Microsoft Technology Licensing, LLC

Nir Mardiks Rappaport

Vikas Malik

Vitaly Khait

Meir Baruch Blachman

Idan Gadot

Itamar Azulay

Guy Lewin

Nitzan Frogel

Vinay Kumar Shiva

In one or more examples, a network proxy agent runs inside an isolated (e.g. sandboxed or virtualized) execution environment and a non-isolated application (e.g., web browser) instance runs outside of the isolated execution environment. The network proxy agent acts as a proxy in the sense that network traffic to and from the application instance is routed through the network proxy agent, and thus via the isolated execution environment. A content access policy is supplied to the content access policy agent, and the content access policy agent enforces the content access policy inside the isolated execution environment in relation to the network traffic. For example, content from a certain resource may be restricted according to the content access policy, in which case content requested from that resource is contained within the isolated environment, and replacement content is served to the non-isolated application instance instead.

Computer device and method for selective content isolation

Systems and methods are described for converting a resource from a first format that is normally rendered by a web browser using a file viewer that prevents monitoring user actions with respect to the resource on behalf of a proxy server into a second format that enables such monitoring. The proxy server injects code into a web page requested by the web browser to cause the web browser to mark a uniform resource locator (URL) of an element that is created by the web page. Upon detecting a request containing the marked URL, the proxy server examines the response corresponding to the request to determine if the response includes a resource in the first format. If the response includes a resource in the first format, the proxy server converts the resource into the second format and transmits the resource to the web browser in the second format.

System and method for monitoring user actions with respect to a resource presented by a web browser

Systems and methods are described for authenticating a client device through remote browser isolation (RBI). An RBI service determines that a remote browser thereof is configured to issue an authentication request to an identity provider to access a resource of a resource provider and, in response, transmits a command to an RBI frontend of a client browser executing on a client computing device. The RBI frontend receives the command and, in response, generates a browsing context that issues a client-side authentication request to the identity provider that includes information accessible to the client computing device. Responsive to issuing the client-side authentication request, the browsing context receives an authentication artifact from an access service and transmits the authentication artifact to the RBI service. The RBI service receives the authentication artifact, generates a response to the authentication request that includes the authentication artifact, and transmits the response to the resource provider.

System and method for client device authentication through remote browser isolation

The disclosure is generally directed towards a client device agent (e.g., a network agent) learning that a service domain is authenticated via a corresponding suffix proxy domain. The network agent may then direct a service domain request to the suffix proxy domain. The learning process generally involves evaluating headers in URL redirection communications between the client device and an authentication service, such as an identity provider (IDP). Based on a session control policy, the IDP may 'bounce' the user to a proxy service (e.g., a suffix proxy). Accordingly, the IDP may include a “bouncer”. The network agent generally learns from the headers that a request to a service domain gets redirected (e.g., bounced) to a suffix proxy domain. The agent intercepts subsequent requests to the service domain, updates the request URL, and sends the updated request to the suffix proxy domain.

Persistency of resource requests and responses in proxied communications

Embodiments described herein leverage web cookies to carry messages across cloud application communications, wherein the messages are between entities that are not part of the cloud application itself. For example, in embodiments, a proxy server is interconnected between a client computer that is executing a front-end component of an application and an application server that is executing a back-end component of the application. The proxy server intercepts a request from the front-end component that is intended for the back-end component and generates a response thereto that includes a command to create a web cookie at the client computer, wherein the web cookie includes data to be utilized by a custom code component of the client computer. The proxy server may further cause the custom code component to be injected into the application front-end component for execution by the client computer.

Leveraging web cookies for carrying messages across cloud application communications

According to examples, an apparatus may include a processor that may identify a navigation event responsive to a URL being entered into an address bar of a web browser, the URL having a domain and a URL component, and may determine whether the web browser received an instruction to navigate to a return URL, in which the return URL includes a suffix domain for a proxy and does not include the URL component. The processor may also, based on a determination that the web browser received the instruction to navigate to the return URL, generate a modified URL by appending the suffix domain to the URL to restore context of the URL for the proxy and navigate the web browser to the modified URL.

Restore URL context for proxies

Embodiments described herein leverage web cookies to carry messages across cloud application communications, wherein the messages are between entities that are not part of the cloud application itself. For example, in embodiments, a proxy server is interconnected between a client computer that is executing a front-end component of an application and an application server that is executing a back-end component of the application. The proxy server intercepts a request from the front-end component that is intended for the back-end component and generates a response thereto that includes a command to create a web cookie at the client computer, wherein the web cookie includes data to be utilized by a custom code component of the client computer. The proxy server may further cause the custom code component to be injected into the front-end component of the application for execution by the client computer.

Securing inter-frame communication within a web page. First, receipt of a request from a client for accessing a web page document is detected. The request includes a URL that identifies the web page document. The web page document has a tree structure that includes a top parent object and multiple child objects. The multiple child objects include at least a first child object associated with a first domain and a second child object associated with a second domain. The web page document is retrieved from a location corresponding to the URL. The code of the retrieved web page document is then modified to enable secure communication between modified code of the first child object and modified code of the second object. Finally, the modified web page document is sent to the client.

Secure inter-frame communication

Methods, systems, and media are shown for providing a reverse proxy system with SSO capability involving receiving an authentication response message from a client that includes an authentication token and a unique session identifier and determining whether the identifier is stored on the proxy service. If the session identifier is stored on the proxy service, sending the authentication response message to a service provider to which the authentication response message is directed. If the session identifier in the authentication response message is not stored on the proxy service: sending a login request message to the service provider to which the authentication response message is directed, receiving an authentication request message from the service provider that includes an other unique session identifier and redirects the authentication request message to an identity provider, storing the other session identifier, and sending the authentication request message with the other identifier to the client.

Nonce handler for single sign on authentication in reverse proxy solutions

A proxy server to retrieve a web address received from a client to a webserver is disclosed. The proxy server can include a reverse proxy server. The web address is converted into proxy address at the proxy server. The proxy address is wrapped into a wrapper domain with a wrapping frame.

Growing community of inventors

Bellevue, WA, United States of America

Nir Mardiks Rappaport