Policy-based secure communication session using direct link and digitally segregated secure tunnels
A policy-based security system for establishing a secure session from client devices to a web server includes a policy component with policies, a client device with a local application to select a cloud service, and a mid-link server. A set of policies is determined based on parameters and a tag of a shared content between the client device and the web server for the cloud service. The set of policies selectively direct traffic to the mid-link server based on the tag, and the set of policies specify a direct link between the client device and the web server if the client device satisfies security standards or a secure tunnel between the client device and the mid-link server for the secure session based on the client device does not satisfy the security standards. The secure session establishes the secure session for the cloud service and for providing the shared content.
1. A policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server, the policy-based security system comprising:
a policy component comprising a plurality of policies, wherein:
the plurality of policies is based on a set of parameters, and
the plurality of policies specifies configuration settings of a plurality of secure tunnels and a plurality of session protocols,
a client device with a local application configured to execute on the client device, the local application is further configured to select a cloud service from a plurality of cloud services for shared content,
a data classifier identifies a tag associated with the shared content, wherein the shared content is to be provided between a client device and the web server,
a mid-link server, coupled to the plurality of specified secure tunnels, the mid-link server comprising:
a policy enforcer configured to determine a set of policies from the plurality of policies for the client device based on the set of parameters and the identified tag, wherein the set of determined policies selectively direct traffic to the mid-link server based on the identified tag of the shared content, and wherein (a) if the client device satisfies security standards the set of determined policies specify a direct link between the client device and the web server and (b) if the client device does not satisfy the security standards, the set of determined policies specify to establish a secure session of a secure tunnel from the plurality of specified secure tunnels between the client device and the mid-link server; and
a router configured to establish via an encryption link a secure session of the client device with the web server for providing the shared content using:
a session protocol from the set of session protocols based on the direct link; or
a tunnel protocol based on the secure tunnel.
2. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein the secure tunnel from the plurality of secure tunnels and the session protocol from the plurality of session protocols to establish the secure session between the client device and the web server in accordance with the set of policies is based on a remote instance and/or an application for access to the cloud service.
3. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein the secure session between the client device and the web server is established based on the parameters of the set of policies meeting a predetermined threshold value.
4. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein the set of parameters include at least one of a user connection, a user application, a user location, a type of source, a source location, a destination, a destination location, a destination connection, a destination application, an application type, a type of shared content, confidentiality of the shared content, network data traffic, metadata, user role, user team, user and entity behavior analytics (UEBA) information, and/or user residency.
5. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein the tag is metadata associated with a type of the shared content, and the shared content is classified based on the metadata.
6. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein the set of policies are determined by an administrator of an enterprise associated with the client device based on a user group, the enterprise, or a user role, and the policy enforcer is further configured to determine the set of policies based on device profiling of the client device.
7. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein the set of policies are modified when the secure tunnel is used for connection instead of the direct link using Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS) protocols.
8. The policy-based security system for establishing a direct link or a secure tunnel from client devices to remote instances on a web server as recited in claim 1 , wherein an administrator of an enterprise associated with the client device receives and analyzes:
log reports of the secure session of the client device with the web server, and
alerts of non-connected client devices,
wherein:
the log reports include client reports on a plurality of client devices for compliance with the plurality of policies, and analytics on usage of the plurality of cloud services on the plurality of client devices, and
the set of policies are modified for the secure session based on an update and/or an upgrade of the session protocol or the secure tunnel.
9. A method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems, the method comprising:
identifying a tag associated with a shared content, wherein the shared content is to be provided between a client device and the web server;
provisioning on a mid-link server, coupled to a plurality of secure tunnels, between the client device and the web server, the set of policies;
determining a set of policies for a client device of the plurality of client devices with a policy component having a plurality of policies, wherein:
the set of policies from the plurality of policies are determined based on a set of parameters and the identified tag,
the set of policies specify configuration settings of a plurality of secure tunnels and a plurality of session protocols, and
the set of determined policies selectively direct traffic to the mid-link server based on the identified tag of the shared content, and wherein (a) if the client device satisfies security standards the set of determined policies specify a direct link between the client device and the web server and (b) if the client device does not satisfy the security standards, the set of determined policies specify to establish a secure session of a secure tunnel from the plurality of specified secure tunnels between the client device and the mid-link server;
receiving from a local application running on the client device of the plurality of client devices, selection of a cloud service from a plurality of cloud services for providing the shared content;
provisioning on a mid-link server between the client device and the web server, the set of policies;
determining an encryption link of a plurality of encryption links specified for the set of policies and the cloud service, wherein the plurality of encryption links deliver the cloud service to the client device;
selecting a set of session protocols from the plurality of session protocols for establishing a secure session between the client device and the web server in accordance with the set of policies; and
establishing via the encryption link a secure session of the client device with the web server for providing the shared content using:
a session protocol from the set of session protocols based on the selection of the direct link, or
a tunnel protocol based on the selection of the secure tunnel.
10. The method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems as recited in claim 9 , wherein the secure tunnel from the plurality of secure tunnels and the session protocol from the plurality of session protocols to establish the secure session between the client device and the web server in accordance with the set of policies is based on a remote instance and/or an application for access to the cloud service.
11. The method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems as recited in claim 9 , wherein the secure session between the client device and the web server is established based on the parameters of the set of policies meeting a predetermined threshold value.
12. The method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems as recited in claim 9 , wherein the set of parameters include at least one of a user connection, a user application, a user location, a type of source, a source location, a destination, a destination location, a destination connection, a destination application, an application type, a type of shared content, confidentiality of the shared content, network data traffic, metadata, user role, user team, user and entity behavior analytics (UEBA) information, and/or user residency.
13. The method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems as recited in claim 9 , wherein shared content between the client device and the web server is labeled with tags, the tags are metadata associated with a type of the shared content, the shared content is classified based on the metadata, and the set of policies are determined based on the tags.
14. The method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems as recited in claim 9 , wherein the set of policies are determined by an administrator of an enterprise associated with the client device based on a user group, the enterprise, or a user role.
15. The method for establishing policy-based security for a secure session between a plurality of client devices and a web server in cloud-based multi-tenant systems as recited in claim 9 , further comprising a policy enforcer configured to determine the set of policies based on device profiling of the client device.
16. A policy-controlled communication system including client devices establishing a secure session with remote instances on a web server using an encryption protocol, the policy-controlled communication system comprising a plurality of servers, collectively having code for:
identifying a tag associated with a shared content, wherein the shared content is to be provided between a client device and the web server;
provisioning on a mid-link server, coupled to a plurality of secure tunnels, between the client device and the web server, the set of policies;
determining a set of policies for a client device of a plurality of client devices with a policy component having a plurality of policies, wherein:
the set of policies from the plurality of policies are determined based on a set of parameters and the identified tag,
the set of policies specify configuration settings of a plurality of secure tunnels and a plurality of session protocols, and
the set of determined policies selectively direct traffic to the mid-link server based on the identified tag of the shared content, and wherein (a) if the client device satisfies security standards the set of determined policies specify a direct link between the client device and the web server and (b) if the client device does not satisfy the security standards, the set of determined policies specify to establish a secure session of a secure tunnel from the plurality of specified secure tunnels between the client device and the mid-link server;
receiving from a local application running on the client device of the plurality of client devices, selection of a cloud service from a plurality of cloud services for providing the shared content;
determining an encryption link of a plurality of encryption links specified for the set of policies and the cloud service, wherein the plurality of encryption links deliver the cloud service to the client device;
selecting a set of session protocols from the plurality of session protocols for establishing the secure session between the client device and the web server in accordance with the set of policies; and
establishing via the encryption link a secure session of the client device with the web server for providing the shared content using:
a session protocol from the set of session protocols based on the direct link, or
a tunnel protocol based on the secure tunnel.
17. The policy-controlled communication system with the client devices establishing the secure session with the remote instances on the web server using the encryption protocol as recited in claim 16 , wherein the secure tunnel from the plurality of secure tunnels and the session protocol from the plurality of session protocols to establish the secure session between the client device and the web server in accordance with the set of policies is based on a remote instance and/or an application for access to the cloud service.
18. The policy-controlled communication system with the client devices establishing the secure session with the remote instances on the web server using the encryption protocol as recited in claim 16 , wherein the secure session between the client device and the web server is established based on the parameters of the set of policies meeting a predetermined threshold value.
19. The policy-controlled communication system with the client devices establishing the secure session with the remote instances on the web server using the encryption protocol as recited in claim 16 , wherein the set of parameters include at least one of a user connection, a user application, a user location, a type of source, a source location, a destination, a destination location, a destination connection, a destination application, an application type, a type of shared content, confidentiality of the shared content, network data traffic, metadata, user role, user team, user and entity behavior analytics (UEBA) information, and/or user residency.
20. The policy-controlled communication system with the client devices establishing the secure session with the remote instances on the web server using the encryption protocol as recited in claim 16 , wherein shared content between the client device and the web server is labeled with tags, the tags are metadata associated with a type of the shared content, the shared content is classified based on the metadata, and the set of policies are determined based on the tags.