Internet Gateway Sandboxing for Suspicious Email Adjuncts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing computers against threats from communications adjuncts, such as sandboxing, require significant resource consumption and introduce security risks by trusting cloud service providers with communication content.
Innovation Solution
An internet gateway with a traffic monitor, scanner, and sandbox manager that identifies suspicious adjuncts, launches them in a sandbox container for analysis, and updates threat lists based on run traces, without requiring local sandbox software on every device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandboxing is used to secure computers against threats from communications adjuncts, then security is improved, but resource consumption increases
Solution Approach 1:
The system segments the sandboxing approach by only sandboxing adjuncts from communications to suspicious destinations rather than all adjuncts. The traffic monitor divides network traffic into monitored and unmonitored streams, the scanner selectively identifies suspicious communications, and the sandbox manager creates isolated containers only when needed. This segmentation reduces resource consumption while maintaining security for high-risk communications.
Solution Approach 2:
The system applies different quality levels of security analysis to different communications based on their destination. Communications to suspicious destinations receive intensive sandboxing analysis, while normal communications pass through with minimal resource consumption. The traffic monitor, scanner, and sandbox manager work together to apply local quality control, ensuring high security where needed and low resource usage elsewhere.
2Measurement precision
If cloud services are used for sandboxing, then security analysis capability is improved, but security risks increase due to trusting cloud providers with communication content
Solution Approach 1:
The internet gateway acts as an intermediary between the network and external services. It includes a local scanner and sandbox manager that can analyze communications without requiring cloud providers to access the full communication content. The gateway mediates between security needs and privacy concerns by performing analysis locally when possible, reducing the security risk of trusting cloud providers while maintaining analysis capability.
Solution Approach 2:
The system adds a local analysis dimension at the internet gateway layer, rather than relying solely on cloud-based sandboxing. This creates a multi-layered security approach where the gateway can perform initial scanning and sandboxing locally, and only escalate to cloud services when necessary. This dimensional change reduces dependency on cloud providers while maintaining comprehensive security analysis capability.
3Reliability
If sandboxing is performed locally at every device, then security control is improved, but device complexity increases
Solution Approach 1:
The internet gateway serves multiple functions: traffic monitoring, scanning for suspicious destinations, sandboxing of adjuncts, and threat list maintenance. By consolidating these security functions at the gateway level rather than requiring them at every device, the system achieves centralized security control while reducing the complexity burden on individual devices. The gateway's sandbox manager can service multiple clients without each client needing full sandboxing capability.
Solution Approach 2:
The system implements self-service through the scanner automatically detecting suspicious destinations and the sandbox manager autonomously creating and managing sandbox containers. The traffic monitor, scanner, and sandbox manager work together in an automated pipeline that reduces manual configuration and management overhead. This self-service capability maintains strong security control while simplifying operational complexity.
4Measurement precision
If all incoming communications are scanned, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The traffic monitor performs preliminary identification of suspicious destinations before the scanner conducts full analysis. By pre-identifying communications to suspicious destinations, the system can then apply focused scanning only to these high-risk communications rather than analyzing every incoming message in detail. This preliminary action maintains high detection accuracy while reducing overall processing time through selective deep analysis.
Solution Approach 2:
The system applies partial scanning to all communications (checking destination against threat lists) and excessive/detailed scanning only to communications to suspicious destinations. The traffic monitor and scanner work in stages, with the first pass being quick and the second pass being thorough but applied only when necessary. This partial/excessive action strategy maintains high detection accuracy for critical threats while minimizing processing time for normal traffic.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to securing computers against threats found in adjuncts to communications, such as links in and attachments to emails. It provides an internet gateway for connecting a computer network to the internet, the internet gateway comprising: a traffic monitor configured to monitor outgoing communications from the computer network; a scanner configured to scan incoming communications to the computer network in response to detection, by the traffic monitor, of communication to a suspicious destination; and a sandbox manager configured to, in response to identification, by the scanner, of a suspicious adjunct to an incoming communication, launch a sandbox container on the internet gateway and open the suspicious adjunct in that sandbox container.