine whether the resource includes text, images, audio data, or a mixture of two or more data types. On the other hand, if no anomaly is detected, ICAP may proceed directly from block 216 to block 220. ICAP may proceed from block 220 to block 222 to determine the data category CLS into which the information in the resource may be classified. η Determining the information type and data category may be performed by accessing metadata characterizing the resource or by sampling the resource and using a suitable classifier to determine the information type and category.

[0080] Optionally, in decision block 224, if it has been determined that the MyCompany resource includes text information, ICAP proceeds to block 226 to optionally define at least one data class CLS η Each of the data categories into which the resource is classified in block 222 determines the confidentiality sensitive text feature stf α,ηThe existence of and optionally determining the text confidentiality quality factor RCON(TxT) of the resource and the user U according to the following expression n Text license quality factor UCLR(TxT):

[0081] RCON(TxT)=∑ α,η n(stf α,η )·CON(stf α,η ), and (1)

[0082]

[0083] In expressions (1) and (2), n(stf αη ) is the confidentiality sensitive text feature stf α,η The number of times it appears in the resource, is the Heaviside function and δ is a deviation less than one that is present in CLR(stf α,η )=CON(stf α,η ) to ensure is equal to 1.

[0084] Optionally, in block 226, if (RCON(TxT)-UCLR(TxT)) is greater than or equal to a predetermined threshold TH(TxT), ICAP proceeds to block 250 to deny the request and ends. On the other hand, if (RCON(TxT)-UCLR(TxT)) is less than the threshold TH(TxT), ICAP may approve the request, but the operation is for local masking or deletion of resources (CON(stf α,η )-CLR(stf α,η )) Those confidentiality sensitive text features stf that are greater than the predetermined text masking threshold TH(MTxT) α,η .

[0085] According to an embodiment, a given text feature stf is locally masked or deleted. α,η Refers to the UE that displays the resource to the user e Mask or delete a given text feature in a resource version in the user interface (UI) of the UE e The received data defines the original version of the resource. Optionally, by e SWB b The renderer can be hooked with executable instructions to perform local masking or deletion, which mask or delete a given feature without affecting the data defining the original resource and thus prevent changes to the resource at the source, which data is generated by the SWB bDownloaded from the source to CISE. For example, local masking or deletion of web pages is not changed by SWB b The received HTML (Hypertext Markup Language), CSS (Cascading Style Sheets) or JavaScript does not change the DOM (Document Object Model) tree of the web page.

[0086] In decision block 224, if the text information does not exist in the MyCompany resource, ICAP proceeds to decision block 230. In decision block 230, if it has been determined that the MyCompany resource includes image information, ICAP may proceed to block 232 to determine if image features sif are present in the image information, respectively. β,η Probability Optionally, the probability is determined by processing the image information using a deep convolutional neural network (DNN) Optionally, in block 234, ICAP uses Optionally determine the image confidentiality quality factor RCON(ImG) of the MyCompany resource and the image confidentiality quality factor RCON(ImG) of the user U according to the following expression: n Image license quality factor UCLR(TxT):

[0087]

[0088]

[0089] Optionally, in block 236, ICAP may determine whether (RCON(ImG)-UCLR(ImG)) is greater than or equal to a predetermined threshold TH(ImG), and if so, proceed to block 250 to deny the request and end. On the other hand, if (RCON(ImG)-UCLR(ImG)) is less than the threshold TH(ImG), ICAP may approve the request, but operate for local masking or deletion (CON(sif α,η )-CLR(sif α,η )) Those confidentiality sensitive image features sif that are greater than the predetermined image masking threshold TH(Im G) α,η .

[0090] If, as determined in decision block 230, image information is not present in the MyCompany resource, then ICAP may proceed to decision block 238. In decision block 238, if it has been determined that the MyCompany resource includes audio information, then ICAP may proceed to block 240 and optionally use a natural language processor (NLP) to determine whether the saf γ,η In this box, ICAP can optionally provide a saf found to exist in the MyCompany resource according to the following expression:γ,η Determine the audio confidentiality quality factor RCON(Audio) for the MyCompany resource and the user U n Audio license quality factor UCLR(Audio):

[0091] RCON(Audio)=∑ α,β n(saf γ，η )·CON(saf γ，η ), and (5)

[0092]

[0093] In block 242, ICAP determines whether (RCON(Audio)-UCLR(Audio)) is greater than or equal to a predetermined threshold TH(Audio), and if so, proceeds to block 250 to deny the request and end. On the other hand, if (RCON(Audio)-UCLR(Audio)) is less than the threshold TH(Audio), ICAP may approve the request, but the operation is for local masking or deletion (CON(saf α,η )-CLR(saf α,η )) Those confidentiality-sensitive audio features saf that are greater than a predetermined audio masking threshold TH(MAudio) α,η .

[0094] In block 244, the ICAP may determine whether RCOR(TxT) is greater than a predetermined text watermarking threshold TH(TxT-Wmark), whether RCOR(ImG) is greater than a predetermined image watermarking threshold TH(ImG-Wmark), or whether RCOR(Audio) is greater than a predetermined audio watermarking threshold TH(ImG-Wmark), and if so, operate to locally watermark the MyCompany resource with a visible or invisible watermark. According to an embodiment, local watermarking is performed similar to performing local masking or deletion, without performing local watermarking on the UE. e Changes are generated in the received data defining the resource. From block 244, ICAP optionally proceeds to block 248, approves the request and ends.

[0095] It should be noted that although in flowchart 300, ICAP determines authorization, masking or deletion and / or watermarking based on data category CLS, resource confidentiality level CON and user permission level CLR, the practice of the embodiments of the present disclosure is not limited to the use of CLS, CON and / or CLR illustrated in the flowchart. For example, given a sufficient number of training examples of resource-user pairs, the DNN network can be trained to recognize resource data categories, confidentiality levels and / or permission levels, and can be used to determine authorization and masking or deletion. When provided with a CyberSafe browser SWB b User U n When the profile U-PRF(n) and the scan or feature vector of the resource are scanned, such a DNN can determine whether the user should be granted or denied authorization to join the resource, and if authorized, whether the resource should undergo feature masking or deletion. The DNN can also be trained to determine what resources should be watermarked and how to watermark them. For example, the DNN can determine whether the user should be granted or denied authorization to join the resource, and if authorized, whether the resource should undergo feature masking or deletion. b The resource being processed should be in SWB b Before transmitting the resource, a visible or hidden steganographic watermark is added.

[0096] According to an embodiment of the present disclosure, in order to facilitate protection and secure access to MyCompany resources, CyberSafe can configure MyCompany UE e , so that UE e SWB b High Resolution Observation (HIRO) process can be implemented to observe the operating UE e Activities of users who interact with MyCompany resources.

[0097] Figures 4A-4B FIG. 1 shows a method for monitoring a user U according to an embodiment of the present disclosure. n Operation of the active HIRO process 300 .

[0098] According to an embodiment, in block 302, a user U who has been authorized by CyberSafe to access and use MyCompany resources that comply with and are constrained by MyCompany and / or CyberSafe policies is logged in. n "Tagged" by MyCompany as using UE e and SWB b Interact with MyCompany resources. Optionally, in block 304, MyCompany instructs SWB b Implementing HIRO to observe U nand in block 306, HIRO is initialized to monitor the user U when the user engages with MyCompany. n Active monitoring mode.

[0099] The monitoring mode is optionally defined by at least one or any combination of more than one of the following: User KPI ukpi n,k , optionally called effective ukpi n,k , which is selected from the set of user key performance indicators to be monitored by the mode U-KPI(n) = {ukpi n,k |1≤k≤K}; the time configuration that characterizes the temporal correlation of the monitoring; the transmission mode (batch or streaming), according to which SWB b The monitored UKPI n,k The data is transmitted to MyCompany; and / or a data analysis profile that specifies at least one desired type of analytical data to be generated by processing the monitored data.

[0100] Effective user KPIs selected for monitoring ukpi n,s The exemplary UKPI noted above with reference to flowchart 100 may include n,k As an additional example, the exemplary ukpi n,k It can be the number and type of websites or resources that the user engages with per session, and any of a variety of common human-machine motion events that the user performs per unit time to communicate with the computer. For example, common human-machine motion events are "mouseover", "mouseleave", "submit" and / or "resize" events.

[0101] The time configuration of the monitoring mode can be characterized as a duty cycle or a continuous configuration, and the corresponding monitoring mode is characterized as a duty cycle mode or a continuous monitoring mode, respectively. n,k The duty cycle mode is a mode in which, for each of a plurality of discrete sampling periods separated by gaps, the effective ukpi is monitored during the monitoring period of interest. n,k , no valid UKPI is monitored during the said gap n,k The duty cycle of this mode is equal to the effective ukpi n,k The percentage of the monitoring period of interest that is monitored. If the sampling periods have the same duration and a substantially constant sampling frequency for initiating the sampling period, the duty cycle is substantially equal to the sampling frequency multiplied by the duration of the sampling period divided by the duration of the monitoring period of interest. The sampling period and sampling frequency of the duty cycle monitoring mode are for a portion or all of the active ukpi n,k Can be the same. Valid UKPI n,kAt least some of the different valid UKPI n,k Can have different sampling periods and / or sampling frequencies. If valid ukpi n,k is substantially continuously monitored over the total duration of the monitoring period of interest, and the monitoring pattern is not advantageously characterized as a duty cycle, then for a valid ukpi n,k The monitoring mode is considered to be continuous monitoring mode.

[0102] In an embodiment, the analysis data specified by the data analysis profile may include at least one or any combination of more than one of proactive assistance analysis, safety analysis, enrichment analysis, and / or audit analysis.

[0103] Proactive help analysis involves processing monitoring data to infer possible user help needs and prescribing substantive help in response to the need. For example, the inference can be based on identifying features such as frantic search patterns exhibited by the user, unusual interruptions in user activity, screenshots taken during the interruptions, unusual user delays in responding to resource actions. For example, substantive help can be determined and configured based on heuristics, machine learning algorithms, and / or in response to queries submitted to the generative AI.

[0104] Security analysis includes processing the monitoring data to identify abnormal events that may indicate a risk of network compromise and / or violation of MyCompany policies. Abnormal events may be determined by identifying outliers or outlier members of any set of components used to determine the initial monitoring pattern in block 306. Components (such as user KPIs ukpi n,k , or website risk vulnerability wrv w,v ) may be, for example, a value of the component that deviates from the mean (optionally, the historical mean) of the component by more than the standard deviation. For example, an outlier member may be a new and potentially high-risk website that a user attempts to visit for the first time. According to an embodiment of the present disclosure, a response to an abnormal event may include invoking an ICAP process, which may be similar to Figures 3A-3C The ICAP 200 illustrated by the flowchart 200 in the embodiment is used to reduce user privileges and / or access to data in a resource. It should be noted that although the ICAP 200 is described as managing data indicated as confidentiality-sensitive information characteristics that have been assigned corresponding confidentiality levels, the ICAP according to the embodiment can be similarly configured to manage and respond to risk-sensitive characteristics of resources by assigning risk levels to the characteristics and assigning corresponding risk tolerance permissions to users.

[0105] Enrichment analysis involves processing the monitoring data to identify analysis data (optionally referred to as new data) that can be used to update or add to information included in any set used to determine the initial monitoring pattern in block 306. Identification of the monitoring data as new data can be determined by comparing a value provided by or derived from the monitoring data with a corresponding value in the set used to determine the initial monitoring pattern in block 306.

[0106] Audit analysis involves processing monitoring data to generate audit data records that identify and specify details of a trajectory that MyCompany digital resources have passed through. The trajectory may include any passage of resources between communication nodes in a MyCompany and / or CyberSafe local area network or wide area network communication network (LAN or WAN, respectively) and / or between MyCompany and / or CyberSafe nodes and nodes external to MyCompany or CyberSafe, as well as changes that resources may undergo at the nodes. Audit data records are optionally generated for each of a plurality of audit triggering events, which may include, for example: downloading a MyCompany resource, modifying a resource, copying material from a resource, pasting material to a clipboard, and / or transferring a resource, a modified resource, or a portion of a resource to a printer. In an embodiment, for each of a plurality of audit triggering events on a user UE, an audit data record is generated. e The audit data record of an event occurring at the UE includes a value for each of a plurality of keys of a key-value pair, wherein the keys include at least one or any combination of more than one of the following: an event timestamp; a value associated with the event being performed using the UE e The extended ID associated with the MyCompany user of the UE, a hash of metadata identifying and / or characterizing the resource, a hash of the content of the resource or at least a portion of the resource, and the UE e The source address of the source from which the resource is received and / or the resource is received from the UE e The destination address of the destination to which the transmission is being made.

[0107] In an embodiment, the HIRO may optionally initiate the monitoring mode in response to any one or any combination of the following: n Components of profile U-PRF(n); User equipment UE e UE e The components of the risk vector HVR(e); UE e Components of the damaged component set HCC(e) of the background software; SWB bThe initialized monitoring mode may also be determined in response to the following: the set of websites monitored by MyCompany and visited by MyCompany users WS = {ws w |(1≤w≤W)} in the website ws w and / or website risk vulnerability set WRV(w)={wrv w,v |1≤v≤V)}, where wrv w,v Quantify the website ws determined by MyCompany or CyberSafe w Any of a variety of artificial intelligence (AI), such as a deep neural network (DNN) or a machine learning algorithm (ML), can be used to assign risk levels to vulnerabilities. Optionally, heuristic classification is used to determine risk vulnerabilities. In an embodiment, the HIRO can initialize the monitoring mode in response to the data analysis profile.

[0108] As a simplified example, the initialized monitoring mode for the MyCompany user having a user profile U-PRF(n) deemed to indicate a relatively high risk of network impairment may be configured as a duty cycle monitoring mode with a relatively high duty cycle or a continuous monitoring mode. n,r is considered to indicate a high risk of network damage, then the user profile U-PRF(n) may, for example, be considered to indicate a high risk. On the other hand, for a user having a relatively high license level component CLR in the user license profile set CLR(n,e,b) n (α, βγη of MyCompany users, the initialized mode may be a duty cycle mode with a relatively small duty cycle.

[0109] In decision block 308, if the HIRO initializes the monitoring mode to duty cycle mode, the HIRO may proceed to block 310 and select a valid ukpi n,k Collection, for the selected UKPI n,k Each of the MCUs determines the duty cycle and determines whether the data transmission is a batch transmission or a stream transmission.

[0110] On the other hand, if the HIRO does not initialize the monitoring mode to the duty cycle mode, but initializes it to the continuous monitoring mode, the HIRO may proceed to block 312. In block 312, the HIRO selects the effective user KPI ukpi n,k Used for continuous monitoring and to determine whether data transfer is batch or streaming.

[0111] In block 316, HIRO begins monitoring user activity according to the initialized monitoring mode, recording and transmitting data to MyCompany.

[0112] Optionally, in block 318, the HIRO determines a substantially real-time value of a user activity metric (optionally referred to as activity temperature) that provides a measure of the user's activity while using the UE. e An indication of the intensity of interaction with MyCompany resources at the time of activity. For example, activity temperature can be the effective user ukpi n,k The (optionally weighted) average of at least a portion of the real-time monitored values ​​of n,k Optionally, the HIRO determines the activity temperature based on the number of events per unit time determined from: n,k Acquired monitoring data. In an embodiment, thermal events include human-computer motion events, such as keyboard, mouse, and screen touch events commonly used to interact with a computer.

[0113] Optionally, in block 320, the HIRO determines the difference between the real-time activity temperature and a baseline activity temperature based on the thermal ukpi provided by the user profile U-PRF(n). n,k The user profile U-PRF(n) is used in block 306 to initialize the user profile for observing the user U n If the difference is greater than a predetermined threshold difference TH(temp), then in block 322, the HIRO may adjust the monitoring mode, for example by changing the effective and thermal ukpi n,k duty cycle, or by changing the monitoring mode from duty cycle mode to continuous mode or from continuous mode to duty cycle mode.

[0114] For example, if the real-time activity temperature is relatively low, indicating relatively low user activity, then the effective UKPI may be advantageously increased. n,k sampling time and duty cycle in order to obtain sufficiently timely monitoring data for generating reliable analysis. Or if the activity temperature is relatively high and / or it is desired to improve the temporal resolution, it may be advantageous to reduce the sampling time but increase the sampling frequency, or change the current monitoring mode from the duty cycle monitoring mode to the continuous monitoring mode. As another example, if the user activity temperature is relatively low and the user is interacting with known web pages or other resources that do not involve high-intensity user activity, it may be reasonable to reduce the duty cycle when the current monitoring mode is the duty cycle mode or to switch from the current continuous mode to the duty cycle mode. Adjustments to the monitoring mode can also be made by changing which user ukpi n,k is valid or valid UKPI n,kIn an embodiment, the HIRO is configured to dynamically adjust the monitoring mode in real time.

[0115] In decision box 324, if the monitoring mode data analysis profile specifies that the monitoring mode participates in active help, the HIRO may proceed to box 326 and invoke help analysis to identify and respond to user needs, as described above. Otherwise, the HIRO may proceed to decision box 328. In decision box 328, if the analysis profile specifies that the monitoring mode participates in security analysis, the HIRO may proceed to box 330 and invoke security analysis to identify security gaps and optionally take remedial actions to offset the identified gaps, as described above. Otherwise, the HIRO may proceed to decision box 332. In decision box 332, if the analysis profile specifies that the monitoring mode participates in data enrichment, the HIRO may proceed to box 334 and invoke enrichment analysis to identify new data and optionally update relevant MyCompany data, such as data in the user profile U-PRF(n) and / or data in the website risk vulnerability WRV(w). Otherwise, the HIRO may proceed to decision box 336. In decision block 336, if the analysis profile specifies not to participate in the audit analysis, HIRO may proceed to block 340 and either terminate the audit analysis for user U or terminate the audit analysis for user U. n 's activities, or return to block 316 and continue monitoring. On the other hand, if the analysis profile specifies participation in audit analysis in block 336, the HIRO may proceed to block 338, invoke audit analysis and generate audit data records for audit trigger events that enable MyCompany to audit the history of MyCompany resources as they may traverse and morph in the MyCompany network. The HIRO may then proceed to block 340 and either stop monitoring activities, or return to block 316 and continue monitoring.

[0116] According to an embodiment of the present disclosure, a hypothetical history of a given MyCompany resource (optionally a research report "X") traversing the MyCompany network illustrates the operation of a HIRO audit analysis.

[0117] Let trg μ Represents the audit trigger event set TRG(b) = {trg μ |(1≤μ≤U)}, such as the audit trigger event mentioned above that may occur at user U n UE in use e SWB b Let AUR(b) denote an audit data record that includes the response to the trigger event that occurs in SWB bThe audit trigger event associated with the MyCompany resource that occurs in SWB b Generate and forward to MyCompany component {aur α |(1≤α≤A)}. According to an embodiment of the present disclosure, the component includes the value of the key-value pair discussed above, and additionally advantageously includes an ID for an audit trigger event that caused the SWB b An audit data record is generated and forwarded to MyCompany.

[0118] Assume that MyCompany research report "X" is created by MyCompany first user U 1 In time ToD 1 Download to UE 1 Browser SWB in 1 . Download can be an audit trigger event "trg 1 ”, which causes SWB 1 Generate the "first" audit data record AUR(1) 1 And upload the audit data record to MyCompany. AUR(1) 1 It can be shown that: 1 , user U 1 From IP address A 1 Download X with a hash H1-M identifying metadata of X and a hash H1-C of a portion of the content of X. By SWB 1 In response to user U 1 The trigger event trg for changes to X 2 The second audit data record AUR(1) generated and uploaded 2 Shown: At time ToD 2 , U 1 Changed the metadata of X. In addition to replacing metadata hash H1-M with metadata hash H2-M, AUR(1) 2 All components of AUR(1) 1 The corresponding components of are the same. 1 Generated and uploaded third audit data record AUR(1) 3 Shown: At time ToD 3 , U 1 A document having a content hash and a metadata hash H2-M identical to the content hash of H1-C is transmitted to the operating browser SWB 2 The second MyCompany user U 2 IP address A 2 . By SWB 2The fourth audit data record AUR(2)4 generated and uploaded shows: at time ToD 3 Soon after ToD 4 , user U 2 From user U 1 A document bearing the metadata hash H2-M is received. 2 Generated and uploaded the fifth audit data record AUR(2) 5 Shows U 2 Email a document to a non-MyCompany employee that has the third metadata hash H3-M but has the same audit data record AUR(1) as document X 1 By processing the uploaded audit data record, MyCompany is able to determine the audit data record AUR(1) 1 -AUR(2) 5 The content of is associated with document X, and user U 1 and U 2 Collaborate in disclosing MyCompany confidential material to an outside entity.

[0119] In an embodiment, MyCompany UE e SWB b Can be configured to implement a method for the following operations: Provide users with dynamically customized isolation (DYTI) to protect MyCompany resources from damage. DYTI involves dynamically protecting user browsing activities in real time by configuring isolation of browsing activities as needed in response to relevant historical and real-time user and website behaviors. In an embodiment, DYTI can provide dynamically customized browser isolation by operating according to a process similar to that illustrated by flowchart 400.

[0120] In block 402, using UE e SWB included in b User U n Initiate a web browsing session. In response, optionally, in block 404, SWB b The DYTI may be invoked and operated to review data included in or associated with at least one or any combination of at least one or more of the following: user profile U-PRF(n), UE e and / or SWB b , and / or a set of website risk vulnerabilities WRV(w) that may affect the risk of network damage associated with browsing. In response to the review, optionally in block 406, DYTI determines whether isolation is beneficial. For example, if the user profile U-PRF(n) indicates that the user U nTend to respond carelessly to phishing, have relatively low permission levels CLR, UE e Has outdated patches, and / or user U n If the website navigated to is typically characterized by high-risk vulnerabilities, DYTI may determine that isolation is beneficial. On the other hand, if DYTI n ,UE e and / or SWB b Determining that the browsing risk is relatively low, the DYTI may determine that quarantine may be unnecessary. If quarantine is determined to be unnecessary, the DYTI may proceed to block 416 and allow browsing without quarantine.

[0121] On the other hand, if it is determined that isolation is necessary, the DYTI may optionally determine in block 408 that the isolation configuration is advantageous for user U. n What type and degree of isolation is provided for browsing. In an embodiment, isolation configuration types include per-tab isolation and browser isolation. Per-tab isolation configuration provides isolation for resources accessed during a session associated with a given tab, and optionally can provide different isolation features for different web pages accessed during and via a tab session. Browser isolation isolates the entire browser and is generally considered to provide more comprehensive isolation than per-tab isolation. It should be noted that browser isolation for a given browser can "nest" per-tab isolation and isolate tabs opened in the browser from each other and from a given browser. The degree of isolation of a given isolation configuration type can be considered to increase with the increase in the number of isolation features included in the configuration type and with the increase in the severity of the restrictions imposed on browsing by the isolation features, respectively. For example, in the order of being considered "serious", a short list of exemplary isolation features can be: server signature disabling; error message disabling; anti-clickjacking; and remote file inclusion blocking.

[0122] In response to the determination in block 408, DYTI may optionally determine in block 410 whether per-label isolation is appropriate to provide the desired degree of isolation. If per-label isolation is deemed appropriate, DYTI may proceed to block 412 to specify isolation features for per-label isolation that provide the user U with a desired degree of isolation. n Browsing provides the desired degree of isolation and proceeds to block 416 and allows the user U n On the other hand, if DYTI determines in decision block 410 that per-tab isolation is not appropriate, DYTI may optionally proceed to block 414 to sandbox the browser using a virtualization technology (such as a virtual machine or container) or via a bare metal server sandbox, optionally for a browser SWB. b Operating system based (OS based) isolation is provided. DYTI may proceed from block 414 to block 416 and allow the user to browse.

[0123] In an embodiment, U is allowed to n After browsing, the DYTI may engage in real-time monitoring of the user's browsing in block 418 to optionally determine in decision block 420 whether characteristics of the browsing (such as, for example, unusual events or the user visiting unknown or particularly malicious websites) warrant a change in the isolation configuration. If an isolation change is indicated, the DYTI optionally returns to decision block 406 to determine the type and degree of isolation required. Optionally, the DYTI is configured to make the change and the DYTI makes the change. If no isolation change is indicated, the DYTI may proceed to decision block 422 to determine whether the user U n Whether the browsing session has been closed, if not, return to block 418 to continue monitoring the user's browsing. If the user has closed the browsing session, DYTI proceeds to block 424, closes any open sandboxes, and ends the DYTI activity. According to an embodiment, DYTI is configured so that establishing a particular isolation configuration and / or making changes to the isolation configuration during a browsing session is not a problem for a user (such as user U). n ) is basically transparent.

[0124] In the specification and claims of this application, each verb "comprise", "include" and "have" and their variations are used to indicate that one or more objects of the verb are not necessarily a complete list of components, elements or parts of one or more subjects of the verb.

[0125] The description of the embodiments of the present invention in this application is provided by way of example and is not intended to limit the scope of the present invention. The described embodiments include different features, not all of which are required in all embodiments of the present invention. Some embodiments utilize only some of the features or possible combinations of features. Those skilled in the art will recognize variations of the described embodiments of the present invention, as well as embodiments of the present invention that include different combinations of the features mentioned in the described embodiments. The scope of the present invention is limited only by the claims.

Claims

1. A method for controlling access to digital resources in a digital resource group, the method comprising: determining an information sensitive feature included in the information content of the resource, wherein access to the feature is limited to users selected from a user group associated with the resource group; determining whether the content of the digital resource includes at least one of the information sensitive characteristics; Based on the at least one information-sensitive characteristic, determining whether a user in the user group has authorization to access at least a portion of the resource; as well as The user is enabled to access only the at least a portion of the resources for which the user is determined to have authorization.

2. The method of claim 1, and determining that the user does not have authorization to access at least a portion of the resource.

3. The method of claim 1, and determining that the user has authorization to access all resources. The method of claim 1 , wherein the at least a portion of the resource comprises only a portion of the resource.

5. A method according to claim 4, and comprising masking or deleting a portion of the resource to which the user is determined not to have authorised access, to provide an edited resource. The method of claim 5 , wherein masking or deleting comprises modifying a renderer that renders the resource but not modifying the resource received by the renderer.

7. A method according to claim 5 or 6, and enabling the user to access the edited resource.

8. A method according to any one of the preceding claims, wherein determining authorization comprises determining a confidentiality level for each of the at least one information-sensitive characteristic and using the confidentiality level to determine authorization.

9. The method of claim 8, and using artificial intelligence to determine the confidentiality level.

10. A method according to any preceding claim, wherein determining authorisation comprises determining respective permission levels for the users in the user group and using the permission levels to determine authorisation.

11. The method of claim 10, and using artificial intelligence to determine the corresponding permission level.

12. The method according to claim 10 or 11, wherein determining authorization comprises determining a confidentiality level for each of the at least one information-sensitive feature, and determining authorization based on the confidentiality level and the permission level for each of the at least one information-sensitive feature.

13. A method according to any of the preceding claims, wherein determining authorization includes teaching an artificial intelligence (AI) to determine authorization for multiple users and multiple resources, and using the AI ​​to determine whether the user has authorization to access at least a portion of the resources.

14. The method of any preceding claim, wherein the at least one information sensitive feature comprises a plurality of information sensitive features.

15. A method according to any one of the preceding claims, wherein and said at least one information-sensitive feature comprises at least one information-sensitive textual feature.

16. A method according to any preceding claim, wherein the at least one information sensitive feature comprises at least one information sensitive image feature.

17. A method according to any preceding claim, wherein the at least one information sensitive feature comprises at least one information sensitive audio feature.

18. A method according to any preceding claim, wherein the at least one information sensitive feature comprises at least one information sensitive video feature.

19. A method according to any preceding claim, and comprising watermarking at least part of the resource.

20. The method of claim 19, wherein watermarking comprises modifying a renderer that renders the resource but not modifying the resource received by the renderer.

21. A communication system for providing secure access to digital resources in a set of digital resources accessible via a communication network, the system comprising: A data processing concentrator accessible via an IP (Internet Protocol) address; as well as a plurality of user equipment (UE) operable to communicate via the communication network, each user equipment being configured to have a network security isolation environment (CISE) isolated from background software in the UE and including a secure web browser (SWB); The concentrator and the CISE are configured to make the moving digital resources and the stationary digital resources in the CISE visible to the concentrator, and the SWB comprises or has access to computer executable instructions executable by the SWB to implement the method according to any one of the preceding claims.

22. A method for monitoring user activity interacting with digital resources in a group of digital resources accessible via a communication network, the method comprising: providing the user with a user equipment (UE) comprising a web browser, the web browser being configured to make resource movement in the web browser visible to a processing concentrator associated with the group of digital resources; as well as determining a user profile for a user, the user profile comprising at least one key performance indicator (KPI) characterizing user activity when interacting with digital resources in the resource group using the web browser; as well as In response to the at least one KPI, a monitoring mode is configured for the web browser, according to which the browser is operative to obtain monitoring data representative of user activity when using the web browser to interact with resources in the resource group.

23. The method of claim 22, and comprising configuring the monitoring mode in response to at least one or any combination of more than one of the following: characterizing the network attack vulnerability characteristics of the UE; Software for providing network protection to the UE; A permission profile that determines rights to access resources in the resource; a website that the user visits.

24. The method of claim 22 or 23, wherein configuring the monitoring mode comprises selecting at least one effective user KPI from a plurality of user KPIs, the web browser acquiring monitoring data of the effective user KPI when monitoring user activities during a monitoring period of interest.

25. The method of any of claims 22-24, wherein configuring the monitoring mode comprises determining a time configuration characterizing a time relevance of the monitoring during a monitoring period of interest.

26. The method of claim 25, wherein determining the time configuration comprises determining whether the monitoring mode is a duty cycle mode or a continuous monitoring mode.

27. The method of claim 26, wherein determining the duty cycle pattern comprises determining a sampling frequency of a sampling period during which a valid KPI of the at least one valid user KPI is monitored and a duration of the sampling period.

28. The method according to any one of claims 23 to 27, wherein configuring a monitoring mode comprises determining a transmission mode for transmitting monitoring data acquired by the web browser to the concentrator.

29. The method of any one of claims 23-28, wherein configuring a monitoring mode comprises determining a data analysis profile for the monitoring mode, the data analysis profile specifying a type of analysis data to be generated by processing the monitoring data.

30. The method of claim 29, wherein specifying the type of analysis data comprises selecting at least one or any combination of more than one of the following: proactive assistance analysis, safety analysis, enrichment analysis, and / or audit analysis.

31. The method of claim 30, wherein generating audit analysis data comprises: determining a set of audit triggering events that may occur during user activities interacting with resources in the resource group; as well as A corresponding audit data record is generated in response to the occurrence of an audit triggering event, wherein the audit data record generated in response to the occurrence of the audit triggering event includes a value of a key-value pair characterizing the audit triggering event.

32. A method according to claim 31, and including using audit data records to identify the trajectory of the resource passing between communication nodes of the communication network.

33. A method according to claim 32, and comprising using audit data records to identify changes experienced by said resources at nodes of said communications network.

34. A method according to any one of claims 31 to 33, and comprising using a plurality of audit data records to determine relationships between different resources propagated via the communications network.

35. A method according to any of the preceding claims, wherein the UE is configured to have a network secure isolation environment (CISE) isolated from background software in the UE, and wherein the web browser is a secure web browser (SWB) resident in the CISE.

36. A communication system for providing secure access to digital resources in a set of digital resources accessible via a communication network, the system comprising: a data processing concentrator accessible via said communications network at an IP (Internet Protocol) address; as well as a plurality of user equipment (UE) operable to communicate via the communication network, each user equipment being configured to have a network security isolation environment (CISE) isolated from background software in the UE and including a secure web browser (SWB); The concentrator and CISE are configured to make the moving digital resources and the stationary digital resources in the CISE visible to the concentrator, and the concentrator and / or the SWB are configured to implement the method according to any one of claims 22-34.

37. A method for providing browsing isolation for a web browser, the method comprising: Reviewing at least one or any combination of more than one of the following: a user profile of a user accessing a website using a web browser in a UE, a network attack vulnerability feature characterizing the UE; a network attack vulnerability feature characterizing the browser; The websites visited by the user and the risk vulnerabilities of the websites; as well as A determination is made based on the review as to the type and degree of isolation to provide for the browser.

38. The method of claim 37, wherein determining the type of isolation comprises selecting tab-by-tab isolation and / or browser isolation.

39. The method of claim 38, wherein selecting browser isolation comprises selecting virtualization technology sandbox isolation or bare metal server isolation.

40. The method of claim 38 or 39, wherein selecting browsing isolation and tab-by-tab isolation comprises nesting tab-by-tab isolation within browsing isolation.

41. The method of any one of claims 37-40, wherein the isolation comprises operating system-based (OS-based) isolation.

42. The method of claim 37, wherein selecting a degree of isolation comprises selecting a number of isolation features to be included in the selected isolation type and a severity of restrictions provided by the selected isolation features.

43. The method of any one of claims 37-42, wherein the browser is configured to monitor user browsing to determine whether characteristics of the user browsing warrant a change in the isolated configuration.

44. A method according to claim 43, and comprising changing the configuration if a change proves necessary.

45. A method according to claim 44, and including configuring the browser to make the changes.

Images