Back to results
US 12,657,059 B1Granted
Siloed browser isolation with multiple affinity
AssigneeMenlo Security, Inc.
InventorsChristopher J. C. Ford, Lionel Litty
Life of this patent
Estimating the term…
Abstract
Siloed browser isolation with multiple affinity is disclosed. A request from a client browser executing on a client device to connect with a first resource is received. The browser isolation system provides a first surrogate browser to facilitate communications between the client browser and a remote application. The browser isolation system receives a request from the client browser executing on the client device to connect with a second resource. A determination is made that access to the second resource should not be provided by the first surrogate browser. In response, a second surrogate browser is caused to be provided to the client browser.
Claims16
A system, comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium storing instructions that cause the processor to:
- receive, at a browser isolation system, a request from a client browser executing on a client device to connect with a first resource during a client browsing session;
- determine, by the browser isolation system based at least in part on a policy applicable to the first resource, that a first type of surrogate browser providing a first set of functionality is applicable under the policy to facilitate access to the first resource;
- pair, by the browser isolation system, the client browser with a first surrogate browser of the first type to facilitate communications between the client browser and the first resource;
- receive, at the browser isolation system during the client browsing session, a request from the client browser executing on the client device to connect with a second resource during the client browsing session;
- responsive to receiving the request to connect with the second resource, determine, by the browser isolation system based at least in part on a policy applicable to the second resource, that the first type of surrogate browser is not applicable under the policy to facilitate access to the second resource,
- instruct, by the first surrogate browser, the client device to send a siloed navigation request to navigate to the second resource;
- and
- responsive to the browser isolation system receiving the siloed navigation request, obtain the policy applicable to the second resource and determine that a second type of surrogate browser providing a second set of functionality is applicable to facilitate access to the second resource, wherein the second set of functionality is different from the first set of functionality;
- and
- pair, by the browser isolation system, the client browser with a second surrogate browser of the second type to facilitate communication between the client browser and the second resource.
10 more elements
A method, comprising:
- receiving, at a browser isolation system, a request from a client browser executing on a client device to connect with a first resource during a client browsing session;
- determining, by the browser isolation system based at least in part on a policy applicable to the first resource, that a first type of surrogate browser providing a first set of functionality is applicable under the policy to facilitate access to the first resource;
- pairing, by the browser isolation system, the client browser with a first surrogate browser of the first type to facilitate communications between the client browser and the first resource;
- receiving, at the browser isolation system during the client browsing session, a request from the client browser executing on the client device to connect with a second resource during the client browsing session;
- responsive to receiving the request to connect with the second resource, determining, by the browser isolation system based at least in part on a policy applicable to the second resource, that the first type of surrogate browser is not applicable under the policy to facilitate access to the second resource,
- instructing, by the first surrogate browser, the client device to send a siloed navigation request to navigate to the second resource;
- and
- responsive to the browser isolation system receiving the siloed navigation request, obtaining the policy applicable to the second resource and determining that a second type of surrogate browser providing a second set of functionality is applicable to facilitate access to the second resource, wherein the second set of functionality is different from the first set of functionality;
- and
- pairing, by the browser isolation system, the client browser with a second surrogate browser of the second type to facilitate communication between the client browser and the second resource.
7 more elements
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving, at a browser isolation system, a request from a client browser executing on a client device to connect with a first resource during a client browsing session;
- determining, by the browser isolation system based at least in part on a policy applicable to the first resource, that a first type of surrogate browser providing a first set of functionality is applicable under the policy to facilitate access to the first resource;
- pairing, by the browser isolation system, the client browser with a first surrogate browser of the first type to facilitate communications between the client browser and the first resource;
- receiving, at the browser isolation system during the client browsing session, a request from the client browser executing on the client device to connect with a second resource during the client browsing session;
- responsive to receiving the request to connect with the second resource, determining, by the browser isolation system based at least in part on a policy applicable to the second resource, that the first type of surrogate browser is not applicable under the policy to facilitate access to the second resource,
- instructing, by the first surrogate browser, the client device to send a siloed navigation request to navigate to the second resource;
- and
- responsive to the browser isolation system receiving the siloed navigation request, obtaining the policy applicable to the second resource and determining that a second type of surrogate browser providing a second set of functionality is applicable to facilitate access to the second resource, wherein the second set of functionality is different from the first set of functionality;
- and
- pairing, by the browser isolation system, the client browser with a second surrogate browser of the second type to facilitate communication between the client browser and the second resource.
7 more elements
Dependencies are inferred from the claim text.