Systems and methods for continuous fingerprinting to detect session hijacking inside zero trust private networks
AssigneeZscaler, Inc.
InventorsNikhil Bhatia, Sandip Davara, Pankaj Kumar, Vivek Ashwin Raman, Abhinav Bansal
Life of this patent
Estimating the term…
Abstract
Systems and methods include responsive to a user initiating a session with a resource, determining a master fingerprint of a device associated with the user; collecting, at predefined time intervals, one or more additional fingerprints during the session; comparing the one or more additional fingerprints with the master fingerprint; and performing one or more actions based on the comparing.
Claims20
A method implemented by a cloud-based system, the method comprising steps of:
- responsive to a user initiating a session with a resource, collecting a master fingerprint of a device associated with the user, wherein the collecting is performed by the cloud-based system located between the device and the resource;
- collecting, at predefined time intervals, one or more additional fingerprints during the session, wherein the master fingerprint and one or more additional fingerprints include any of a location of the device, a browser used to access the resource, and an Operating System (OS) of the device;
- comparing the one or more additional fingerprints with the master fingerprint;
- dynamically adjusting, based upon the comparing indicating contextual changes exceeding a predetermined threshold, a security policy associated with the session, wherein the security policy is continuously adapted during the session based on a zero trust architecture that re-evaluates user privileges according to changes in one or more contextual attributes including user role, resource sensitivity, or device risk posture;
- and
- enforcing the dynamically adjusted security policy by selectively allowing, limiting, or denying user access to the resource based on the continuously reassessed contextual attributes.
A non-transitory computer-readable storage medium having computer readable code stored thereon for programming at least one processor of a cloud-based system to perform steps of:
- responsive to a user initiating a session with a resource, collecting a master fingerprint of a device associated with the user, wherein the collecting is performed by the cloud-based system located between the device and the resource;
- collecting, at predefined time intervals, one or more additional fingerprints during the session, wherein the master fingerprint and one or more additional fingerprints include any of a location of the device, a browser used to access the resource, and an Operating System (OS) of the device;
- comparing the one or more additional fingerprints with the master fingerprint;
- and
- dynamically adjusting, based upon the comparing indicating contextual changes exceeding a predetermined threshold, a security policy associated with the session, wherein the security policy is continuously adapted during the session based on a zero trust architecture that re-evaluates user privileges according to changes in one or more contextual attributes including user role, resource sensitivity, or device risk posture;
- and
- enforcing the dynamically adjusted security policy by selectively allowing, limiting, or denying user access to the resource based on the continuously reassessed contextual attributes.
Dependencies are inferred from the claim text.