Cloud Web Isolation via Image Streaming

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud-based web content processing systems struggle to effectively isolate user devices from malicious web content and prevent data exfiltration, especially in enterprise environments where sensitive data is accessed from various locations and devices.

Innovation Solution

A cloud-based web content processing system that moves the processing of select web content from a user's local web browser to a secure and isolated cloud environment, rendering content in isolation and providing only image content to the local browser, while using a JavaScript application and WebSocket channel for interaction.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If web content is processed in a local web browser, then user interaction is direct and simple, but user devices are exposed to malicious code and data exfiltration risks

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a cloud-based web isolation service as an intermediary between the user's local browser and the web content. This service renders web content in an isolated cloud environment and streams only the rendered output back to the user, preventing direct execution of malicious code while maintaining user interaction capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments the web content processing into separate components: the user's local browser handles only display and input functions, while the cloud-based isolation service handles the actual content rendering and security filtering. This segmentation isolates security risks from the user device while maintaining functionality.

Inventive Principle:

Principle #1Segmentation

2Reliability

If web content is isolated in a cloud environment, then data exfiltration is prevented, but network bandwidth consumption increases due to continuous content streaming

Engineering Contradiction:

Improvedata integrityVSAvoidbandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

Instead of transmitting the complete web content and its associated data to the user device, the system creates a visual copy (rendered output) of the content and streams only this copy to the user's browser. This reduces the amount of data transmitted while maintaining the functional equivalent of the original content.

Inventive Principle:

Principle #26Copying

3Reliability

If all web content is processed through isolation, then security is maximized, but user experience and productivity are reduced due to processing delays

Engineering Contradiction:

ImprovesecurityVSAvoiduser productivity

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system applies web isolation selectively rather than universally. Content is isolated only when security risks are detected or when organizational policies require it, while safe content can be accessed directly. This partial application of isolation maintains security where needed without unnecessarily degrading user experience across all web traffic.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentEP3716108B1Cloud-based web content processing system providing client threat isolation and data integrity

Publication Date: 2025.04.23 ZSCALER INC

Figure 1
Figure 2~3
Figure 4

AI summary

Systems and methods include receiving a request for resources that are one of web content and a cloud application from a user device; determining the request requires isolation based on any of policy, category of the web content, type of the user device, and location of the user device; rendering content associated with the request in a secure environment that is isolated from the user device; and providing image content based on the content to the user device. The user device can execute a web browser that loads the image content utilizing a JavaScript application and that interacts with the image content by sending keyboard and mouse inputs via a WebSocket channel.