Client application based access control in cloud security systems for mobile devices

Patent metadata

Field	Value
Publication number	US-10044719-B2
Application number	US-201615009966-A
Country	US
Kind code	B2
Filing date	Jan 29, 2016
Priority date	Jan 29, 2016
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

Systems and methods, implemented by one or more nodes in a cloud-based security system, for enforcing application-based control of network resources include receiving a request from a user device for the network resources; evaluating the request through the cloud-based security system and determining an application on the user device performing the request; and performing one of (1) denying the request if the application is unauthorized to access the network resources, (2) redirecting the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and (3) allowing the request if the application is authorized to access the network resources.

First claim

What is claimed is:

1. A method, implemented by one or more nodes in a cloud-based security system, for enforcing application-based control of network resources, the method comprising:
receiving a request from a user device for the network resources, wherein the user device is connected to the cloud-based system through a tunnel such that all network traffic is forward thereto, prior to the network resources for inline monitoring;
evaluating the request through the cloud-based security system based on a tunnel protocol of the tunnel and determining an application on the user device performing the request; and
performing, at the one or more nodes in the cloud-based security system external and independent from the user device, one of
denying the request if the application is unauthorized to access the network resources,
redirecting the request to an authorized application on the user device via the tunnel protocol if the application is legitimate but unauthorized to access the network resources, wherein the redirecting has the cloud-based security system utilizes a Uniform Resource Locator (URL) command of REDIRECT to cause the user device to switch the request from the application to the authorized application, and
allowing the request if the application is authorized to access the network resources.

2. The method of claim 1 , wherein the network resources are in an enterprise network, the user device is a mobile device, the mobile device is configured to communicate with the enterprise network through the cloud-based security system,
wherein the enterprise network and the mobile device are both located external to the cloud-based security system, and the enterprise network and the mobile device are both located external to one another.

3. The method of claim 1 , wherein the network resources are connected to the cloud-based security system through a tunnel, and wherein the evaluating is based on a tunnel protocol used.

4. The method of claim 1 , wherein the redirecting comprises
causing the authorized application to intercept a redirect request,
causing a tunnel between the user device and a network associated with the network resources, and
enabling exchange of the network resources to the authorized application via the tunnel.

5. The method of claim 1 , further comprising:
receiving a list of whitelist and blacklist applications for determining the application, wherein the list is associated with the network resources.

6. The method of claim 1 , further comprising:
responsive to the denying, providing a notification to the end user through a mobile Operating System notification cloud.

7. The method of claim 1 , wherein the application comprises an email client and the network resources comprise email on a corporate network.

8. The method of claim 1 , wherein the application comprises a Web browser and the network resources comprise data files or content on a corporate network.

9. A node in a cloud-based security system configured to enforce application-based control of network resources, the node comprising:
a network interface, a data store, and a processor communicatively coupled to one another; and
memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to
receive a request from a user device for the network resources, wherein the user device is connected to the cloud-based system through a tunnel such that all network traffic is forward thereto, prior to the network resources for inline monitoring,
evaluate the request through the cloud-based security system based on a tunnel protocol of the tunnel and determine an application on the user device performing the request, and
perform, in the node in the cloud-based security system external and independent from the user device, one of
deny the request if the application is unauthorized to access the network resources,
redirect the request to an authorized application on the user device via the tunnel protocol if the application is legitimate but unauthorized to access the network resources, wherein, for the redirect, the node in the cloud-based security system utilizes a Uniform Resource Locator (URL) command of REDIRECT to cause the user device to switch the request from the application to the authorized application, and
allow the request if the application is authorized to access the network resources.

10. The node of claim 9 , wherein the network resources are in an enterprise network, the user device is a mobile device, the mobile device is configured to communicate with the enterprise network through the cloud-based security system,
wherein the enterprise network and the mobile device are both located external to the cloud-based security system, and the enterprise network and the mobile device are both located external to one another.

11. The node of claim 9 , wherein the network resources are connected to the cloud-based security system through a tunnel, and wherein the evaluating is based on a tunnel protocol used.

12. The node of claim 9 , wherein, to redirect, the computer-executable instructions cause the processor to
cause the authorized application to intercept a redirect request,
cause a tunnel between the user device and a network associated with the network resources, and
enable exchange of the network resources to the authorized application via the tunnel.

13. The node of claim 9 , wherein the computer-executable instructions further cause the processor to
receive a list of whitelist and blacklist applications for determining the application, wherein the list is associated with the network resources.

14. The node of claim 9 , wherein the computer-executable instructions further cause the processor to
responsive to the denying, provide a notification to the end user through a mobile Operating System notification cloud.

15. The node of claim 9 , wherein the application comprises an email client and the network resources comprise email on a corporate network.

16. The node of claim 9 , wherein the application comprises a Web browser and the network resources comprise data files or content on a corporate network.

17. A user device configured to access a cloud-based security system which performs application-based control of network resources, the node comprising:
a network interface, a data store, and a processor communicatively coupled to one another; and
memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to
provide a request the network resources through an application, wherein the user device is connected to the cloud-based system through a tunnel such that all network traffic is forward thereto, for inline monitoring,
responsive to evaluation of the request through the cloud-based security system based on a tunnel protocol of the tunnel, perform one of
receive a denial of the request if the application is unauthorized to access the network resources, wherein the request is denied and blocked in the cloud-based security system external and independent from the user device,
cause redirection of the request to an authorized application by the cloud-based security system via the tunnel protocol if the application is legitimate but unauthorized to access the network resources, wherein the request redirected in the cloud-based security system external and independent from the user device such that the cloud-based security system utilizes a Uniform Resource Locator (URL) command

Assignees

• Desai Purvi
• Bansal Abhinav
• Zscaler Inc

Inventors

• Desai Purvi
• Bansal Abhinav

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title