Microsoft Technology Licensing, LLC

Meir Baruch Blachman

Itamar Azulay

Nitzan Frogel

Guy Lewin

Nir Mardiks Rappaport

Tomer Cherni

Lakshmi Prasad

Eitam Meisel

Yossi Haber

Amir Geri

Sunil Kadam

Daniel Senderovich

Sharon Lifshits

Hassan Almandil

Yibing Chen

Mark-Gil Parayno

Ishay Hilzenrat

Amy Hariharan Dang

Placeholders are inserted and replaced in placeholders in code included in resources. A proxy receives a request for a resource from a client and verifies an authentication credential included therein. The proxy determines a placeholder value indicating the authentication credential is verified and determines the requested resource corresponds to a first modified version of the resource stored in memory accessible to the proxy, the first modified version comprising a code component including a placeholder inserted by the proxy. The proxy replaces the placeholder with a first placeholder value to generate a second modified version of the resource and transmits the second modified version of the resource to a client. In another aspect, a client-side proxy service detects events in a modified version of a web page, inserts a placeholder in code of the web page, replaces the placeholder with a placeholder value, and evaluates the modified code.

Inserting and replacing placeholders in resource code

Systems and methods are described for converting a resource from a first format that is normally rendered by a web browser using a file viewer that prevents monitoring user actions with respect to the resource on behalf of a proxy server into a second format that enables such monitoring. The proxy server injects code into a web page requested by the web browser to cause the web browser to mark a uniform resource locator (URL) of an element that is created by the web page. Upon detecting a request containing the marked URL, the proxy server examines the response corresponding to the request to determine if the response includes a resource in the first format. If the response includes a resource in the first format, the proxy server converts the resource into the second format and transmits the resource to the web browser in the second format.

System and method for monitoring user actions with respect to a resource presented by a web browser

Automated and semi-automated document redaction technology is disclosed herein. In certain example embodiments, 'context-aware' redaction is provided. Automated techniques are used to identify a set of potentially sensitive item(s) within a document. The potentially sensitive item(s) are filtered based on contextual information, such an entity identifier (e.g. person identifier, person group identifier identifying a group of multiple people, organization identifier etc.), resulting in a filtered set of redaction candidate(s). The filtered redaction candidate(s) may, for example, be redacted from the document automatically, or outputted as suggestions in an assisted redaction tool, e.g. via a document redaction graphical user interface. Other example embodiments consider selective redaction when uploading and/or downloading documents via a proxy server, to prevent intended or unintended release of potentially sensitive information, e.g. in a web browsing context.

Detection and removal of predefined sensitive information types from electronic documents

Systems and methods are described for client-side rewriting of web page code. A proxy computing device receives a web page from a server computing device and analyzes the web page to identify a code component. The proxy computing device generates a modified version of the web page by replacing the identified code component with a wrapped code component and including a code rewriting and evaluation function in the web page. The wrapped code component includes a call to the code rewriting and evaluation function that includes the identified code component as an argument thereof. The code rewriting and evaluation function is configured to generate a rewritten code component by rewriting the identified code component and to evaluate the rewritten code component. The proxy computing device sends the modified version of the web page to a client computing device that is configured to load the modified version of the web page.

System and method for client-side rewriting of code included in a web page

Systems and methods are described for authenticating a client device through remote browser isolation (RBI). An RBI service determines that a remote browser thereof is configured to issue an authentication request to an identity provider to access a resource of a resource provider and, in response, transmits a command to an RBI frontend of a client browser executing on a client computing device. The RBI frontend receives the command and, in response, generates a browsing context that issues a client-side authentication request to the identity provider that includes information accessible to the client computing device. Responsive to issuing the client-side authentication request, the browsing context receives an authentication artifact from an access service and transmits the authentication artifact to the RBI service. The RBI service receives the authentication artifact, generates a response to the authentication request that includes the authentication artifact, and transmits the response to the resource provider.

System and method for client device authentication through remote browser isolation

A tenant network of a cloud services platform performs the rewriting of code included in a web page. For example, a proxy service communicatively coupled to a plurality of browser applications belonging to the same tenant network and a server receives a request, from a first browser, for a web page hosted by the server. The web page is returned to the proxy service, and the proxy service identifies code component(s) thereof for rewriting. The proxy service provides the identified code component(s) to a second browser included in the same tenant network as the first browser that is configured to rewrite the code component(s). After rewriting the code component, the second browser provides the rewritten code component(s) to the proxy service, which forwards the web page, along with the rewritten code component(s), to the first browser for execution and rendering.

Tenant network for rewriting of code included in a web page

The disclosure is directed towards controlling the persistency of information provided to a service worker. A method includes receiving a response that includes response data. The response is received at a security service and was transmitted by a second computing device in response to receiving an information request from a first computing device. The first computing device implements a service worker. Sensitive data included in the response data is identified. The response includes caching instructions that instruct the service worker to cache the sensitive data at the first computing device. In response to identifying the sensitive data, the caching instructions are updated such that any portion of the response data that the updated caching instructions instruct the service worker to cache at the first computing device excludes the sensitive data. The updated response is transmitted to the first computing device and includes the response data and the updated caching instructions.

Proxy services for controlling the persistency, utilization, and dissemination of information provided to a service worker

Methods and systems are provided for a browser in a client device that receives a user interface script-code snippet from a web page. A chain logic engine determines whether an in-memory map indicates an output value of prior execution of the UI script-code snippet. If the in-memory map does indicate the output value, it is returned from the in-memory map to generate the user interface. If not, the engine determines whether an in-local storage map indicates the prior executed snippet output. If the in-local storage map indicates the prior executed snippet output, it is returned from the in-local storage map to generate the user interface, and it is stored in the in-memory map. If not, the UI script-code snippet is executed to generate the output value, which is used to generate the user interface, and is stored in the in-memory map and in the in-local storage map.

Client side browser-based caching for monitored resources

An example inline frame monitor is disclosed. The inline frame monitor injects monitoring logic into a document object model to monitor an activity within a dynamically loaded inline frame of a web page. Data regarding the activity within the dynamically loaded inline frame is received. A policy is applied to validate or invalidate the activity within the dynamically loaded inline frame.

Inline frame monitoring

Generally discussed herein are devices, systems, and methods for secure cloud application provisioning. A method can include, while providing access to the cloud application, receiving data indicating a first universal resource locator (URL) entered in a search bar of a web browser associated with the cloud application has changed to a second URL, determining whether the second URL has a valid certificate, and in response to determining the second URL is associated with the cloud application and a valid certificate for the second URL exists, providing resources for the second URL and the valid certificate to the web browser or in response to determining the second URL is not associated with the application, re-directing the web browser away from the proxy server.

Growing community of inventors

Ramat Gan, Israel

Meir Baruch Blachman