Encrypted interstitial techniques for web security

A security server device comprising:

• a memory comprising programmed instructions stored thereon;
• and
• one or more processors coupled to the memory and configured to execute the stored programmed instructions to:
• intercept a request for a webpage from a client device to a server device;
• generate one or more link tags for a corresponding one or more sub-resources included in the webpage;
• serve an interstitial page to the client device, the interstitial page comprising:
• an unencrypted portion comprising the one or more link tags;
• and
• instrumentation code that, when executed at the client device, collects telemetry data;
• receive the telemetry data from the client device;
• perform a threat analysis on the telemetry data collected in association with the request;
• and
• responsive to determining, based on the performed threat analysis, that the request is allowed:
• provide the client device access to the webpage;
• and
• set an interstitial cookie at the client device, wherein the interstitial cookie is configured to allow a subsequent request from the client device to be processed without performing the threat analysis on the subsequent request.

A non-transitory computer readable medium having stored thereon instructions comprising executable code that, when executed by one or more processors, causes the one or more processors to:

• intercept a request for a webpage from a client device to a server device;
• generate one or more link tags for a corresponding one or more sub-resources included in the webpage;
• serve an interstitial page to the client device, the interstitial page comprising:
• an unencrypted portion comprising the one or more link tags;
• and
• instrumentation code that, when executed at the client device, collects telemetry data;
• receive the telemetry data from the client device;
• perform a threat analysis on the telemetry data collected in association with the request;
• and
• responsive to determining, based on the performed threat analysis, that the request is allowed:
• provide the client device access to the webpage;
• and
• set an interstitial cookie at the client device, wherein the interstitial cookie is configured to allow a subsequent request from the client device to be processed without performing the threat analysis on the subsequent request.

A security system comprising one or more security server apparatuses, server devices, or client devices with memory comprising programmed instructions stored thereon and one or more processors coupled to the memory and configured to execute the stored programmed instructions to:

• intercept a request for a webpage from a client device to a server device;
• generate one or more link tags for a corresponding one or more sub-resources included in the webpage;
• serve an interstitial page to the client device, the interstitial page comprising:
• an unencrypted portion comprising the one or more link tags;
• and
• instrumentation code that, when executed at the client device, collects telemetry data;
• receive the telemetry data from the client device;
• perform a threat analysis on the telemetry data collected in association with the request;
• and
• responsive to determining, based on the performed threat analysis, that the request is allowed:
• provide the client device access to the webpage;
• and
• set an interstitial cookie at the client device, wherein the interstitial cookie is configured to allow a subsequent request from the client device to be processed without performing the threat analysis on the subsequent request.