Back to results
US 11,888,902 B2Granted
Object metadata-based cloud policy enforcement using synthetic request injection
AssigneeNetskope, Inc.
InventorsPrasenna Ravi, David Tze-Si Wu
Life of this patent
Estimating the term…
Abstract
The technology disclosed describes a network security system that is configured to configure a synthetic request with an object identifier, and to inject the synthetic request into an application session to transmit the synthetic request to a cloud application. The synthetic request is configured to retrieve object metadata about the object using the object identifier. The network security system is further configured to receive from the cloud application a response to the synthetic request. The response supplies the object metadata.
Claims20
A system, comprising:
- a network security system interposed between clients and cloud applications, running on one or more hardware processors coupled to memory storing instructions, the instructions when executed cause the network security system to:
- receive, during an application session, an incoming request from a client, wherein the incoming request is directed towards a cloud application and includes an object identifier of an object and an activity initiated on the object, and wherein the incoming request is intercepted by the network security system;
- analyze the incoming request;
- detect the object identifier based on the analyzing the incoming request;
- hold the incoming request to hold execution of the activity on the object;
- configure a synthetic request with the object identifier;
- inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to retrieve object metadata about the object using the object identifier, and wherein the synthetic request is generated by the network security system in response to the incoming request and is separate from the incoming request generated by the client;
- receive a response to the synthetic request from the cloud application, wherein the response supplies the object metadata that is available for enforcing a security policy on the activity initiated on the object by the incoming request;
- and
- evaluate the object metadata against the security policy, the evaluation comprising:
- in response to a determination that the activity qualifies as executable on the object based on the object metadata and the security policy:
- release the hold of the incoming request, and
- transmit the incoming request to the cloud application for execution of the activity;
- and
- in response to a determination that the activity does not qualify as executable on the object based on the object metadata and the security policy:
- block the incoming request from the cloud application.
13 more elements
A computer-implemented method, comprising:
- a network security system, interposed between clients and cloud applications, the network security system receiving, during an application session, an incoming request from a client, wherein the incoming request is directed towards a cloud application and includes an object identifier of an object and an activity initiated on the object;
- the network security system analyzing the incoming request;
- the network security system detecting the object identifier based on the analyzing the incoming request;
- the network security system holding the incoming request to hold execution of the activity on the object;
- the network security system configuring a synthetic request with the object identifier;
- the network security system injecting the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to retrieve object metadata about the object using the object identifier, and wherein the synthetic request is generated by the network security system in response to the incoming request and is separate from the incoming request generated by the client;
- the network security system receiving a response to the synthetic request from the cloud application, wherein the response supplies the object metadata;
- and
- the network security system evaluating the object metadata against a security policy, the evaluation comprising:
- in response to a determination that the activity qualifies as executable on the object based on the object metadata and the security policy:
- releasing the hold of the incoming request, and
- transmitting the incoming request to the cloud application for execution of the activity;
- and
- in response to a determination that the activity does not qualify as executable on the object based on the object metadata and the security policy:
- blocking the incoming request from the cloud application.
12 more elements
A non-transitory computer readable storage medium impressed with computer program instructions to enforce policies, the instructions, when executed on a processor, implement a method comprising:
- a network security system, interposed between clients and cloud applications, the network security system receiving, during an application session, an incoming request from a client, wherein the incoming request is directed towards a cloud application and includes an object identifier of an object and an activity initiated on the object;
- the network security system analyzing the incoming request;
- the network security system detecting the object identifier based on the analyzing the incoming request;
- the network security system holding the incoming request to hold execution of the activity on the object;
- the network security system configuring a synthetic request with the object identifier;
- the network security system injecting the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to retrieve object metadata about the object using the object identifier, and wherein the synthetic request is generated by the network security system in response to the incoming request and is separate from the incoming request generated by the client;
- the network security system receiving a response to the synthetic request from the cloud application, wherein the response supplies the object metadata;
- and
- the network security system evaluating the object metadata against a security policy, the evaluation comprising:
- in response to a determination that the activity qualifies as executable on the object based on the object metadata and the security policy:
- releasing the hold of the incoming request, and
- transmitting the incoming request to the cloud application for execution of the activity;
- and
- in response to a determination that the activity does not qualify as executable on the object based on the object metadata and the security policy:
- blocking the incoming request from the cloud application.
12 more elements
Dependencies are inferred from the claim text.