Synthetic Request Injection for Cloud Metadata Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud access security brokers (CASBs) face challenges in retrieving metadata from cloud applications due to the need to adhere to exacting intermediation protocols, limiting their ability to enforce appropriate security policies, especially for data at rest and in multi-cloud environments.
Innovation Solution
Implementing synthetic request injection mechanisms to retrieve metadata directly from cloud applications using APIs, enabling the network security system to generate and process synthetic requests to gather missing metadata for effective policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud access security brokers (CASBs) adhere to exacting intermediation protocols to access cloud applications, then they can maintain protocol compliance, but their ability to retrieve metadata is limited
Solution Approach 1:
The patent introduces an intermediary component that sits between the CASB and the cloud application API. This intermediary translates and transforms requests to comply with cloud application protocols while extracting metadata, effectively mediating between the security broker's needs and the application's protocol requirements. The intermediary enables metadata retrieval without violating protocol compliance by acting as a buffer that adapts communication between the two systems.
2Reliability
If CASBs use traditional intermediation methods to access cloud applications, then they can maintain security oversight, but they cannot effectively enforce policies on data at rest
Solution Approach 1:
The patent implements preliminary action by extracting and caching metadata about cloud storage objects (such as file names, types, sizes, and other attributes) before actual data access or transfer occurs. This pre-extraction of metadata enables the CASB to enforce policies on data at rest by having the information already available in advance, rather than waiting for data movement events. The metadata is retrieved proactively through API calls and stored for later policy evaluation.
3Productivity
If CASBs implement metadata retrieval mechanisms, then they can improve policy enforcement, but they may intrude on existing infrastructure
Solution Approach 1:
The patent implements self-service by enabling the CASB to autonomously retrieve its own required metadata directly from cloud application APIs without needing additional infrastructure components or modifying existing cloud application architectures. The CASB independently makes API calls to extract metadata, processes the information, and uses it for policy enforcement. This self-sufficient approach avoids infrastructure intrusion while maintaining productivity.
Data Source
AI summary
The technology disclosed describes a network security system (NSS) for managing cloud security posture. The NSS uses synthetic request injection to determine a security posture of a resource hosted on a cloud application for policy enforcement. The NSS receives an incoming request from a client directed toward a resource hosted on a cloud application during an application session. The NSS holds the incoming request, generates the synthetic request, and transmits the synthetic request to the cloud application. The synthetic request is designed to retrieve information specifying the security posture of the resource from the cloud application using the resource identifier. The NSS receives a response to the synthetic request from the cloud application that supplies the information specifying the security posture of the resource. The NSS applies a policy on the incoming request based on the security posture information.