Inline Proxy Synthetic Request Injection for Missing Cloud Metadata

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud access security brokers (CASBs) face challenges in retrieving missing metadata during transactions, limiting their ability to enforce appropriate policies due to the need to adhere to exacting intermediation protocols of cloud service providers, especially in scenarios where metadata is not available in the transaction stream.

Innovation Solution

Implementing synthetic requests by a network security system to independently retrieve missing metadata, using application-specific parsers and templates, enabling effective policy enforcement and enhancing security posture across cloud environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cloud access security brokers adhere to exacting intermediation protocols of cloud service providers, then they can maintain proper transaction flow, but they cannot retrieve missing metadata that is not available in the transaction stream

Engineering Contradiction:

Improvetransaction flow integrityVSAvoidmetadata retrieval capability

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

Instead of passively waiting for metadata to appear in the transaction stream, the CASB actively sends synthetic requests to the cloud service provider to retrieve the missing metadata. This inverts the traditional approach where the security broker only observes transactions, transforming it into an active inquiry mechanism that obtains otherwise unavailable information while maintaining protocol compliance.

Inventive Principle:

Principle #13The other way round (Inversion)

2Device complexity

If cloud access security brokers passively monitor transaction streams, then they maintain low system complexity, but they cannot enforce policies when metadata is missing from transactions

Engineering Contradiction:

Improvesystem architecture simplicityVSAvoidpolicy enforcement capability

Core Design Contradiction:

Device complexityVSAdaptability or versatility

Solution Approach 1:

The CASB system performs self-service by autonomously generating and sending synthetic requests to retrieve missing metadata without requiring external intervention or complex architectural changes. This self-service mechanism enables the system to adaptively obtain necessary information for policy enforcement while maintaining its existing operational framework.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If cloud access security brokers use synthetic requests to retrieve missing metadata, then they enhance policy enforcement capability, but they increase system complexity

Engineering Contradiction:

Improvemetadata retrieval flexibilityVSAvoidrequest generation mechanism

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The synthetic request mechanism acts as an intermediary between the CASB and the cloud service provider, enabling metadata retrieval without requiring direct integration or complex bidirectional communication protocols. This intermediary approach simplifies the overall system architecture by providing a standardized method for obtaining missing information while maintaining protocol compliance.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12445451B2Inline proxy with synthetic request injection logic for cloud policy enforcement

Publication Date: 2025.10.14 NETSKOPE INC

AI summary

The technology disclosed relates to an inline proxy configured with synthetic request injection logic to intercept incoming requests during an application session, and generate, during the application session, synthetic requests that are separate from the incoming requests.