Identity Proxy Isolation via Cloud Browser Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer networking systems lack effective methods for Identity Proxy Isolation (IPI) through Cloud Browser Isolation (CBI), particularly in ensuring secure access to applications across various devices and locations while preventing data exfiltration.
Innovation Solution
The system implements Identity Proxy Isolation (IPI) through Cloud Browser Isolation (CBI) by receiving user device requests, authenticating them via a customer Identity Provider, and using Security Assertion Markup Language (SAML) assertions to determine whether to block, allow, or isolate the requests, thereby initiating a CBI session for secure application access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud browser isolation is implemented to secure application access, then security against malicious code and cyberattacks is improved, but device complexity and system overhead increase
Solution Approach 1:
The patent introduces a cloud-based browser isolation service as an intermediary between users and applications. This service runs browsers in isolated cloud environments rather than on user devices, acting as a mediator that prevents malicious code from reaching local systems while maintaining application access functionality. The isolation layer separates the untrusted user environment from the trusted application environment.
Solution Approach 2:
The system segments the browsing environment from the user device by running browsers in isolated cloud containers. This segmentation divides the system into distinct trusted and untrusted zones, allowing application access functionality to be separated from the potentially compromised local browser environment, thereby improving security without requiring changes to the core application infrastructure.
2Reliability
If authentication and isolation checks are performed for every access request, then data exfiltration prevention is improved, but processing time and response delay increase
Solution Approach 1:
The system performs preliminary authentication and device trust assessment before granting application access. By evaluating user credentials and device trust status in advance through SAML authentication and device fingerprinting, the system establishes security policies upfront, reducing the need for repeated checks during each access request and minimizing processing delays.
Solution Approach 2:
The system implements feedback mechanisms where authentication results and device trust assessments are cached and reused for subsequent requests from the same user and device. This feedback loop allows the system to maintain strict security checks while reducing redundant processing time for established trusted sessions.
3Reliability
If cloud browser isolation sessions are initiated for untrusted devices, then secure access control is improved, but network bandwidth and computational resources increase
Solution Approach 1:
The system applies partial isolation by initiating cloud browser isolation sessions only for untrusted devices based on authentication results and device trust assessments. Trusted devices can access applications directly without full isolation overhead, while untrusted devices receive targeted isolation protection. This selective approach maintains access control security while reducing unnecessary computational resource consumption for already-trusted users.
Data Source
AI summary
Systems and methods include receiving a request from a user device for access to an application; performing an authentication of the request via a customer Identity Provider (IDP); receiving a Security Assertion Markup Language (SAML) assertion from the customer IDP; and performing an action based on the SAML assertion, the action being one of blocking the request, allowing the request, and isolating the request.