Granted Patent B2

US 10,999,324 · App. 15/666,100 · Granted May 4, 2021

Abstract

Claims (58)

1. A computer-implementable method for enforcing a security policy, comprising:

determining when an endpoint device initiates a web transaction with a web server, the endpoint device initiating the web transaction using a web-enabled application;

establishing a side channel to a security service when the endpoint device initiates the web transaction using the web-enabled application, the side channel being established via a direct-connect endpoint system, the direct-connect endpoint system comprising a direct-connect endpoint engine and a driver, the direct-connect endpoint engine comprising a system service module and an endpoint filter engine, the driver comprising an endpoint filter driver, the system service module receiving security policy configuration information from the security service, the endpoint filter engine applying a filter according to the security service, the filter being applied to the web-enabled application via the endpoint filter driver;

performing a categorization and policy enforcement operation via the security service in parallel with initiating the web transaction, the categorization and policy enforcement operation applying a security policy to the web transaction and determining a security policy result regarding the web transaction based upon the security policy;

withholding content resulting from performance of the web transaction until the security policy result is provided by the security service, the content being withheld from a user at the endpoint device;

releasing the content resulting from the web transaction to the web-enabled application of the endpoint device upon receipt of an affirmative policy result from the security service; and

blocking the content from the user when the security policy result is not affirmative.

2. The method of claim 1 , wherein:

the endpoint device accesses a website via a direct connection to a target server, the target server comprising the web server.

3. The method of claim 1 , wherein:

the categorization and policy enforcement operation comprises performing a disposition request, the disposition request submitting Uniform Resource Locator information associated with a target server to the security service.

4. The method of claim 3 , wherein:

the disposition request comprises header information associated with files contained in content provided by the target server.

5. The method of claim 1 , wherein:

the policy result comprises a security policy result from a cloud-based security policy.

6. The method of claim 1 , wherein:

the content resulting from the web transaction is held within a direct-connect endpoint system of the endpoint device.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

determining when an endpoint device initiates a web transaction with a web server, the endpoint device initiating the web transaction using a web-enabled application;

establishing a side channel to a security service when the endpoint device initiates the web transaction using the web-enabled application, the side channel being established via a direct-connect endpoint system, the direct-connect endpoint system comprising a direct-connect endpoint engine and a driver, the direct-connect endpoint engine comprising a system service module and an endpoint filter engine, the driver comprising an endpoint filter driver, the system service module receiving security policy configuration information from the security service, the endpoint filter engine applying a filter according to the security service, the filter being applied to the web-enabled application via the endpoint filter driver;

performing a categorization and policy enforcement operation via the security service in parallel with initiating the web transaction, the categorization and policy enforcement operation applying a security policy to the web transaction and determining a security policy result regarding the web transaction based upon the security policy;

withholding content resulting from performance of the web transaction at the endpoint device until the security policy result is provided by the security service, the content being withheld from a user at the endpoint device;

releasing the content resulting from the web transaction to the web-enabled application of the endpoint device upon receipt of an affirmative policy result from the security service; and

blocking the content from the user when the security policy result is not affirmative.

8. The system of claim 7 , wherein:

the endpoint device accesses a website via a direct connection to a target server, the target server comprising the web server.

9. The system of claim 7 , wherein:

the categorization and policy enforcement operation comprises performing a disposition request, the disposition request submitting Uniform Resource Locator information associated with a target server to the security service.

10. The system of claim 9 , wherein:

the disposition request comprises header information associated with files contained in content provided by the target server.

11. The system of claim 7 , wherein:

the policy result comprises a security policy result from a cloud-based security policy.

12. The system of claim 7 , wherein:

the content resulting from the web transaction is held within a direct-connect endpoint system of the endpoint device.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

determining when an endpoint device initiates a web transaction with a web server, the endpoint device initiating the web transaction using a web-enabled application;

establishing a side channel to a security service when the endpoint device initiates the web transaction using the web-enabled application, the side channel being established via a direct-connect endpoint system, the direct-connect endpoint system comprising a direct-connect endpoint engine and a driver, the direct-connect endpoint engine comprising a system service module and an endpoint filter engine, the driver comprising an endpoint filter driver, the system service module receiving security policy configuration information from the security service, the endpoint filter engine applying a filter according to the security service, the filter being applied to the web-enabled application via the endpoint filter driver;

performing a categorization and policy enforcement operation via the security service in parallel with initiating the web transaction, the categorization and policy enforcement operation applying a security policy to the web transaction and determining a security policy result regarding the web transaction based upon the security policy;

withholding content resulting from performance of the web transaction at the endpoint device until the security policy result is provided by the security service, the content being withheld from a user at the endpoint device;

releasing the content resulting from the web transaction to the web-enabled application of the endpoint device upon receipt of an affirmative policy result from the security service; and

blocking the content from the user when the security policy result is not affirmative.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the endpoint device accesses a website via a direct connection to a target server, the target server comprising the web server.

15. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the categorization and policy enforcement operation comprises performing a disposition request, the disposition request submitting Uniform Resource Locator information associated with a target server to the security service.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein:

the disposition request comprises header information associated with files contained in content provided by the target server.

17. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the policy result comprises a security policy result from a cloud-based security policy.

18. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the content resulting from the web transaction is held within a direct-connect endpoint system of the endpoint device.

19. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignments (8)