Distributed split browser content inspection and analysis

Patent metadata

Field	Value
Publication number	US-9635041-B1
Application number	US-201414306141-A
Country	US
Kind code	B1
Filing date	Jun 16, 2014
Priority date	Jun 16, 2014
Publication date	Apr 25, 2017
Grant date	Apr 25, 2017

Abstract

Distributed split browser content inspection and analysis are described. A server, comprising a browser engine, stores a definition of sets of browser policies. A definition of one or more sets of users is stored. The server stores an association with a respective set of browser policies for the one or more sets of users. A request is received from a client browser associated with a user, wherein the client browser is configured to communicate with the server browser engine. The server determines which set of users the user is associated with. The server identifies a first set of browser policies that is associated with the determined set of users and applies the identified first set of browser policies to the request. A determination is made, for one or more browser processes, which browser processes are to be executed by the server browser engine and which browser processes are to be executed by the client browser.

First claim

What is claimed is:

1. A computer-implemented method of enabling the management of browsers, the method comprising:
receiving and storing at a server system comprising one or more computing devices a definition of one or more sets of browser policies, wherein the server system comprises a browser engine hosted on the server system, the server browser engine including a rendering engine;
receiving and storing at the server system a definition of one or more sets of users;
for the one or more sets of users, receiving at the server system an association with a respective set of browser policies;
receiving at the server system a first request from a first client browser associated with a first user, wherein the first client browser is hosted on a device remote from the server system and is configured to communicate with the server system browser engine;
determining by the server system which set of users the first user is associated with;
based at least in part on the determination as to which set of users the first user is associated with, identifying by the server system a first set of browser policies that is associated with the determined set of users;
applying by the server system the identified first set of browser policies, that is associated with the determined set of users, to the first request from the first client browser;
determining, for one or more browser processes, including at least one pre-rendering process that pre-renders at least a portion of a network resource corresponding to the first request:
which browser processes are to be executed by the server system browser engine, and executing such browser processes by the server system browser engine, and
which browser processes are to be executed by the first client browser and causing such browser processes to be executed by the first client browser; and
transmitting to the first client browser the pre-rendered portion of the network resource corresponding to the first request or corresponding graphics painting commands.

2. The method of claim 1 , wherein the server system comprises a data store configured to store historical data related to requests from a plurality of client browsers being managed by the server system, wherein the server system is configured to utilize such historical data to identify patterns or threats, or both patterns and threats.

3. The method of claim 1 , wherein the server system comprises a data store configured to store historical data related to interactions of a plurality of client browsers with items of content, wherein the server system is configured to detect if an interaction of given client browser with a given item of content indicates that the given item of content comprises malware, and at least partly in response, prevent one or more other client browsers from accessing the given of item content indicated to be malware.

4. The method of claim 1 , wherein the server system comprises a detonation chamber configured to isolate potential malware for examination.

5. The method of claim 1 , wherein the first request from the first client browser comprises a request for a first network resource the method further comprising:
requesting the first network resource;
determining if the first network resource comprises embedded resources;
if the first network resource comprises embedded resources, requesting at least a portion of the embedded resources;
wherein applying the identified first set of browser policies to the first request from the first client browser comprises determining whether one or more of the embedded resources are to be provided to the first client browser.

6. The method of claim 1 , wherein the first request from the first client browser comprises a request to change a first client browser setting pertaining to browser security, wherein applying the identified first set of browser policies to the first request from the first client browser comprises determining whether the change to the first client browser setting in permitted by the first set of browser policies.

7. The method of claim 1 , wherein the first set of browser policies indicates which browser functions are to be disabled.

8. The method of claim 1 , wherein applying the identified first set of browser policies to the first request from the first client browser further comprising determining if the first request is to be complied with, and at least partly in response to determining that the first request is not to be complied with, causing a corresponding notification to be displayed via the first client browser.

9. The method of claim 1 , wherein the first set of browser policies indicates that pattern matching is to be utilized to determine whether dynamic content is to be provided to the first client browser in response to the first request.

10. The method of claim 1 , wherein the first set of browser policies indicates that requests for a network resource that has been in existence less than a threshold period of time are to be denied.

11. The method of claim 1 , wherein at least a portion of the sets of users are identified based at least in part on metadata associated with respective users, wherein the metadata data comprises one or more of: user title, employee type classification, job function descriptor, department name, or length of employment.

12. The method of claim 1 , wherein at least a portion of the sets of users are identified based at least in part on metadata associated with respective users, wherein the metadata data indicates what type of data the respective user has access to.

13. A system, comprising:
a computer data repository that stores sets of browser policies and definitions of sets of users, said computer data repository comprising a non-transitory storage device; and
a computing system comprising one or more computing devices, said computing system programmed to implement:
a server configured to receive requests from browsers hosted on remote computing devices and to perform one or more browser functions on behalf of the browsers hosted on remote computing devices using a server browser engine comprising a rendering engine;
a browser administration system that is configured to:
access the sets of browser policies and the definitions of user sets;
for a first request from a first client browser associated with a first user received by the server, determine which set of users the first user is associated with;
based at least in part on the determination as to which set of users the first user is associated with, identify a first set of browser policies that is associated with the determined set of users;
apply the identified first set of browser policies to the first request from the first client browser to control at least in part processing by the server related to the first request;
determine, for one or more browser processes, including at least one pre-rendering process that pre-renders at least a portion of a network resource corresponding to the first request:
which browser processes are to be executed by the server browser engine, and execute such browser processes by the server system browser engine, and
which browser processes are to be executed by the first client browser, and cause such browser processes to be executed by the first client browser; and

transmit to the first client browser the pre-rendered portion of the network resource corresponding to the first request or corresponding graphics painting command.

14. The system of claim 13 , wherein the computing system comprises a data store configured to store historical data related to requests from a plurality of browsers being managed by th

Assignees

• Amazon Tech Inc

Inventors

• Warman Leon Robert
• Kufeld Kurt
• Vosshall Peter Sven
• Johansson Jesper Mikael
• Peterson Kyle Bradley
• Hill Peter Frank

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L41/50

  Network service management, e.g. ensuring proper service fulfilment according to agreements · CPC title

• H04L63/168

  above the transport layer · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title