Patent ID: 11888902
Assignee: NETSKOPE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 17:
18. A non-transitory computer readable storage medium impressed with computer program instructions to enforce policies, the instructions, when executed on a processor, implement a method comprising:
a network security system, interposed between clients and cloud applications, the network security system receiving, during an application session, an incoming request from a client, wherein the incoming request is directed towards a cloud application and includes an object identifier of an object and an activity initiated on the object;
the network security system analyzing the incoming request;
the network security system detecting the object identifier based on the analyzing the incoming request;
the network security system holding the incoming request to hold execution of the activity on the object;
the network security system configuring a synthetic request with the object identifier;
the network security system injecting the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to retrieve object metadata about the object using the object identifier, and wherein the synthetic request is generated by the network security system in response to the incoming request and is separate from the incoming request generated by the client;
the network security system receiving a response to the synthetic request from the cloud application, wherein the response supplies the object metadata; and
the network security system evaluating the object metadata against a security policy, the evaluation comprising:
in response to a determination that the activity qualifies as executable on the object based on the object metadata and the security policy:
releasing the hold of the incoming request, and
transmitting the incoming request to the cloud application for execution of the activity; and

in response to a determination that the activity does not qualify as executable on the object based on the object metadata and the security policy:
blocking the incoming request from the cloud application.