Client-Side Service Worker for SaaS User Identification and DLP

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity appliances face high overhead and resource consumption in maintaining centralized caches of user account information and session IDs for SaaS applications, and DLP tools struggle with variability across different protocols, necessitating extensive development for per-SaaS application security policies and inline scanning.

Innovation Solution

A service worker is installed client-side between the web browser and cybersecurity appliance to intercept and modify requests, caching user information and performing DLP scanning, reducing overhead on the appliance and enabling consistent security policy enforcement across SaaS applications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a centralized cache of user account information and session IDs is maintained on the cybersecurity appliance, then security policy enforcement is enabled, but overhead and resource consumption increase significantly

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidappliance overhead

Core Design Contradiction:

ReliabilityVSUse of energy by stationary object

Solution Approach 1:

The patent extracts the caching function from the cybersecurity appliance and relocates it to the client-side service worker. The service worker maintains a local cache of user account information and session IDs, eliminating the need for the appliance to maintain a centralized cache. This extraction reduces appliance overhead while preserving security policy enforcement capabilities.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The service worker acts as an intermediary between the browser and the cybersecurity appliance. It intercepts requests, modifies them by adding user information from its local cache, and forwards them to the appliance. This intermediary role eliminates the need for the appliance to maintain centralized user information caches.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If DLP scanning is performed for each SaaS application with varying protocols, then data loss prevention is achieved, but extensive development resources are consumed

Engineering Contradiction:

Improvedata loss preventionVSAvoiddevelopment effort

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The service worker implements a universal DLP scanning mechanism that works across multiple SaaS applications with different protocols. Instead of developing application-specific DLP scanners, the service worker uses a protocol-agnostic approach by intercepting and modifying HTTP requests at the service worker level, enabling consistent DLP scanning across diverse SaaS applications without extensive per-application development.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Adaptability or versatility

If per-SaaS application security policies are implemented, then granular control is achieved, but device complexity increases

Engineering Contradiction:

Improvegranular security controlVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments security policy enforcement into two parts: granular policy configuration on the appliance side and policy execution on the client-side service worker. The service worker receives policy directives from the appliance and enforces them locally by modifying requests based on user information from its cache. This segmentation enables granular control without increasing overall system complexity.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12445412B2Automated service worker installation for client-initiated user identification and DLP scanning

Publication Date: 2025.10.14 PALO ALTO NETWORKS INC

AI summary

A cybersecurity appliance orchestrates registration and installation of a service worker by a web browser. The service worker intercepts and modifies requests sent by the web browser for a SaaS application with tenant/user information and/or DLP scanning results. The cybersecurity appliance orchestrates the service worker registration and installation by modifying responses to requests sent by the web browser. Once installed, the service worker determines the logged in user for the session and modifies outbound requests to attach the user information (e.g., account name/email address) thereto. The service worker can also or alternatively monitor for input of data into web pages, designate the data for data loss prevention (DLP) scanning, and modify outbound requests to attach the DLP scanning result. The cybersecurity appliance receives the user information and/or DLP scanning results with requests sent by the web browser since the user information and/or results were attached to the requests client-side.