Patent ID: 11888902
Assignee: NETSKOPE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A system, comprising:
a network security system interposed between clients and cloud applications, running on one or more hardware processors coupled to memory storing instructions, the instructions when executed cause the network security system to:
receive, during an application session, an incoming request from a client, wherein the incoming request is directed towards a cloud application and includes an object identifier of an object and an activity initiated on the object, and wherein the incoming request is intercepted by the network security system;
analyze the incoming request;
detect the object identifier based on the analyzing the incoming request;
hold the incoming request to hold execution of the activity on the object;
configure a synthetic request with the object identifier;
inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to retrieve object metadata about the object using the object identifier, and wherein the synthetic request is generated by the network security system in response to the incoming request and is separate from the incoming request generated by the client;
receive a response to the synthetic request from the cloud application, wherein the response supplies the object metadata that is available for enforcing a security policy on the activity initiated on the object by the incoming request; and
evaluate the object metadata against the security policy, the evaluation comprising:
in response to a determination that the activity qualifies as executable on the object based on the object metadata and the security policy:
release the hold of the incoming request, and
transmit the incoming request to the cloud application for execution of the activity; and

in response to a determination that the activity does not qualify as executable on the object based on the object metadata and the security policy:
block the incoming request from the cloud application.