Granted Patent B2

US 12,445,451 · App. 17/696,785 · Granted Oct 14, 2025

Inventors: David Tze-Si Wu (Fremont, CA); Prasenna Ravi (Thanjavur, IN)

Assignee: Netskope, Inc.

H04L63/105H04L63/08

Abstract

Claims (45)

1. A system, comprising:

an inline proxy interposed between a client device and a cloud application, the inline proxy configured to;

intercept one or more incoming requests during an application session between the client device and the cloud application,

generate, during the application session, one or more synthetic requests associated with each of the one or more incoming requests, wherein the one or more synthetic requests are separate from the one or more incoming requests,

inject the one or more synthetic requests into the application session,

receive synthetic responses to each of the one or more synthetic requests, and

enforce a security policy on the one or more incoming requests based at least in part on the synthetic responses associated with the respective incoming request.

2. The system of claim 1 , wherein the synthetic requests are constructed using at least one parameter of the incoming requests.

3. The system of claim 2 , wherein the synthetic requests do not transmit the incoming requests.

4. The system of claim 1 , wherein the incoming requests are targeted at cloud applications.

5. The system of claim 4 , wherein the synthetic requests are transmitted to the cloud applications.

6. The system of claim 5 , wherein one or more of the synthetic responses to the one or more synthetic requests retrieve information from the cloud applications.

7. The system of claim 6 , wherein the inline proxy is further configured to:

identify an application-specific parser for each incoming request;

identify a template using the identified application specific-parser; and

generate the one or more synthetic requests using the identified template.

8. A computer-implemented method, including:

intercepting, by an inline proxy interposed between a client device and a cloud application, one or more incoming requests during an application session between the client device and the cloud application;

generating, during the application session, one or more synthetic requests associated with each of the one or more incoming requests, wherein the one or more synthetic requests are separate from the one or more incoming requests;

injecting the one or more synthetic requests into the application session;

receiving synthetic responses to each of the one or more synthetic requests; and

enforcing a security policy on the one or more incoming requests based at least in part on the synthetic responses associated with the respective incoming request.

9. The computer-implemented method of claim 8 , wherein the synthetic requests are constructed using at least one parameter of the incoming requests.

10. The computer-implemented method of claim 9 , wherein the synthetic requests do not transmit the incoming requests.

11. The computer-implemented method of claim 8 , wherein the incoming requests are targeted at cloud applications.

12. The computer-implemented method of claim 11 , wherein the synthetic requests are transmitted to the cloud applications.

13. The computer-implemented method of claim 12 , wherein one or more of the synthetic responses to the one or more synthetic requests retrieve information from the cloud applications.

14. The computer-implemented method of claim 13 , wherein the generating the one or more synthetic requests comprises:

identifying an application-specific parser for each incoming request;

identifying a template using the identified application-specific parser; and

generating the one or more synthetic requests using the identified template.

15. A non-transitory computer readable storage medium impressed with computer program instructions, the instructions, when executed on a processor, implement a method comprising:

intercepting one or more incoming requests during an application session between a client device and a cloud application;

generating, during the application session, one or more synthetic requests associated with each of the one or more incoming requests, wherein the one or more synthetic requests are separate from the one or more incoming requests;

injecting the one or more synthetic requests into the application session;

receiving synthetic responses to each of the one or more synthetic requests; and

enforcing a security policy on the one or more incoming requests based at least in part on the synthetic responses associated with the respective incoming request.

16. The non-transitory computer readable storage medium of claim 15 , wherein the synthetic requests are constructed using at least one parameter of the incoming requests, and wherein the synthetic requests do not transmit the incoming requests.

17. The non-transitory computer readable storage medium of claim 15 , wherein the incoming requests are targeted at cloud applications.

18. The non-transitory computer readable storage medium of claim 17 , wherein the synthetic requests are transmitted to the cloud applications.

19. The non-transitory computer readable storage medium of claim 18 , wherein one or more of the synthetic responses to the one or more synthetic requests retrieve information from the cloud applications.

20. The non-transitory computer readable storage medium of claim 19 , wherein the generating the one or more synthetic requests comprises:

identifying an application-specific parser for each incoming request;

identifying a template using the identified application-specific parser; and

generating the one or more synthetic requests using the identified template.

Assignments (1)

Continuity (2)

References Cited (351)