Browser Service Worker for SaaS User ID and DLP Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity appliances face high overhead and resource consumption in maintaining centralized caches of user account information and session IDs for SaaS applications, and DLP tools struggle with variability across different protocols, necessitating a more efficient and adaptable approach for user identification and DLP scanning.
Innovation Solution
A service worker is installed client-side to intercept and modify network traffic, caching user information and performing DLP scanning, reducing the burden on cybersecurity appliances by determining user identity and incorporating DLP results directly into requests, thus enabling granular security policies across multiple SaaS applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized cache is maintained by cybersecurity appliances to store user account information and session IDs, then user identification capability is improved, but system overhead and resource consumption increase
Solution Approach 1:
The patent extracts the user identification function from the centralized cybersecurity appliance and relocates it to the client-side service worker. The service worker caches user account information and session IDs locally in the browser, eliminating the need for the appliance to maintain a centralized cache, thereby reducing system overhead while preserving identification capability
Solution Approach 2:
The service worker acts as an intermediary between the web browser and the cybersecurity appliance. It intercepts network traffic, determines user identity information, and modifies requests before they reach the appliance, allowing the appliance to receive pre-processed requests without maintaining its own user information cache
2Ease of manufacture
If DLP tools use a one-size-fits-all approach for decoding network traffic, then implementation simplicity is improved, but adaptability to different SaaS application protocols deteriorates
Solution Approach 1:
The patent implements dynamic protocol adaptation by having the service worker detect the SaaS application protocol from the network traffic and adjust its behavior accordingly. The service worker dynamically determines which protocol is being used and configures DLP scanning parameters based on the detected protocol, enabling a single implementation to adapt to multiple protocols without complex configuration
Data Source
AI summary
A cybersecurity appliance orchestrates registration and installation of a service worker by a web browser. The service worker intercepts and modifies requests sent by the web browser for a SaaS application with tenant/user information and/or DLP scanning results. The cybersecurity appliance orchestrates the service worker registration and installation by modifying responses to requests sent by the web browser. Once installed, the service worker determines the logged in user for the session and modifies outbound requests to attach the user information (e.g., account name/email address) thereto. The service worker can also or alternatively monitor for input of data into web pages, designate the data for data loss prevention (DLP) scanning, and modify outbound requests to attach the DLP scanning result. The cybersecurity appliance receives the user information and/or DLP scanning results with requests sent by the web browser since the user information and/or results were attached to the requests client-side.