Granted Patent B1

US 12,284,224 · App. 18/740,667 · Granted Apr 22, 2025

Inventors: Carlos Ulderico Cirello Filho (South San Francisco, CA); Philip D. Hassey (Rye, CO); Kevin David Jamieson (North Vancouver, CA); Justin Allan McCarthy (Redwood City, CA); Amol Kabe (Palo Alto, CA); Karim Fanous (Seattle, WA)

Assignee: strongDM, Inc.

H04L63/20G06F9/45558H04L63/1425G06F2009/45587G06F2009/45595

Abstract

Claims (129)

1. A method for managing interactions with an application in a computing environment using one or more processors that are configured to execute instructions, wherein the execution of the instructions enables performance of actions, comprising:

determining a plurality of interactions with the application that are enforced by one or more native security policies;

generating a virtual policy interface to collect information associated with a plurality of other interactions with the application that are unassociated with the one or more native security policies; and

employing a virtual policy engine to perform further actions, including:

determining one or more activities based on the collected information associated with the plurality of other interactions, wherein a user identity is associated with the one or more activities;

determining one or more virtual security policies associated with the plurality of other interactions based on the one or more activities and the user identity; and

validating one or more of the plurality of other interactions based on the one or more virtual security policies, wherein the one or more validated other interactions are employed to execute one or more operations in the application, and wherein one or more other operations associated with one or more invalidated other interactions are disabled.

2. The method of claim 1 , further comprises:

monitoring network traffic associated with the application;

determining an application protocol based on the network traffic and the application;

determining the collected information based on one or more portions of the network traffic and the application protocol; and

providing the collected information to the virtual security layer.

3. The method of claim 1 , further comprises:

evaluating one or more submissions from the application that are provided to a local interface of the virtual policy interface, wherein the one or more submissions are associated with the application and the plurality of other interactions;

determining the collected information based on one or more submissions; and

providing the collected information to the virtual policy interface.

4. The method of claim 1 , further comprises:

tracking telemetry associated with the plurality of interactions, including one or more of a keystroke, a gaze location, or a pointing device location;

determining one or more of a window, a user-interface control, or a data submission based on the telemetry; and

determining the collected information based on one or more of the window, the user-interface control, or the submitted data.

5. The method of claim 1 , further comprises:

determining one or more of a window, a window class, an intra-application message, or an executed system call based on one or more of a window manager or operating system that is hosting the application; and

determining the collected information based on one or more of the window, the window class, the intra-application message, or the executed system call.

6. The method of claim 1 , further comprising:

modifying the one or more virtual security policies at an infrastructure security computer that is separate from a computer that is hosting the application; and

communicating the modified virtual security policies to the computer to update the virtual policy interface.

7. The method of claim 1 , further comprising:

modifying the one or more virtual security policies at a computer that is hosting the application; and

updating the virtual policy interface based on the one or more modified virtual security policies.

8. The method of claim 1 , further comprising:

employing one or more updates to the one or more virtual security policies to revalidate the one or more of the plurality of other interactions.

9. A network computer for managing interactions with an application, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that are configured to cause actions, including:

determining a plurality of interactions with the application that are enforced by one or more native security policies;

generating a virtual policy interface to collect information associated with a plurality of other interactions with the application that are unassociated with the one or more native security policies; and

employing a virtual policy engine to perform further actions, including:

determining one or more activities based on the collected information associated with the plurality of other interactions, wherein a user identity is associated with the one or more activities;

determining one or more virtual security policies associated with the plurality of other interactions based on the one or more activities and the user identity; and

validating one or more of the plurality of other interactions based on the one or more virtual security policies, wherein the one or more validated other interactions are employed to execute one or more operations in the application, and wherein one or more other operations associated with one or more invalidated other interactions are disabled.

10. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

monitoring network traffic associated with the application;

determining an application protocol based on the network traffic and the application;

determining the collected information based on one or more portions of the network traffic and the application protocol; and

providing the collected information to the virtual policy interface.

11. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

evaluating one or more submissions from the application that are provided to a local interface of the virtual policy interface, wherein the one or more submissions are associated with the application and the plurality of other interactions;

determining the collected information based on one or more submissions; and

providing the collected information to the virtual policy interface.

12. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

tracking telemetry associated with the plurality of interactions, including one or more of a keystroke, a gaze location, or a pointing device location;

determining one or more of a window, a user-interface control, or a data submission based on the telemetry; and

determining the collected information based on one or more of the window, the user-interface control, or the submitted data.

13. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

determining one or more of a window, a window class, an intra-application message, or an executed system call based on one or more of a window manager or operating system that is hosting the application; and

determining the collected information based on one or more of the window, the window class, the intra-application message, or the executed system call.

14. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

modifying the one or more virtual security policies at an infrastructure security computer that is separate from a computer that is hosting the application; and

communicating the modified virtual security policies to the computer to update the virtual policy interface.

15. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

modifying the one or more virtual security policies at a computer that is hosting the application; and

updating the virtual policy interface based on the one or more modified virtual security policies.

16. The network computer of claim 9 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

employing one or more updates to the one or more virtual security policies to revalidate the one or more of the plurality of other interactions.

17. A processor readable non-transitory storage media that includes instructions configured for managing interactions with an application in a computing environment, wherein execution of the instructions by one or more processors on one or more network computers performs actions, comprising:

determining a plurality of interactions with the application that are enforced by one or more native security policies;

generating a virtual policy interface to collect information associated with a plurality of other interactions with the application that are unassociated with the one or more native security policies; and

employing a virtual policy engine to perform further actions, including:

determining one or more activities based on the collected information associated with the plurality of other interactions, wherein a user identity is associated with the one or more activities;

determining one or more virtual security policies associated with the plurality of other interactions based on the one or more activities and the user identity; and

validating one or more of the plurality of other interactions based on the one or more virtual security policies, wherein the one or more validated other interactions are employed to execute one or more operations in the application, and wherein one or more other operations associated with one or more invalidated other interactions are disabled.

18. The media of claim 17 , further comprises:

monitoring network traffic associated with the application;

determining an application protocol based on the network traffic and the application;

determining the collected information based on one or more portions of the network traffic and the application protocol; and

providing the collected information to the virtual policy interface.

19. The media of claim 17 , further comprises:

evaluating one or more submissions from the application that are provided to a local interface of the virtual policy interface, wherein the one or more submissions are associated with the application and the plurality of other interactions;

determining the collected information based on one or more submissions; and

providing the collected information to the virtual policy interface.

20. The media of claim 17 , further comprises:

tracking telemetry associated with the plurality of interactions, including one or more of a keystroke, a gaze location, or a pointing device location;

determining one or more of a window, a user-interface control, or a data submission based on the telemetry; and

determining the collected information based on one or more of the window, the user-interface control, or the submitted data.

21. The media of claim 17 , further comprises:

determining one or more of a window, a window class, an intra-application message, or an executed system call based on one or more of a window manager or operating system that is hosting the application; and

determining the collected information based on one or more of the window, the window class, the intra-application message, or the executed system call.

22. The media of claim 17 , further comprising:

modifying the one or more virtual security policies at an infrastructure security computer that is separate from a computer that is hosting the application; and

communicating the modified virtual security policies to the computer to update the virtual policy interface.

23. The media of claim 17 , further comprising:

modifying the one or more virtual security policies at a computer that is hosting the application; and

updating the virtual policy interface based on the one or more modified virtual security policies.

24. A system for method for managing interactions with an application, comprising:

a network computer, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that are configured to cause actions, including:

determining a plurality of interactions with the application that are enforced by one or more native security policies;

generating a virtual policy interface to collect information associated with a plurality of other interactions with the application that are unassociated with the one or more native security policies; and

employing a virtual policy engine to perform further actions, including:

determining one or more activities based on the collected information associated with the plurality of other interactions, wherein a user identity is associated with the one or more activities;

determining one or more virtual security policies associated with the plurality of other interactions based on the one or more activities and the user identity; and

validating one or more of the plurality of other interactions based on the one or more virtual security policies, wherein the one or more validated other interactions are employed to execute one or more operations in the application, and wherein one or more other operations associated with one or more invalidated other interactions are disabled; and

a client computer, comprising:

another memory that stores at least instructions; and

one or more other processors that execute other instructions that are configured to cause actions, including:

generating one or more of plurality of interactions.

25. The system of claim 24 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

monitoring network traffic associated with the application;

determining an application protocol based on the network traffic and the application;

determining the collected information based on one or more portions of the network traffic and the application protocol; and

providing the collected information to the virtual policy interface.

26. The system of claim 24 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

evaluating one or more submissions from the application that are provided to a local interface of the virtual policy interface, wherein the one or more submissions are associated with the application and the plurality of other interactions;

determining the collected information based on one or more submissions; and

providing the collected information to the virtual policy interface.

27. The system of claim 24 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

tracking telemetry associated with the plurality of interactions, including one or more of a keystroke, a gaze location, or a pointing device location;

determining one or more of a window, a user-interface control, or a data submission based on the telemetry; and

determining the collected information based on one or more of the window, the user-interface control, or the submitted data.

28. The system of claim 24 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

determining one or more of a window, a window class, an intra-application message, or an executed system call based on one or more of a window manager or operating system that is hosting the application; and

determining the collected information based on one or more of the window, the window class, the intra-application message, or the executed system call.

29. The system of claim 24 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

modifying the one or more virtual security policies at an infrastructure security computer that is separate from a computer that is hosting the application; and

communicating the modified virtual security policies to the computer to update the virtual policy interface.

30. The system of claim 24 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

modifying the one or more virtual security policies at a computer that is hosting the application; and

updating the virtual policy interface based on the one or more modified virtual security policies.

Assignments (2)

Continuity (1)

References Cited (169)

Cited By (5)

US 12,423,418 US 12,432,242 US 12,603,921 US 12,670,246 US 12,695,793