# US 12,003,547 B1 · Protecting web applications from untrusted endpoints using remote browser isolation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,547 B1 - Document ID: US12003547B1 - Status: Granted - Kind: B1 - Application number: 17/894,981 - Filed: 2022-08-24 - Granted: 2024-06-04 - Earliest claimed: 2020-03-21 - Assignees: Menlo Security, Inc. - Applicants: Menlo Security, Inc. - Inventors: Kowsik Guruswamy; Stephen John Stanley Thornhill; Andrew Peter Edward Prince; Joshua Frank Wharton - Web page: https://patentgrep.com/patent/US12003547B1 ## CPC - G06F 16/972: {Access to data in other repository systems, e.g. legacy data or dynamic Web page generation} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 16/116: {Details of conversion of file system types or formats} - G06F 16/9566: {URL specific, e.g. using aliases, detecting broken or misspelled links} - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - H04L 63/0272: {Virtual private networks} - H04L 63/105: {Multiple levels of security} - H04L 67/06: specially adapted for file transfer, e.g. file transfer protocol [FTP] - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed herein are techniques for protecting web applications from untrusted endpoints using remote browser isolation. In an example scenario, a browser isolation system receives a request from a client browser executing on a client device to connect with a remote application accessible via a private network. A surrogate browser is provided to facilitate communications between the client browser and the remote application. A security policy is enforced against the communications. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive at a browser isolation system, a request from a client browser executing on a client device to connect with a remote application; provide, by the browser isolation system, a surrogate browser to facilitate communications between the client browser and the remote application in accordance with enforcement of a security policy, wherein the browser isolation system is configured to facilitate the communications at least in part by one of: (1) receiving a first data transmission from the client device comprising first data and determining whether to prevent transmission of the first data transmission, on behalf of the client device, to the remote application, based at least in part by applying the security policy to an evaluation of the first data, or (2) receiving a second data transmission from the remote application and determining, based on the security policy, to convert at least a portion of the second data transmission prior to transmission, on behalf of the remote application, to the client device, wherein the converting includes unzipping a zipped file; and enforce, by the browser isolation system, the security policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein enforcing the security policy includes preventing the client browser from performing a text-field POST to the remote application. ### Claim 3 (depends on 1) The system of claim 1, wherein enforcing the security policy includes preventing a file upload by the client device to the remote application. ### Claim 4 (depends on 1) The system of claim 1, wherein enforcing the security policy includes preventing a file download by the client device to the remote application. ### Claim 5 (depends on 1) The system of claim 1, wherein the processor is further configured to prompt a user to provide a credential associated with a file the user is attempting to upload. ### Claim 6 (depends on 1) The system of claim 1, wherein the processor is further configured to obfuscate URLs provided to the client browser. ### Claim 7 (depends on 1) The system of claim 1, wherein the browser isolation system is further configured to provide the client device with a thin client that executes in the client browser. ### Claim 8 (depends on 1) The system of claim 1, wherein the remote application comprises an ssh web application. ### Claim 9 (depends on 5) The system of claim 5, wherein the processor is further configured to decrypt the file using the credential. ### Claim 10 A method, comprising: receiving at a browser isolation system, a request from a client browser executing on a client device to connect with a remote application; providing, by the browser isolation system, a surrogate browser to facilitate communications between the client browser and the remote application in accordance with enforcement of a security policy, wherein the browser isolation system is configured to facilitate the communications at least in part by one of: (1) receiving a first data transmission from the client device comprising first data and determining whether to prevent transmission of the first data transmission, on behalf of the client device, to the remote application, based at least in part by applying the security policy to an evaluation of the first data, or (2) receiving a second data transmission from the remote application and determining, based on the security policy, to convert at least a portion of the second data transmission prior to transmission, on behalf of the remote application, to the client device, wherein the converting includes unzipping a zipped file; and enforcing, by the browser isolation system, the security policy. ### Claim 11 (depends on 10) The method of claim 10, wherein enforcing the security policy includes preventing the client browser from performing a text-field POST to the remote application. ### Claim 12 (depends on 10) The method of claim 10, wherein enforcing the security policy includes preventing a file upload by the client device to the remote application. ### Claim 13 (depends on 10) The method of claim 10, wherein enforcing the security policy includes preventing a file download by the client device to the remote application. ### Claim 14 (depends on 10) The method of claim 10, further comprising prompting a user to provide a credential associated with a file the user is attempting to upload. ### Claim 15 (depends on 10) The method of claim 10, further comprising obfuscating URLs provided to the client browser. ### Claim 16 (depends on 10) The method of claim 10, wherein the browser isolation system is further configured to provide the client device with a thin client that executes in the client browser. ### Claim 17 (depends on 10) The method of claim 10, wherein the remote application comprises an ssh web application. ### Claim 18 (depends on 14) The method of claim 14, further comprising decrypting the file using the credential. ### Claim 19 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: receiving at a browser isolation system, a request from a client browser executing on a client device to connect with a remote application; providing, by the browser isolation system, a surrogate browser to facilitate communications between the client browser and the remote application in accordance with enforcement of a security policy, wherein the browser isolation system is configured to facilitate the communications at least in part by one of: (1) receiving a first data transmission from the client device comprising first data and determining whether to prevent transmission of the first data transmission, on behalf of the client device, to the remote application, based at least in part by applying the security policy to an evaluation of the first data, or (2) receiving a second data transmission from the remote application and determining, based on the security policy, to convert at least a portion of the second data transmission prior to transmission, on behalf of the remote application, to the client device, wherein the converting includes unzipping a zipped file; and enforcing, by the browser isolation system, the security policy.