Patent ID: 11880422
Assignee: CLOUDFLARE, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 14:
15. A non-transitory computer-readable medium that stores instructions that, when executed by one or more processors, cause the one or more processors to perform actions, the actions comprising:
providing an application isolation session cooperatively between a local application instance on a rendering computing device and a remote application instance on an executing computing device that is remotely located, separate, and distinct from the rendering computing device by:
instantiating the remote application instance in the executing computing device,
intercepting, at the remote application instance, a first set of one or more draw commands associated with output of the remote application instance, and
providing, by the executing computing device, the first set of one or more draw commands to the rendering computing device,
wherein the provided application isolation session isolates the local application instance from malicious changes to the remote application instance by causing the remote application instance to execute in an isolated execution environment on the executing computing device, and causing the remote application instance to modify the rendering output responsive to inputs from the local application instance;

receiving user inputs representing an action of a user of the local application instance on the rendering computing device during the provided application isolation session;
determining that the user action is directed to a target absent from a whitelist;
determining that the user inputs representing the action of the user includes a trigger event of one or more trigger events determined based on a role associated with the user responsive to determining that the user action is directed to the target absent from the whitelist, the trigger event including a predetermined number of keystrokes satisfying a character types variety requirement;
responsive to determining that the user inputs representing the action of the user includes the trigger event, evaluating one or more characteristics of one or more fields in the rendering output of the remote application instance;
detecting one or more candidate sensitive information fields in the rendering output of the remote application instance on the executing computing device based on the evaluation of the one or more characteristics of the one or more fields in the rendering output of the remote application instance;
evaluating one or more values of the one or more detected candidate sensitive information fields;
determining that the one or more values include candidate sensitive information based on the evaluation of the one or more values of the one or more detected candidate sensitive information fields;
comparing the determined candidate sensitive information to one or more stored values;
verifying that the determined candidate sensitive information includes actual sensitive information based on the comparison of the determined candidate sensitive information to the one or more stored values; and
responsive to the comparison, preventing the verified actual sensitive information from being provided from the local application instance or the remote application instance to another application or computing device.