# US 11,909,808 B2 · Non-HTTP layer 7 protocol applications running in the browser > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,808 B2 - Document ID: US11909808B2 - Status: Granted - Kind: B2 - Application number: 17/956,695 - Filed: 2022-09-29 - Published: 2023-06-22 - Granted: 2024-02-20 - Earliest claimed: 2021-04-15 - Assignees: Cloudflare, Inc. - Applicants: Cloudflare, Inc. - Inventors: Killian Koenig; Dane Orion Knecht; James Royal - Web page: https://patentgrep.com/patent/US11909808B2 ## CPC - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/102: {Entity profiles} - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04L 67/561: Adding application-functional data or data for application control, e.g. adding metadata - H04L 67/563: Data redirection of data network streams - H04L 69/162: {involving adaptations of sockets based mechanisms (secure socket layer H04L63/168)} - H04L 69/18: Multiprotocol handlers, e.g. single devices capable of handling multiple protocols - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A server receives from a browser executing on a client device an HTTP request. The server transmits a response to the HTTP request to the browser. The response includes code that when executed by the browser, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network. The server receives, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service. The server proxies the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service. The server logs event data received from the non-HTTP layer 7 protocol client executing in the browser. ## Claims ### Claim 1 A method, comprising: receiving, at a server from a browser executing on a client device, an HTTP request; transmitting, to the browser executing on the client device, a response to the HTTP request, wherein the response includes code that when executed by the browser executing on the client device, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network; receiving, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service; proxying the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service; and logging event data received from the non-HTTP layer 7 protocol client executing in the browser. ### Claim 2 (depends on 1) The method of claim 1, wherein the code is in a WebAssembly format. ### Claim 3 (depends on 1) The method of claim 1, wherein the non-HTTP layer 7 protocol client is a Secure Shell Protocol (SSH) client, wherein the non-HTTP layer 7 protocol service is a SSH server, and wherein the SSH client executes in a tab of the browser. ### Claim 4 (depends on 1) The method of claim 1, wherein the data related to the non-HTTP layer 7 protocol service is received over a WebSocket between the browser and the server. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, based on a set of one or more policies configured for a domain of the HTTP request, that the HTTP request is allowed to be processed, wherein the set of one or more policies are based on one or more of identity, device posture, location, and/or risk signals. ### Claim 6 (depends on 1) The method of claim 1, further comprising: authenticating a user of the non-HTTP layer 7 protocol client with the non-HTTP layer 7 protocol service. ### Claim 7 (depends on 6) The method of claim 6, wherein authenticating the user includes performing one of: presenting a login prompt, presenting a prompt for a public key, and automatically performing a certificate generation and authentication. ### Claim 8 A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations including: receiving, at a server from a browser executing on a client device, an HTTP request; transmitting, to the browser executing on the client device, a response to the HTTP request, wherein the response includes code that when executed by the browser executing on the client device, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network; receiving, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service; proxying the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service; and logging event data received from the non-HTTP layer 7 protocol client executing in the browser. ### Claim 9 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the code is in a WebAssembly format. ### Claim 10 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the non-HTTP layer 7 protocol client is a Secure Shell Protocol (SSH) client, wherein the non-HTTP layer 7 protocol service is a SSH server, and wherein the SSH client executes in a tab of the browser. ### Claim 11 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the data related to the non-HTTP layer 7 protocol service is received over a WebSocket between the browser and the server. ### Claim 12 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the operations further comprise: determining, based on a set of one or more policies configured for a domain of the HTTP request, that the HTTP request is allowed to be processed, wherein the set of one or more policies are based on one or more of identity, device posture, location, and/or risk signals. ### Claim 13 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the operations further comprise: authenticating a user of the non-HTTP layer 7 protocol client with the non-HTTP layer 7 protocol service. ### Claim 14 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein authenticating the user includes performing one of: presenting a login prompt, presenting a prompt for a public key, and automatically performing a certificate generation and authentication. ### Claim 15 A server, comprising: a processor; and a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the server to perform operations including: receiving, at the server from a browser executing on a client device, an HTTP request; transmitting, to the browser executing on the client device, a response to the HTTP request, wherein the response includes code that when executed by the browser executing on the client device, executes a non-HTTP layer 7 protocol client that communicates with a non-HTTP layer 7 protocol service at an external network; receiving, from the non-HTTP layer 7 protocol client executing in the browser, data related to the non-HTTP layer 7 protocol service; proxying the data related to the non-HTTP layer 7 protocol service over a layer 4 tunnel that is interfaced with the non-HTTP layer 7 protocol service; and logging event data received from the non-HTTP layer 7 protocol client executing in the browser. ### Claim 16 (depends on 15) The server of claim 15, wherein the code is in a WebAssembly format. ### Claim 17 (depends on 15) The server of claim 15, wherein the non-HTTP layer 7 protocol client is a Secure Shell Protocol (SSH) client, wherein the non-HTTP layer 7 protocol service is a SSH server, and wherein the SSH client executes in a tab of the browser. ### Claim 18 (depends on 15) The server of claim 15, wherein the data related to the non-HTTP layer 7 protocol service is received over a WebSocket between the browser and the server. ### Claim 19 (depends on 15) The server of claim 15, wherein the operations further comprise: determining, based on a set of one or more policies configured for a domain of the HTTP request, that the HTTP request is allowed to be processed, wherein the set of one or more policies are based on one or more of identity, device posture, location, and/or risk signals. ### Claim 20 (depends on 15) The server of claim 15, wherein the operations further comprise: authenticating a user of the non-HTTP layer 7 protocol client with the non-HTTP layer 7 protocol service. ### Claim 21 (depends on 20) The server of claim 20, wherein authenticating the user includes performing one of: presenting a login prompt, presenting a prompt for a public key, and automatically performing a certificate generation and authentication.