Presenting determined contextual security information within browser along with web page of cloud and SAAS vendor

Abstract

The browser extension produces a single view that includes content of a web page of a target vendor requested by a customer and corresponding security information of the target vendor maintained for the customer. And determining fingerprints of webpage URLs and webpage elements of the target suppliers respectively corresponding to the resources. When a web browser retrieves a web page and a customer selects a web page element identifying a resource, the browser extension matches a URL and / or HTML / XML syntax pattern of the retrieved web page to the fingerprint to determine security information to be obtained from the back-end storage. The type / granularity of the retrieved information may vary depending on the identified fingerprint match. The browser extension retrieves security information corresponding to a fingerprint for which a match is identified, generates a security summary from the security information, and integrates the security summary into the requested web page to generate a merged multi-angle view.

Description

Background Art

[0001] The present disclosure relates generally to digital data processing (eg, CPC subclass G06F) and information retrieval (eg, CPC subclass G06F 16 / 00).

[0002] A cloud service provider (CSP) is a provider of cloud computing technology that delivers computing resources in the cloud. With cloud computing, applications and other computing resources that are traditionally hosted on-premise are delivered by the CSP over the Internet. Cloud computing services provided by CSPs include Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), which provide cloud-based infrastructure, cloud-based platforms, and cloud-based applications, respectively. With the growing accessibility of cloud computing technology and the increasing popularity of CSPs, more and more suppliers are adopting cloud computing technology to deliver hardware technology and / or software technology in addition to or instead of providing local solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Aspects of the present disclosure may be better understood with reference to the following drawings.

[0004] Figure 1 A conceptual diagram of integrating security information maintained by a security vendor with the web page of a cloud or cloud-based technology provider.

[0005] Figure 2 is a conceptual diagram of an exemplary GUI depiction of a security overview integrated with a target vendor's web page.

[0006] Figure 3 is a flow diagram of example operations for integrating contextual security information with a requested web page of a target provider within a browser.

[0007] Figure 4 is a flow diagram of example operations for generating and displaying a security summary of the content of a requested web page.

[0008] Figure 5 is a flow diagram of example operations for generating and displaying a security summary of a resource based on detecting interactions with web page elements.

[0009] Figure 6 is a flow diagram of example operations for onboarding a vendor to support in-browser integration of web content-based security profiles.

[0010] Figure 7 An exemplary GUI depiction is depicted that includes information about a selected resource in an instance integrated within a browser where a target vendor natively supports contextual security information.

[0011] Figure 8 An example computer system having a contextual security information integrator is depicted. DETAILED DESCRIPTION

[0012] The following description includes example systems, methods, techniques, and program flows that embody aspects of the present disclosure. However, it should be understood that the present disclosure can be practiced without these specific details. For example, the present disclosure relates to generating a security overview for services provided by a CSP in an illustrative example. Aspects of the present disclosure may also be applied to services, features, and / or other functionality provided by a SaaS application vendor / provider. In other examples, well-known instruction instances, protocols, structures, and techniques are not shown in detail in order not to obscure the description.

[0013] the term For efficiency and ease of explanation, this description uses shorthand terms related to cloud technology. When referring to "cloud" or "cloud environment", this description refers to the resources of the CSP, also known as cloud resources. For example, the cloud can cover the CSP's servers, virtual machines, storage devices, and other cloud resources. More generally, cloud resources are resources owned / managed by a CSP entity that are accessible via a network connection. Typically, this access is based on an application programming interface (API) or software development kit provided by the CSP.

[0014] This description uses the phrase "browser extension" to refer to software used to add customized functionality to a web browser. Browser extensions can extend the functionality of a web browser through various APIs supported by the web browser. Different web browsers may use various terms to refer to software that has these capabilities, such as "add-ons." As used herein, "browser extension" refers to software used by any web browser to support web browser customization.

[0015] Unless expressly stated otherwise, the use of the phrase "at least one of" before a list with the conjunction "and" should not be considered an exclusive list, nor should it be interpreted as a category list with one item from each category. A clause reciting "at least one of A, B, and C" can only be violated by one of the listed items, multiple items in the listed items, and one or more items in the list and another item not listed.

[0016] Overview Security vendors are increasingly adapting to the shift to cloud computing by offering cloud or SaaS security solutions to customers. Since the infrastructure underlying these cloud-based protection targets (i.e., SaaS applications or cloud environments) is hosted and owned offline by CSPs rather than hosted locally by customers, these security solutions utilize APIs provided by the vendors of these cloud-based protection targets (hereinafter referred to as "target vendors") to obtain information about resources and applications that are protected because they are provided by third parties. Security information obtained by the security vendor and consumed by the customer is stored in the security vendor's repositories and systems rather than with that of the target vendor. Therefore, the customer has separate accounts and corresponding separate displays for both the target vendor (e.g., CSP) and the security vendor. It can be cumbersome to navigate between these displays and through workflows to consume information about the protected cloud environment or SaaS application and its associated security details.

[0017] As used herein, browser extensions merge the display presented by a web browser by integrating the relevant information retrieved from a security supplier with the web page of the target supplier loaded by the web browser. The result is a single view of the corresponding security information of the target supplier's web page that a client can request and the services and / or resources of the target supplier maintained by the security supplier for the client, thereby allowing the workflow to be merged into a single display, rather than across multiple displays and browser sessions. In order to make the target supplier log in to be compatible with the browser extension, multiple fingerprints of the target supplier's web page URL and web page elements are determined. The fingerprint can be a URL pattern or a syntactic pattern of a web page (e.g., in a hypertext markup language (HTML) document or an extensible markup language (XML) document) that the URL of the web page requested by the client can match, and these patterns correspond to selectable and / or visible web page elements that the client can interact with. Each target supplier logs in once, so the URL of the target supplier's web page and the fingerprint of the element can be programmed into the browser extension to identify the services, resources or other offerings of the target supplier used by the client at runtime, which have any updates to the offerings of the target supplier, which are represented in the update to the browser extension.

[0018] During a login session of the browser extension, the browser extension matches the URL and / or HTML / XML syntax pattern in the web page retrieved by the browser to the fingerprint to determine the associated security information to be retrieved from the backend storage system(s) of the security provider. The type and level of information detail retrieved by the browser extension may vary depending on the fingerprint matched to the URL or HTML / XML syntax pattern; thus, the security information retrieved and presented is determined based on the context of the web page content determined from the fingerprint identification. For example, when the browser extension identifies a fingerprint match for the home page or summary view of the customer's account under the target provider, the browser extension may retrieve general high-level security information maintained for the account and generate a security overview of the customer's account presented with the main page / home page. Such information may include the total number of security issues identified by the security provider for the customer's account under the target provider, data / metadata about the last scan or security analysis performed for the customer's account under the target provider, and the like. A more detailed overview may be generated when the customer selects a web page element corresponding to an individual resource provided to the customer (e.g., by hovering a cursor). The browser extension detects these selection events, matches the selected element to a resource based on the corresponding syntactic pattern fingerprint, and retrieves the data / metadata of the resource to generate a security overview of that specific resource. The security overview generated for the client at any level of detail is presented together with the requested web page to produce a combined multi-angle view.

[0019] Example Figure 1 1 is a conceptual diagram of integrating security information maintained by a security provider with a web page of a cloud or cloud-based technology provider. A contextual security information integrator (hereinafter referred to as "integrator") 103 is provided by a security provider 105 and is implemented as a browser extension of a web browser 101 installed on a client device 131. The integrator 103 can communicate with the backend components of the security provider 105 through an API 145 exposed by the security provider 105. The web browser 101 can be any web browser that supports browser extensions. The security provider 105 can be a cloud platform or can be hosted locally.

[0020] The integrator 103 determines and retrieves security information (i.e., security data and / or metadata) based on contextual information identified from the content of a web page of a cloud or cloud-based technology provider that is a protection target (hereinafter referred to as a "target provider") retrieved by the web browser 101, and merges the retrieved security information into a security overview presented with the web page for viewing in a single display with the web page content. The security information determined by the integrator 103 is said to be based on contextual information identified from the web page content because the integrator 103 performs "fingerprinting" of web page URLs and / or syntax patterns to quickly determine the security perspective associated with the web page, rather than fully parsing and scanning the web page URLs and / or syntax. The target provider can be a CSP or a SaaS application provider; in this example, at least the CSP that provides storage services is the target provider 141 of the integrator 103.

[0021] Figure 1 Assume that user 133 is a registered user of target provider 141 and belongs to organization 143 named "ex-app-1", which is a tenant of target provider 141. For example, target provider 141 may have allocated a virtual private cloud (VPC) to organization 143 within a public cloud environment. Figure 1 It is also assumed that organization 143 is a tenant / has an account under security provider 105 and that after installing integrator 103 on a client device having web browser 101 installed, user 133 can access integrator 103 (eg, via login).

[0022] Figure 1 Annotated with a series of letters A to E. These letters represent stages of operation. Although these stages are ordered for this example, these stages illustrate an example to aid understanding of the present disclosure and should not be used to limit the claims. Subject matter falling within the scope of the claims may vary depending on the order of operations and certain operations.

[0023] In phase A, the integrator 103 detects an event that triggers security summary generation. The integrator 103 includes an event listener 129, which may be implemented as a background script that listens for security summary generation triggering events. The triggering event includes retrieving and loading a web page having a URL that matches the first one of a set of URL patterns 139, which are generalized patterns of URLs for web pages of target vendors 141. When the web browser 101 retrieves the web page of the target vendor 141 requested by the user 133 using an associated URL that matches one of the URL patterns 139, the integrator 103 should become active (i.e., the program code of the integrator 103 should be executed). The URL patterns 139 may be defined in a manifest file associated with the integrator 103. The event listener 129 determines whether the URL of the retrieved web page matches the first one of the URL patterns 139 to determine whether security summary generation should be triggered. The triggering of security summary generation by the event listener 129 may be implemented as triggering the execution of one or more content scripts of which the integrator 103 is composed.

[0024] In this example, user 133 requests access to a web page 119 of a target provider 141 maintained by server 117 (e.g., a physical or cloud-based web server) and having URL 137, where web page 119 is a home page for a cloud storage service of target provider 141. Web browser 101 transmits request 135 (e.g., a Hypertext Transfer Protocol (HTTP) GET request) indicating URL 137 to server 117 to retrieve web page 119. When web page 119 is retrieved by web browser 101, event listener 129 identifies a match of URL 137 to a first one of URL patterns 139. To illustrate, Figure 1 Depicting URL 137 as "https: / / cloudvendor.com / storage / home", event listener 129 matches it to the first of URL patterns 139 that include the pattern "https: / / cloudvendor.com / *".

[0025] At stage B, the integrator 103 determines the content to be retrieved for inclusion in the security summary 121 based on the identified match between the URL 137 and the fingerprint 113A defined for the target vendor 141. The integrator 103 has been pre-configured with a plurality of fingerprints 113 of the target vendor 141. The fingerprint 113 includes a predetermined URL pattern and / or syntax pattern of the markup language (e.g., HTML or XML) of the target vendor's 141 web page. The fingerprint of the URL may include a URL pattern whose variable name(s) are in the position of the name(s) of the service, feature, or other indication of the content of the target vendor's 141 web page in the URL. Upon identifying a match between the URL and the URL fingerprint, the integrator 103 may extract (e.g., copy) a substring of the URL corresponding to the position of the variable name in the matching fingerprint to determine the service / group to which the associated web page corresponds. The fingerprint of the syntax pattern in the markup language of the web page may be represented using a query or expression for identifying the element(s) of interest in the markup language of the web page, such as an XML Path Language (XPath) expression and / or a jQuery selector for a web page including HTML / XML. Fingerprinting of the URL and / or syntax pattern of the retrieved web page informs the integrator 103 of the content of the web page retrieved by the web browser 101. Matches with different ones of the fingerprints 113 may trigger execution of different code units (e.g., routines / subroutines) of the integrator 103. As another example, each fingerprint 113 may indicate (e.g., via a pointer) the code unit(s) to be executed upon identification of a match with the fingerprint.

[0026] When web page 119 is retrieved, integrator 103 matches URL 137 of web page 119 with fingerprint 113A, where the variable corresponds to the location of the service name that matches the substring "storage" in the path of URL 137. To illustrate, Figure 1 The fingerprint 113A that matches the URL 137 depicted in FIG. 1 is “https: / / cloudvendor.com / SVC_NAME / *”, and the substring “storage” matches the location specified by the variable “SVC_NAME”. The integrator 103 may be pre-configured with the names of the services of the target provider 141, which may match the variable names in the fingerprint 113, including the substring “storage” indicating the cloud storage service of the target provider 141. Therefore, the integrator 103 determines that the web page 119 corresponding to the URL 137 is associated with the cloud storage service provided by the target provider 141.

[0027] At stage C, the integrator 103 queries one or more repositories of the security provider 105 to retrieve security information maintained for the account associated with the user 133 . Figure 1 The security provider 105 is depicted as maintaining a repository 107 and a repository 109 (collectively, "repositories 107, 109"), although the security provider may maintain any number of repositories, each of which may be implemented as a database, data lake, data warehouse, etc. Repository 107 includes data of cloud resources that the target provider 141 has provided to the organization 143 and that the security provider 105 has documented. Repository 109 includes security reports that the security provider 105 has generated for the organization 143 based on running security analyses. Repositories 107, 109 may include cloud resources and security reports corresponding solely to the organization 143, or may also include cloud resources and security reports for other tenants of the security provider 105, depending on whether the security provider 105 is a cloud-based service and whether it is implemented using single-tenancy or multi-tenancy.

[0028] Each of the repositories 107, 109 can be queried by calling an API 145 published by the security provider 105. The integrator 103 submits at least a first query 123 to the repository 107 and / or the repository 109 by calling at least a first function of the API 145. The integrator 103 provides one or more parameter values ​​corresponding to the query 123 that specifies at least a tenant (i.e., an identifier of an organization) of the security provider 105. For illustration, Figure 1 The integrator 103 is depicted as calling an exemplary function of the API 145 named "get_storage_overview" that accepts a tenant name as a parameter and provides data and / or metadata including an overview of the security of the resources and the use of the cloud storage service for the specified tenant. The integrator 103 can determine the tenant name based on the login session information of the login session initiated by the user 133 to log in to use the browser extension for implementing the integrator 103 or based on one of the fingerprints 113 of the location where the tenant name is located that can be extracted from the HTML / XML of the web page 119.

[0029] In response to calling the API 145 function(s), the integrator 103 receives security information 127 of the security status of the cloud storage service of the target provider 141 for the organization 143. The security information, including security data and / or metadata, retrieved from the security provider 105 may include a count of security issues associated with the cloud storage service (e.g., for resources of the cloud storage service provided to the organization 143) that the security provider 105 has identified for the organization 143, an indication of the most critical security issues, etc. This example depicts the security provider 105 as providing API 145 functions that, if called, return security summary data / metadata to the integrator 103; in other words, the security information 127 includes summary-level or summarized / aggregated security data and / or metadata that is maintained for the use of the storage service by the organization 143. In an implementation, the security provider's API function may return raw (i.e., non-summary) security data / metadata, such that, after receiving a response to the API function call, summarization, aggregation, or other pre-processing of the data / metadata is performed by the integrator 103 to generate a summary thereof.

[0030] At stage D, the integrator 103 generates a security summary 121 for the storage service used by the organization 143 to be presented with the web page 119 content. The integrator 103 includes a content generator 125 that generates content to be presented by the web browser 101. The content generator 125 generates the security summary 121, which includes security information 127 of the storage service. For example, the content generator 125 can generate the security summary 121 by modifying the HTML / XML document of the web page 119 to include the security information 127 in summary form. Generating the security summary 121 can also include aggregating, summarizing, or otherwise pre-processing at least a subset of the security information 127 to be merged into the HTML / XML document. The content generator 125 can modify the web page 119 HTML / XML document via a web page document object model (DOM) so that the security summary 121 content is also presented on a single screen (e.g., in a sidebar / side panel of a GUI) with the content of the web page 119. The modification of web page 119 by content generator 125 produces a security summary enhanced web page (“enhanced web page”) 119 ′ that includes the content of web page 119 and security summary 121 .

[0031] At stage E, web browser 101 presents enhanced web page 119' on the screen of client device 131. As a result of presenting enhanced web page 119', the contents of web page 119 and security overview 121 are both displayed in a single view on the screen of client device 131. Thus, user 133 can view the home page of target provider 141's cloud storage service and the associated overview of the security status of organization 143's service based on the information collected and maintained by security provider 105 without having to navigate between multiple views and browser sessions, which creates a more convenient and intuitive experience for user 133.

[0032] Figure 2 is a conceptual diagram depicting an exemplary GUI of a security overview integrated with a target vendor's web page. Figure 1 , Figure 2 The exemplary GUI of illustrates the integration of security information into the target supplier's web page with additional details. Figure 1 In the example, the integrator 103 generates a security overview for the target provider's service used by the tenant, and integrates the security overview into the homepage of the service. Figure 2 As depicted, integrator 103 can also retrieve and generate security overviews of individual resources of the target provider that have been provided to the tenant for integration into the target provider's web page. This example assumes that user 133 has requested a web page of target provider 141 that includes a list of cloud storage instances provided to organization 143.

[0033] To perform resource-level security profile generation, the integrator 103 is pre-configured with events defined for user interactions with web page elements corresponding to individual resources. A web page element refers to a structural element (or elements) in an HTML / XML document of a web page represented by one or more tags. Thus, events associated with individual resources such as Figure 2 The web page element corresponding to the resource 205 named "storage-instance-C" depicted in FIG. 200 may be represented by a specific structural element (eg, Tags). Thus, events may be defined for structural elements or sequences corresponding to individual resources in HTML / XML documents, wherein one or more of the fingerprints 113 represent (multiple) syntactic patterns corresponding to structural elements by which resources can be identified. Events defined for structural element(s) corresponding to resources may be mouse hover / hover events, click events, or similar events corresponding to selection of web page elements based on cursor 203 positioning. Detection of events defined for structural elements refers to a specified selection event occurring and invoking the integrator 103.

[0034] When the integrator 103 detects such a selection event, it determines the identifier of the selected resource based on the corresponding web page element. The integrator 103 can determine the resource identifier based on the fingerprint of the (multiple) web page elements corresponding to the resource identifier. For example, the fingerprint 113 may include one or more XPath expressions and / or jQuery selectors for evaluating an HTML / XML document of a web page that produces values ​​as a result, which are stored in the HTML / XML nodes corresponding to the individual resources. For illustration, an example of a fingerprint 113A implemented using jQuery for a node of HTML / XML that includes the text "EC2 Instance" and therefore corresponds to this type of cloud resource is "$("#instanceID").text() == "EC2Instance".

[0035] In this example, after resource 205 is selected by a mouse hover, click, etc. of a cursor 203 detected for a corresponding web page element, the integrator 103 evaluates the HTML / XML of the web page corresponding to resource 205. The integrator 103 can evaluate the HTML / XML of the web page based on an XPath expression, a jQuery selector, or other expressions for manipulation of an HTML / XML document triggered by a selection event. The result of the expression based on which the integrator 103 evaluates the HTML / XML document indicates that the resource identifier corresponding to the web page element for which the selection event was detected is "storage-instance-c". The integrator 103 calls one or more functions of the API 145 to query the security data / metadata of the resource 205 maintained by the organization 143, wherein the submitted query(s) includes at least the determined resource identifier. The response(s) to the API call(s) includes the data / metadata maintained by the security provider 105 for the resource 205.

[0036] Upon retrieving the data and / or metadata of the resource 205, the integrator 103 generates a security summary 201 that is presented with the web page. The integrator 103 may generate the security summary 201 by modifying the web page content via DOM manipulation to display a security summary 201 panel (e.g., in a side panel of the GUI) and merge the security data / metadata of the resource 205. The security summary 201 generated by the integrator 103 includes resource metadata 207, an alert summary 209, remediation commands 211, and a policy interface 213. These components of the security summary 201 are included as examples, and in implementations, other and / or different components may be included in the security summary.

[0037] The displayed resource metadata 207 includes metadata of the resource 205 obtained by the integrator 103 from the security vendor 105. In this example, the resource metadata 207 includes an identifier of the resource 205 and an indication of the network exposure of the resource determined by the security vendor 105 (e.g., based on a prior security analysis of the resource 205). The alert summary 209 includes a summary of alerts for security issues, such as vulnerabilities and / or misconfigurations of the resource 205, that have been identified for the resource 205 organized by count and severity level (i.e., critical, medium, and low). The remediation command 211 is a web page element that a user can select (e.g., click) to trigger remediation of the security issues identified for the resource 205 reflected in the alert summary 209. For example, selection of a GUI element corresponding to the remediation command 211 can invoke function(s) of the API 145 that, when invoked for the resource 205, triggers remediation play(s) for the resource 205 to be executed by the security vendor 105. The policy interface 213 includes a text box from which a user can write a new policy for the resource 205, which upon submission is applied to the resource 205. For example, selection of a GUI element corresponding to a submit option of the policy interface 213 may invoke function(s) of the API 145 that transmits the contents of the text box and an indication of the resource 205 to a component of the security provider 105 that manages policy creation and enforcement. As depicted in this example, when a user wants to view security information about a resource 205, the user may remain in the same browser session and view the security information in a single display, rather than switching between displays as in conventional solutions.

[0038] The level of detail included in the security summary generated and presented for a resource may vary by implementation. Figure 2 An example is depicted in which a security overview 201 of a resource 205 includes a high-level overview of details related to the security of the resource 205. For example, when generating the security overview 201 with a high-level overview of security details, the function(s) of the API 145 invoked by the integrator 103 may provide result(s) that include raw data / metadata of the resource 205 and / or summarized, aggregated, or otherwise pre-processed data / metadata of the resource 205. In the former case, the integrator 103 may pre-process the retrieved data / metadata as part of generating the security overview 201. As an example, the security data of the resource 205 corresponding to the alarm summary 209 obtained by the integrator 103 may include an indication of the alarms currently associated with the resource 205, including the alarm severity and the details of the alarms. The integrator 103 may pre-process the alarm data to determine a total count of alarms of each severity level, and create the alarm summary 209 using the total count and severity level instead of the details of each individual alarm. In other examples, the security data for resource 205 obtained in response to invoking the API 145 function(s) may include a summary view of current alarms for the resource, so the integrator 103 can create the alarm summary 209 without additional preprocessing. The more detailed, lower-level security summary generated by the integrator 103 for the resource 205 may include at least a subset of the raw data / metadata retrieved for the resource 205, such as the name or type of alarm represented in the alarm summary 209 in addition to the severity level, rather than just the count. Figure 2 An example GUI of is depicted to aid understanding. Implementations may instead display the raw data / metadata of a resource, or a combination of raw data / metadata and pre-processed data / metadata. Implementations may also retrieve and present different types of data / metadata.

[0039] Figures 3 to 6 is a flow chart of example operations for presenting determined contextual security information within a browser along with web pages of a CSP provider and a SaaS provider. The example operations are described with reference to a contextual security information integrator (hereinafter referred to as the "integrator"), which is implemented as a browser extension or a security provider that provides the integrator, for consistency with the earlier figures. As used in the example operations, "security provider" refers to the entity that provides the integrator for installation, and "target provider" refers to the CSP or provider / supplier of the SaaS application. The names chosen for program code should not be limited by the claims. The structure and organization of the program may vary depending on the platform, programmer / architect preferences, programming language, etc. Additionally, the names of code units (programs, modules, methods, functions, etc.) may vary for the same reasons and may be arbitrary.

[0040] Figure 3 Flowchart of example operations for integrating contextual security information with a requested web page of a target provider within a browser. The security information that is contextual to the requested web page depends on the security provider account associated with the requester and the content of the web page. The example operations assume that the integrator has been pre-configured with multiple fingerprints of the target provider, where the fingerprints can be URL fingerprints and / or HTML / XML syntax pattern fingerprints.

[0041] In block 301, a browser extension login session begins. A login session begins when a user with an account under a security provider providing an integrator logs into the browser extension. The login session information may include a username and password, or may additionally include an account or tenant name (e.g., the name of an organization with which the user is registered).

[0042] In block 303, the integrator begins listening for events corresponding to a match between the URL of the requested web page and a specified URL pattern. When a login session begins, the integrator's background script begins listening for events that trigger the integrator's activities, where the integrator's activities include executing non-background scripts (e.g., content script(s)). The integrator has been pre-configured with one or more patterns of URLs associated with the target vendor (e.g., in a browser extension manifest file) that trigger the integrator's activities when the URL of the web page is matched to the patterns. Thus, the event that triggers the browser extension's activities is the matching of the URL of the retrieved web page to the URL pattern maintained by the integrator.

[0043] In block 305, the integrator matches the URL of the retrieved web page to the URL pattern, which triggers the activity of the browser extension. The integrator identifies the match based on applying the URL pattern(s) to the URL of the web page retrieved by the browser. Matching the URL to the URL pattern triggers the activity of the browser extension (i.e., executing the content script(s)). The identified match may typically be the user's account homepage that is retrieved and displayed to the target provider after a successful login.

[0044] In block 306, the integrator determines an account associated with the login session. Account determination is performed to determine an identifier(s) of an account known to the security provider for which security information should be retrieved (e.g., a tenant name / identifier, an account identifier, etc.). The integrator may determine the account based on account information associated with the maintained login session. Alternatively or additionally, the account information may be located on the retrieved web page. The integrator may determine the account information by evaluating the web page HTML / XML document based on predetermined XPath expression(s), jQuery selector(s), or other expressions that describe the location of the account information in the HTML / XML document of the target provider's web page.

[0045] In an implementation, before proceeding, the integrator may verify that the account under the target provider associated with the user is known to the security provider. If the security provider actively performs security monitoring on the services and resources of the target provider associated with the account, then the account is known to the security provider. For example, the integrator may query the backend storage of the security provider to determine whether the security provider is monitoring the account under the target provider. If the account is not being monitored, the integrator may display a prompt to the user, requesting the user to confirm whether the user wants to log into the account under the security provider for security monitoring. If input indicating consent is received, the integrator triggers a login of the account under the target provider before proceeding to box 307. The login may be triggered by calling (multiple) functions of the security provider's API, which triggers a request for any relevant permissions from the user, thereby initiating a scan of the account resources, etc.

[0046] In block 307, the integrator performs security summary generation when the URL of the requested web page matches the URL pattern that triggers the browser extension and when the login session is active. When these conditions are met, the integrator generates a security summary customized for the web page content based on the detection of the triggering event. The triggering event may include retrieval of a web page by a web browser. The security summary generation triggered by the web page retrieval may be as described in reference to Figure 4 Alternatively or additionally, the triggering event may also include selecting a web page element that triggers the action (e.g., based on user interaction with a GUI element). The generation of the security overview triggered by the web page selection may be as described in reference Figure 5 Implemented as described.

[0047] Figure 4 4 is a flowchart of example operations for generating and displaying a security overview of the content of a requested web page. In box 401, the integrator detects a retrieval of a web page having a first URL by a web browser. The first URL may be the URL of the retrieved web page for which a pattern match is identified in box 305, or may be the URL of a subsequently retrieved web page. The integrator may detect the retrieval of a web page based on receiving a response (e.g., a response to an HTTP GET request) that includes the content of the web page. Alternatively or additionally, the integrator may detect the retrieval of a web page based on detecting that the browser has retrieved a web page HTML / XML document and that the document is accessible for manipulation via the DOM of the web page. The integrator may determine the URL of the retrieved web page by calling a function of an API provided by a web browser or a browser extension platform.

[0048] In block 405, the integrator evaluates the first URL and / or syntax pattern of the web page based on the fingerprint defined for the web page owner (i.e., the target vendor). The integrator maintains one or more fingerprints of the web page HTML / XML syntax pattern and / or URL so that the web page can be fingerprinted to determine the content of the web page. The fingerprint has been pre-determined for the target vendor's web page, as described below with reference to Figure 6 Each fingerprint corresponds to a type of security overview that should be generated. Therefore, fingerprint recognition notifies the integrator of the security information to be retrieved to generate a security overview of the web page. The web page content that can be determined by fingerprint recognition can be a general account overview presented at login, or information about specific services of the target provider (e.g., different services of a CSP).

[0049] Fingerprinting can be implemented in two forms: URL fingerprinting or markup language fingerprinting. A URL fingerprint can include a URL pattern with a variable name (e.g., a service name) that matches a URL substring that indicates the content of a web page. For illustration, refer to Figure 1 , a URL fingerprint for identifying a CSP service corresponding to a web page may be "https: / / cloudvendor.com / SVC_NAME / *", where a substring matching the position of "SVC_NAME" indicates the name of the service corresponding to the web page. The integrator may evaluate the web page URL based on the URL fingerprint(s) by determining whether a match between the URL and the URL fingerprint can be identified. The markup language fingerprint may include XPath expressions, jQuery selectors, and / or other expressions for HTML / XML document manipulation that describe node(s) of a DOM tree or other tree representation (e.g., an HTML DOM tree) created for an HTML / XML document of a web page, whose value(s) indicate the web page content.

[0050] In block 407, the integrator determines whether a fingerprint match can be identified. If the URL of the web page matches the first URL fingerprint and / or evaluation of the HTML / XML of the web page based on (multiple) XPath expressions, (multiple) jQuery selectors, or (multiple) other expressions produces a value (i.e., the node described by the XPath expression, jQuery selector, or other expression exists in the tree representation of the HTML / XML document), then a fingerprint match can be identified. If a fingerprint match cannot be identified, operations continue in block 409. If a fingerprint match can be identified, operations continue in block 411.

[0051] In block 409, the integrator displays a prompt for a next action using the requested web page. The lack of a fingerprint match may indicate that the security provider has not yet monitored the target provider's service corresponding to the account's web page. The integrator may display (e.g., by modifying the web page via the DOM) a prompt requesting input as to whether the user wants to monitor the service corresponding to the web page. Upon receiving input indicating consent, the integrator may transmit a request to the backend security monitoring system(s) to begin a process for monitoring the service (e.g., via calling function(s) of an API of the backend system).

[0052] In block 411, the integrator queries the backend storage of the security vendor for security information corresponding to the fingerprinted element(s). The backend storage may be one or more repositories, databases, data lakes, or other types of data stores that have exposed an API. The query(s) submitted by the integrator to the backend storage may indicate the account information (e.g., tenant name / identifier) ​​determined in block 403 and one or more types of security information (i.e., data and / or metadata) to be retrieved. The type(s) of security information indicated in the query(s) may vary depending on the fingerprints identified for their matches. For example, identifying different fingerprint matches may trigger the invocation of different functions of the API to retrieve the corresponding security information, such as based on fingerprints, each fingerprint corresponding to the code unit(s) to be invoked when the fingerprint match is identified (e.g., routine(s) / subroutine(s)). To illustrate, if the target vendor is a CSP and the fingerprinted element corresponds to a particular service of the CSP, the integrator may query the backend storage for security information maintained for accounts associated with the service via the API function invocation(s). Examples of such security information include a total number of security issues for an account identifier corresponding to a service (e.g., security issues for a resource identifier corresponding to a service) and / or a list of the most critical security issues. As security information is retrieved, the integrator may cache the security information for a configurable number of security overview generation events (e.g., 5 generation events). Caching of security information facilitates quick retrieval of security information corresponding to frequently retrieved web pages, such as those corresponding to services frequently used by the user(s) associated with the account.

[0053] In box 413, the integrator generates a security overview for the content of the web page using the retrieved security information. The integrator generates a GUI depiction of the retrieved security information, which is displayed together with the web page. The integrator can generate the GUI depiction by modifying the web page via the web page DOM. The security information retrieved from the backend storage may already include the overview information and can be directly incorporated into the GUI depiction. As another example, the integrator can pre-process at least a subset of the security information before merging the subset of security information into the GUI depiction. For example, the integrator can aggregate and / or generate a summary of a subset of the security information, and merge the aggregated or summarized security information into the GUI depiction. The integrator modifies the (multiple) documents that make up the web page via the DOM to merge the security information and / or the pre-processed security information. For example, the integrator can add and / or modify HTML / XML and / or cascading style sheet (CSS) documents via the DOM, so that the (multiple) added and / or modified documents will be presented.

[0054] In block 415, the web browser extended by the integrator presents the security summary with the web page. The security summary is integrated into the content presented on the screen of the client device on which the web browser is installed. Therefore, the security summary can be used to view together with the web page content.

[0055] Figure 5 is a flow chart of example operations for generating and displaying a security summary of a resource based on detecting interactions with web page elements. The example operations assume that the web page has been rendered by a web browser, so a user can interact with GUI elements corresponding to elements of the web page.

[0056] In box 501, the integrator detects selection of a resource based on user interaction with an element of a web page corresponding to the resource. The integrator has one or more events (e.g., HTML events, such as mouse hover and / or click events) that are defined for web page elements corresponding to individual resources and are therefore considered selection events for the resource. The web page elements corresponding to the individual resources and having defined events can be (multiple) web page elements that include an HTML / XML attribute with a resource identifier as a value. The integrator detects selection of a resource when the defined event occurs and triggers execution of the program code of the integrator corresponding to the event.

[0057] In box 503, the integrator determines the identifier of the selected resource based on the selected web page element. The integrator fingerprints the HTML / XML document corresponding to the web page to determine the resource identifier based on a syntactic pattern that has been predetermined to correspond to the location of (multiple) resource identifiers in the HTML / XML of the web page. In order to fingerprint the HTML / XML document, the integrator may have an XPath expression and / or jQuery selector defined in association with a resource selection event, wherein the XPath expression or jQuery selector describes / selects a node of the HTML / XML document (e.g., in a tree representation of the document) that includes an attribute value corresponding to the identifier of the selected resource. The integrator determines a node that includes the resource identifier as an attribute value based on an evaluation of the web page element for which the detected event is defined using an XPath expression or jQuery selector. From the determined node that includes the attribute value, the integrator may extract the resource identifier.

[0058] In block 505, the integrator queries the security provider's backend storage for security information maintained for the selected resource. Figure 4 As described in box 411, the backend storage may be one or more repositories, databases, data lakes, or other types of data stores that have exposed an API. The query(s) submitted by the integrator to the backend storage may indicate account information determined for a login session and a resource identifier. The query(s) may also specify one or more types of security information to be retrieved for a resource. For illustration, if the target provider is a CSP and the selected resource is a cloud resource, the integrator may query the backend storage for data and / or metadata maintained for the cloud resource via (multiple) API function calls. Examples of such data and / or metadata include counts of security issues identified for cloud resources (e.g., misconfigurations and / or vulnerabilities of cloud resources) and / or counts of security issues identified for each severity classification of cloud resources. When the security information of a resource is retrieved, the integrator may generate an event cache security information for a configurable number of security overviews. Caching the security information of a resource helps to quickly retrieve security information corresponding to web page elements that frequently interact with the resource, such as those corresponding to resources with high usage and / or public exposure.

[0059] In box 507, the integrator generates a security overview for the resource using the retrieved security information. The integrator generates a GUI depiction of the retrieved security information, which is displayed with the web page. The integrator can generate the GUI depiction by modifying the web page via the web page DOM. The security information retrieved from the backend storage may already include overview-level security information for the resource and can be directly incorporated into the GUI depiction. Alternatively, the integrator can pre-process at least a subset of the security information before merging the subset of security information into the GUI depiction. For example, the integrator can aggregate and / or generate a summary of a subset of security information, and merge the aggregated or summarized subset of security information into the GUI depiction. An example is to determine a count of security issues associated with a resource based on security issue data retrieved from the backend storage. The integrator modifies one or more documents that make up the web page via the DOM to merge the security information of the resource and / or the pre-processed security information. For example, the integrator can add and / or modify HTML / XML and / or CSS documents via the DOM to present (multiple) added and / or modified documents.

[0060] The integrator may include elements other than the security overview in the content to be presented for the selected resource. For example, the integrator may also incorporate (multiple) web page elements that accept input into the content to be presented, the input corresponding to the action to be taken by the security provider for the selected resource. For example, the integrator may incorporate a selectable HTML / XML element (e.g., a button) into the content to be presented, and the user may select the element to trigger the remediation of the security issue identified for the resource. Selecting the element triggers (multiple) function calls of the API of the security provider to start the remediation workflow (e.g., (multiple) scripts) for the resource. Alternatively or additionally, the integrator may incorporate an HTML / XML element in which the policy to be applied to the resource may be entered and submitted (e.g., a text box and a corresponding button for submitting the content of the text box). Submitting the policy via the element triggers (multiple) function calls of the API of the security provider to start the workflow for policy creation and implementation. Therefore, remediation of misconfigured or vulnerable resources and / or creation of policies to be implemented for resources may be initiated within the browser without navigating to different browser sessions and displays.

[0061] In block 509, the web browser presents the security summary of the resource with the web page. The security summary is integrated into the content presented to the screen of the client device on which the web browser is installed. Thus, the security summary is available for viewing with the web page content corresponding to the resource that the user has selected.

[0062] Figure 6 is a flow chart of example operations for enabling vendor login to support in-browser integration of a security profile based on web page content. The example operations are performed once per target vendor to make the target vendor protected by the security vendor compatible with a browser extension that includes an integrator. When the target vendor begins to offer new services and / or new resource types, the example operations may be performed when corresponding updates are generated to the integrator to support the updates published by the target vendor. The security vendor may perform the example operations based on expert knowledge or domain knowledge and as part of developing an integrator.

[0063] In box 601, the security provider begins fingerprinting each web page for which security information needs to be integrated. One or more URLs can be predetermined, which correspond to (multiple) web pages that need to be enhanced with security information. Each web page is retrieved via its URL and can be used for analysis and processing (for example, through developer tools provided by (multiple) web browsers for which browser extensions are provided). Since the specific content of the web page can vary across accounts under the target provider, the web page can be generic or represent the general structure of a web page HTML / XML document. Additionally, although subsequent operations involve a single web page, some web page collections (i.e., two or more web pages) may correspond to the same service or other grouping, such as a collection of web pages for which a single URL fingerprint needs to be determined. In such cases, subsequent operations can be performed on a collection of web pages.

[0064] In block 603, the security provider determines the type(s) of fingerprint(s) to be determined for the web page. Fingerprint(s) of web page elements defined according to a syntactic pattern (e.g., a syntactic pattern of an HTML / XML structural element), a URL, or both may be determined. If at least a first web page element fingerprint should be determined, then operation continues in block 605; if multiple web page element fingerprints need to be determined, subsequent operations are performed for each web page element. If the URL of the web page should be fingerprinted, then operation continues in block 611.

[0065] In block 605, the security provider identifies the location of at least a first element to be fingerprinted in an HTML / XML document of a web page. A tree representation of the HTML / XML document, such as a DOM tree, may first be created based on processing the HTML / XML document. The location of the element is identified based on a corresponding node in the tree representation of the HTML / XML document. Because elements of a web page may depend on an account for which a login session with a target provider has been established, such as elements corresponding to specific resources provided for that account, the location in the tree representation may be generalized as a path of nodes (e.g., a "branch" of the tree) from which nodes corresponding to resources are to be added.

[0066] In block 607, the security provider determines an expression that describes the location of an element in the HTML / XML document. The expression may be an XPath expression, a jQuery selector, or another expression type that may be used to manipulate an HTML / XML document (e.g., expressions / functions provided by an open source library for HTML / XML DOM tree traversal and manipulation). The expression describes at least the first node in the tree representation that corresponds to the web page element. The node described by the expression may be a node that corresponds to an HTML / XML attribute of the web page element that will store a value of interest (e.g., a resource identifier). As an example, the expression may describe a node that includes <button>The name attribute of the element or another visible / selectable element.

[0067] In block 609, the security vendor adds the expression to the program code of the browser extension. The expression is added to the program code, which is executed based on the detection of a triggering event to extract information from the web page content identified based on evaluating the expression against the web page HTML / XML document (e.g., by traversing the HTML / XML DOM tree based on the expression); generally, this triggering event is the retrieval of a web page having a certain URL (i.e., a URL that matches the URL fingerprint), or the interaction with a GUI element corresponding to a web page element.

[0068] In block 611, the security provider determines a generalized pattern for a URL web page, the generalized pattern including at least a first variable name of a URL substring that indicates the content of the web page. The URL pattern generalizes the URL to reflect the content of the web page regardless of the specific account requesting the web page. The pattern may include an asterisk for specific account information and include variable name(s) of the location of the URL substring(s) (e.g., in the URL path), the variable name corresponding to the name of the service or other indication of the content of the web page. As an example, refer to Figure 1 , the URL "https: / / cloudvendor.com / storage / home" can be generalized into the pattern "https: / / cloudvendor.com / SVC_NAME / *" to reflect that the substring matching the variable name "SVC_NAME" indicates the service of the target provider corresponding to the webpage. As another example, the URL "https: / / cloudvendor.com / storage / home?region=us-east" can be generalized into the pattern "https: / / cloudvendor.com / SVC_NAME / *region=REGION" to reflect that the substring matching the variable names "SVC_NAME" and "REGION" respectively indicate the service of the target provider corresponding to the webpage and the region corresponding to the instance of the service.

[0069] Additionally, a rank or priority may be determined for (multiple) URL patterns and variable names to handle situations where a URL matches multiple URL patterns. If there are multiple possible matches for a URL, the rank or priority assigned to the URL pattern may represent the URL pattern to which the integrator is to match the URL at runtime. An example of a rank / priority scheme that may be implemented is one in which URL patterns are assigned to ranked tiers, where one or more URL patterns are assigned to each tier, and the integrator performs URL pattern matching on the URL patterns in each tier in descending order of rank. For this example, the security provider determines the tier to which the URL pattern is assigned.

[0070] In box 613, the security provider adds the URL pattern with the variable name to the browser extension code. The URL pattern is added to a set of URL patterns, and the integrator attempts to match the URL of the retrieved web page to these URL patterns. If a ranking or priority is determined for the URL pattern, an indication of the ranking or priority is also added to the browser extension code. Matching the URL to the first pattern in the pattern further triggers the generation of a security summary of a type corresponding to the matched URL pattern, such as based on the variable name indicating the content of the web page. For example, matching the URL to the first pattern in the pattern that corresponds to a service of the target provider can trigger the generation of a security summary for an account to use the service.

[0071] In block 615, if there are (multiple) additional web pages to be fingerprinted, the operation continues. If there are (multiple) additional web pages, the operation continues in block 601. Otherwise, the operation is complete.

[0072] Figures 1 to 6 The following implementation is concerned, in which contextual security information integration is performed based on a browser extension that implements a contextual security overview integrator (referred to as "integrator 103" above), which determines the content of web pages after retrieving and fingerprinting the web pages. In this case, it is assumed that the target vendor does not provide native support for the integration of contextual security information. Some target vendors may natively support in-browser integration of contextual security information. Due to the native support for in-browser contextual security information integration, the browser extension that implements integrator 103 can "hook into" the target vendor's web page via hooks. In such an implementation, the target vendor web page for which security information is to be integrated includes one or more code hooks, or locations in the program code, provided by the target vendor, at which execution is intercepted by integrator 103 to retrieve security information related to the web page, and any pre-processing is performed before presenting the web page including the retrieved security information and the security overview. Because integrator 103 can execute in the same context of the web page program code, rather than executing as an external entity, integrator 103 can then directly determine the services, resources, or other content of the web page for which corresponding security information should be retrieved. In other words, the information may be determined directly from web page elements accessible to the aggregator 103, rather than indirectly through fingerprinting as described above.

[0073] Figure 7 An exemplary GUI depiction is depicted that includes information about a selected resource in an instance where the target vendor natively supports in-browser integration of contextual security information. Figure 1 And additionally refer to Figure 2 , Figure 7 The GUI shown is an example of a resulting screen after selecting (e.g., clicking) a GUI element corresponding to resource 205. In this example, since the target vendor supports integration of security information retrieved by integrator 103, the security summary generated by integrator 103 can be displayed together with the content of the corresponding web page of the target vendor, rather than as Figure 2 205 are displayed in separate GUI elements as in the example above. For illustration, the detailed view 705 of the resource 205 includes a plurality of tabs 707, between which the user can navigate to view various details about the resource 205. The tabs 707 include a security overview tab 703, in addition to other tabs traditionally supported by the target vendor. Selecting the security overview tab 703 causes the security overview 701 generated by the integrator 103 for the resource 205 to be displayed. As illustrated in the detailed view 705 of the resource 205, if the target vendor natively supports the integration of contextual security information within the browser, the security overview can be incorporated as part of the web page content and presented with it.

[0074] Further, the type and / or granularity of security information retrieved and presented using in-browser security information integration may also be customized by the customer, whether the functionality of the integrator 103 is provided as an external browser extension or is natively supported by the target vendor (e.g., Figure 2 and Figure 7 For example, refer to Figure 7 , a customer who has been provisioned with resource "storage-instance-C" may have configured the integrator 103 to display resource metadata, alert overview, remediation commands, and policy interfaces in the security overview tab 703 corresponding to the selected resource. Other customers may choose to display more or less information about individual resources, and may configure the integrator 103 accordingly.

[0075] The integrator 103 may be further configurable to incorporate different elements and / or types or granularities of security information into the security overview generated and presented for users having different roles assigned by a customer (e.g., by a customer's system administrator). For example, upon initiating a login session, the integrator 103 may determine the role of the user for whom the login session is being maintained (e.g., based on an organizational directory accessible to the integrator 103). The integrator 103 may be configured with additional policies that specify user roles, and for each role, may be configured with one or more types of security information and / or one or more GUI elements that will be incorporated into the security overview presented during the login session. For illustration, refer to Figure 2 , the integrator 103 may be configured with a policy for retrieving and displaying resource metadata 207 for users with any role, and another policy for retrieving and displaying alert summaries 209 for users with more privileged roles. As another example, the integrator 103 may be further configured with a policy that states that remediation commands 211 and policy interface 213 should be incorporated into the security summary for users with the highest level of privileged roles.

[0076] Variants The flowcharts are provided to aid understanding of the illustrations and are not intended to limit the scope of the claims. The flowcharts depict example operations that may vary within the scope of the claims. Additional operations may be performed; fewer operations may be performed; operations may be performed in parallel; and operations may be performed in a different order. It will be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented by program code. The program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable machine or device.

[0077] As will be appreciated, aspects of the present disclosure may be embodied as systems, methods, or program codes / instructions stored in one or more machine-readable media. Thus, aspects may take the form of hardware, software (including firmware, resident software, microcode, etc.), or a combination of software and hardware aspects that may all generally be referred to herein as "circuits," "modules," or "systems." Functionality presented as separate modules / units in the example illustrations may be organized differently depending on at least one of the platform (operating system and / or hardware), application ecosystem, interface, programmer preference, programming language, administrator preference, etc.

[0078] Any combination of one or more (multiple) computer readable media may be utilized. A machine readable medium may be a machine readable signal medium or a machine readable storage medium. A machine readable storage medium may be, for example, but not limited to, a system, device, or apparatus that uses any one or combination of electronic, magnetic, optical, electromagnetic, infrared, or semiconductor technologies to store program code. More specific examples (non-exhaustive list) of machine readable storage media would include the following: a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this article, a machine readable storage medium may be any tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or device. A machine readable storage medium is not a machine readable signal medium.

[0079] A machine-readable signal medium may include a propagated data signal having machine-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including but not limited to electromagnetic, optical, or any suitable combination thereof. A machine-readable signal medium may be any machine-readable medium that is not a machine-readable storage medium and that may convey, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0080] Program code embodied on a machine-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0081] The program code / instructions may also be stored in a machine-readable medium that can direct a machine to operate in a particular manner so that the instructions stored in the machine-readable medium produce an article of manufacture, including instructions for implementing the functions / actions specified in the flowchart and / or one or more block diagram blocks.

[0082] Figure 8 An example computer system with a contextual security information integrator is depicted. The computer system includes a processor 801 (which may include multiple processors, multiple cores, multiple nodes, and / or implement multiple threads, etc.). The computer system includes a memory 807. The memory 807 can be any one or more possible implementations of system memory or the machine-readable media described above. The computer system also includes a bus 803 and a network interface 805. The system also includes a contextual security information integrator 811. The contextual security information integrator 811 can perform in-browser integration of contextual security information related to the content of the retrieved web page. Any of the functions previously described can be implemented partially (or entirely) in hardware and / or on the processor 801. For example, the functions can be implemented using a dedicated integrated circuit, implemented in logic implemented in the processor 801, implemented in a coprocessor on a peripheral device or card, and so on. Further, the implementation can include Figure 8 Fewer or additional components not shown in the figure (e.g., video card, audio card, additional network interface, peripheral devices, etc.). Processor 801 and network interface 805 are coupled to bus 803. Although not shown as coupled to bus 803, memory 807 can be coupled to processor 801.

[0083] Although aspects of the present disclosure are described with reference to various implementations and utilizations, it will be understood that these aspects are illustrative and the scope of the claims is not limited thereto. In general, the techniques described herein for presenting contextual security information determined within a browser through web pages of CSPs and SaaS providers can be implemented using facilities or hardware systems consistent with any hardware system. Many variations, modifications, additions, and improvements are possible.

[0084] Multiple instances may be provided for components, operations, or structures described as single instances herein. Finally, the boundaries between various components, operations, and data stores are arbitrary to some extent, and specific operations are described in the context of specific illustrative configurations. Other allocations of functions are contemplated, and these allocations may be within the scope of the present disclosure. In general, structures and functions presented as independent components in the example configurations may be implemented as combined structures or components. Similarly, structures and functions presented as single components may be implemented as separate components. These and other variations, modifications, additions, and improvements may be within the scope of the present disclosure.< / button>

Claims

1. A method comprising: detecting a request for a first webpage of a provider during a login session of an account under the provider, wherein the first webpage has a first uniform resource locator (URL); evaluating the first URL against a plurality of fingerprints of the provider, identifying a match between the first URL and a first fingerprint of the plurality of fingerprints; determining, based on the first fingerprint matched by the first URL, a first type of security summary to be generated for use of a provider associated with the account; retrieving first security information maintained for the account under a provider corresponding to a security profile of the first type; as well as A security summary of a first type is generated from the first security information. 2 . The method of claim 1 , further comprising presenting a security summary with the first web page.

3. A method according to claim 1 or 2, wherein the multiple fingerprints include multiple URL patterns determined from URLs of a provider, wherein the provider includes a cloud service provider or a software as a service (SaaS) provider, and wherein identifying a match between a first URL and a first fingerprint includes identifying a match between the first URL and a corresponding URL pattern in the multiple URL patterns.

4. The method according to any one of claims 1 to 3, wherein each URL pattern in the plurality of URL patterns comprises a variable name, wherein determining a first type of security summary to be generated comprises determining a substring of a first URL that matches a first variable name of a corresponding URL pattern in the plurality of URL patterns, where the first variable name corresponds to the name of the provider's service, and The first type of security overview includes a security overview of the provider's services.

5. A method according to any one of claims 1 to 4, wherein the first security information includes at least one of security data and security metadata maintained for the account, wherein generating a security overview includes aggregating and aggregating at least one of at least a subset of the first security information, and wherein generating a security overview from the first security information includes generating a security overview from at least one of the aggregated and aggregated subsets of the first security information.

6. The method of any one of claims 1 to 5, wherein generating the security summary comprises modifying a Hypertext Markup Language (HTML) or Extensible Markup Language (XML) document of the first web page through a Document Object Model (DOM) of the HTML or XML document.

7. The method according to any one of claims 1 to 6, further comprising: Based on detecting a selection of an element of the second web page, determining a resource to which the selected element corresponds based on a syntax pattern of an HTML or XML document of the second web page corresponding to the selected element, wherein the syntax pattern includes at least one of a jQuery selector and an XML Path Language (XPath) expression of a node of the HTML or XML document of the second web page, and wherein the node includes an attribute having an indication of the resource as a value; retrieving second security information maintained for the resource; generating a security profile of the resource based on the second security information; as well as A security summary of the resource is presented for display with the second web page.

8. One or more non-transitory computer-readable media having program code stored thereon, the program code comprising instructions for: detecting a first event initiated by a user who has requested a first web page, wherein the first event includes retrieval of the first web page by a web browser or selection of an element of the first web page by a user; determining, based on the first event, which subset of a plurality of security data and metadata maintained for an account associated with the user should be retrieved; retrieving the determined subset of security data and metadata; as well as The determined subset of the security data and the metadata is integrated into the content of the first web page for presentation.

9. The non-transitory computer-readable medium of claim 8, wherein the first event comprises retrieval of a first web page, and wherein the program code further comprises instructions for: matching a uniform resource locator (URL) of a first webpage to a first URL pattern of a plurality of URL patterns, wherein the first URL pattern includes a variable name, and wherein a first substring of the URL matches a position of the variable name, Wherein the instructions for determining a subset of the security data and the metadata include instructions for determining the subset based on a first substring of the URL.

10. A non-transitory computer-readable medium according to claim 8 or 9, wherein the first event includes a selection of the element of the first web page, and wherein the program code further includes instructions for evaluating the markup language document of the first web page based on a first expression, the first expression describing the location in the markup language document of an indication of a resource corresponding to the selected element, and wherein the instructions for retrieving a subset of security data and metadata include instructions for retrieving security data and metadata maintained for the resource based on the indication of the resource corresponding to the selected element.

11. The non-transitory computer-readable medium of any one of claims 8 to 10, wherein the instructions for evaluating the markup language document of the first web page include instructions for evaluating a Hypertext Markup Language (HTML) or Extensible Markup Language (XML) document, and wherein the first expression includes at least one of an XPath expression and a jQuery selector.

12. An apparatus comprising: processor; as well as A computer readable medium having instructions stored thereon, the instructions being executable by a processor to cause the apparatus to: detecting a request for a first webpage of a provider during a login session of an account under the provider, wherein the first webpage has a first uniform resource locator (URL); identifying a match between the first URL and a first URL pattern in the plurality of URL patterns based on an evaluation of the first URL against a plurality of URL patterns defined for the vendor; determining, based on the first URL pattern, a first subset of security information maintained for the account to retrieve; as well as Based on the retrieval of the determined first subset of security information, the first subset of security information is integrated into the first web page as a security summary of the content of the first web page.

13. The apparatus of claim 12, wherein each of the plurality of URL patterns comprises a variable name indicating which security information is to be retrieved, and wherein the instructions executable by the processor to cause the apparatus to determine the first subset of security information comprise: Instructions executable by the processor to cause the device to determine a substring of a first URL that matches a first variable name of a first URL pattern.

14. The apparatus according to claim 12 or 13, further comprising instructions executable by a processor to cause the apparatus to: based on detecting a selection of an element of the second webpage, evaluating the markup language of the second webpage to determine a resource to which the selected element corresponds, wherein the instructions for evaluating the markup language include instructions for evaluating at least one of an Extensible Markup Language Path Language (XPath) expression and a jQuery selector defined for a vendor, wherein at least one of the XPath expression and the jQuery selector evaluates or selects a node of the markup language of the second webpage, the node including an indication of the resource; generating a security profile for the resource based on the second subset of security information based on the retrieved second subset of security information corresponding to the resource; as well as A second subset of the security information is integrated into a second web page as a security summary of the resource.

15. The apparatus of any one of claims 12 to 14, wherein the instructions executable by the processor to cause the apparatus to integrate the first subset of security information into the first webpage include: Instructions executable by the processor to cause the device to modify, through a document object model (DOM) of a Hypertext Markup Language (HTML) or Extensible Markup Language (XML) document of a first web page to include a first subset of security information.

Images