Netskope, Inc.

Arecabay, Inc.

Imperva, Inc.

Lebin Cheng

Krishna Narayanaswamy

Ravi Ithal

Sanjay Beri

Chetan Anand

Abhay Kulkarni

Rajneesh Chopra

Ravindra K Balupari

Kartik Kumar Chatnalli Deshpande Sridhar

Robert R Dykes

Sandeep Yadav

Sekhar Babu Chintaginjala

Ankit Kumar

Robert Dykes

A network security system and method provide dynamic access control for a protected resource using a client-initiated ticket generation scheme. A client application receives, from an access control manager, a limited-use access ticket and may include the limited-use access ticket within application program interface (API) calls to a service application. The service application may forward the limited-use access ticket as a service access ticket to a ticket-based access control layer. A transaction monitor monitors run-time transaction information generated by the API calls to the service application and if the limited-use access ticket is detected in the run-time transaction information, forward the limited-use access ticket to the access control manager to perform validation of the limited-use access ticket. The ticket-based access control layer compares the service access ticket to the validated limited-use access ticket and determine whether to grant the client application access to the protected resource based on the comparison.

Network security dynamic access control and policy enforcement

A dynamic API security policy is enforced at runtime. This can be done without having access to the API specification or code. A flow of execution initiated by the API is tracked at runtime, and a data object used by the API is identified. Specific data labels are assigned to specific fields of the data object used by the API. The specific data labels consistently identify data fields of specific types. The API security policy that is enforced prohibits specific actions concerning data fields of specific types, which are also consistently identified in the security policy. Actions in the tracked flow of execution that violate the API security policy are detected at runtime, and security actions are taken in response. In some implementations, these dynamic API security techniques are supplemented with static API security analysis of an API specification and a set of rules concerning API risk assessment.

Dynamic, runtime application programming interface parameter labeling, flow parameter tracking and security policy enforcement

The technology disclosed relates to a proxy receiving a request to manipulate a data object on an independent object store. The proxy is interposed between a user system from which the request originates and the independent object store. The technology disclosed further relates to the proxy accessing a metadata store that contains object metadata for the data object and retrieving the object metadata. The technology disclosed further relates to the proxy enforcing a policy on the request based on the object metadata. Enforcing the policy further includes enforcing malware detection policies and threat detection policies.

Cloud security based on object metadata

The technology disclosed relates to accessing a hosted service on a client device. In particular, the technology disclosed relates to receiving, on a client device of an entity's user, from a network security system, a forwarding rule for modifying requests for accessing a hosted service, receiving on the client device a request for accessing the hosted service, using the forwarding rule to modify the request for accessing the hosted service and generating a modified request for accessing the hosted service, and receiving on the client device a response from the network security system.

Reverse proxy for cloud security

A multi-API security policy that covers multiple API calls of a transaction is dynamically enforced at runtime, without access to the specification or code of the APIs. Calls made to APIs of the transaction are logged, and the logs are read. Data objects used by the APIs are identified. Specific data labels are assigned to specific fields of the data objects, consistently identifying data fields of specific types. Linkages are identified between specific ones of the multiple APIs, based on the consistent identification of specific types of data fields. An API call graph is constructed, identifying a sequence of API calls made during the transaction. The call graph is used to enforce the security policy, by tracking the flow of execution of the multi-API transaction at runtime, and detecting actions that violate the security policy. Security actions are taken responsive to the detected actions that violate the policy.

Dynamic, runtime application programming interface parameter labeling, flow parameter tracking and security policy enforcement using API call graph

A network security system and method implements dynamic access control for a protected resource using run-time contextual information. In some embodiments, the network security system and method implements a dynamic access ticket scheme for access control where the access ticket is based on run-time application context. In other embodiments, the network security system and method implements policy enforcement actions in response to detected violations using application programming interface (API) to effectively block detected policy violations without negatively impacting the operation of the application or the user of the application. In some embodiments, the network security system uses enterprise social collaboration tools to interact with the end-user or with the system administrator in the event of detected security incidents.

Network security dynamic access control and policy

The technology disclosed relates to non-intrusively enforcing security during federated single sign-on (SSO) authentication without modifying a trust relationship between a service provider (SP) and an identity provider (IDP). In particular, it relates to an assertion proxy receiving a verified assertion from an IDP obtained from an assertion that is generated when a user logs into a service provider (SP) and is verified in dependence upon the IDP's public key. It also relates to evaluating the verified assertion against one or more security policies. It further relates to forwarding the verified assertion evaluated to the SP and causing establishment of a single sign-on (SSO) authenticated session without modifying the assertion.

Single sign-on access to cloud applications

The technology disclosed applies data loss prevention (DLP) to those cloud-applications for which no application-specific parser is available. Known cloud applications can be arranged in categories of services such as 'personal pages and blog,' 'news websites,' &#x201c;cloud-based storage services,&#x201d; and &#x201c;social media services.&#x201d; A category includes a list of uniform resource locators (URLs) of providers of cloud applications that allow users to perform similar activities. The various providers in a category use different syntaxes to implement services in the category. The disclosed category-directed parsers synthesize interaction syntax patterns of a sample of providers in the category. A category-directed parser collects metadata from known cloud applications using multiple category-directed match rules synthesized from syntaxes used by the sample providers in the category. The metadata collected by the category-directed parser enables the DLP processor to focus analysis of the content being conveyed via a corresponding API.

Cloud application-agnostic data loss prevention (DLP)

A computer-implemented method for accessing a hosted service on client devices is described. The client devices include client software that uses a remotely delivered policy to redirect network requests for hosted services to a server to enforce visibility, policy and data security for network delivered services. The method can be used in conjunction with existing VPN and proxy solutions, but provides distinct additional functionality, particularly suited to corporate needs. Policies allow entities to centralize enforcement of service-specific restrictions across networks and communication channels, e.g. only certain users can download client records from a service&#x2014;irrespective of the network used to access the service.

Points of presence (POPs) architecture for cloud security

The technology disclosed includes a system to apply data loss prevention (DLP) to cloud-based services for which no service-specific parser is available. The system determines that a known cloud-based service is being accessed via an application programming interface (API) and no service-specific parser is available for the API being accessed. The system applies a category-directed parser to the API being accessed. The category-directed parser includes multiple category-directed match rules derived from multiple syntaxes used by numerous known providers to implement a category of service. The category-directed parser collects metadata from content being conveyed via the API and assigns the collected metadata to variables. The system invokes a DLP processor and sends the collected metadata to the DLP processor for use in focusing analysis of content being conveyed via the API.

Data loss prevention using category-directed parsers

Universal connectors for cloud data loss prevention (DLP)

The technology disclosed relates to non-intrusively enforcing security during federated single sign-on (SSO) authentication without modifying a trust relationship between a service provider (SP) and an identity provider (IDP). In particular, it relates to configuring the IDP to use a proxy-URL for forwarding an assertion generated when a user logs into the SP, in place of an assertion consumer service (ACS)-URL of the SP. It also relates to configuring an assertion proxy, at the proxy-URL, to use the SP's ACS-URL for forwarding the assertion to the SP. It further relates to inserting the assertion proxy in between the user's client and an ACS of the SP by forwarding the assertion to the SP's ACS-URL to establish a federated SSO authenticated session through the inserted assertion proxy.

Assertion proxy for single sign-on access to cloud applications

The technology disclosed relates to enforcing multi-part policies on data-deficient transactions of independent data stores. In particular, it relates to combining active analysis of access requests for the independent object stores with inspection of objects in the independent object stores, each of the analysis and inspection generating and persisting object metadata in a supplemental data store, actively processing data-deficient transactions that apply to the objects by accessing the supplemental data store to retrieve object metadata not available in transaction streams of the data-deficient transactions, and actively enforcing the multi-part policies using the retrieved object metadata.

Growing community of inventors

Saratoga, CA, United States of America

Lebin Cheng