Securing cloud applications via isolation

A method for securing cloud applications is described. The method may include establishing a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and managing, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

FIELD OF TECHNOLOGY

The present disclosure relates generally to cloud platform systems, and more specifically to securing cloud applications via isolation

BACKGROUND

A cloud platform (e.g., a computing platform for cloud computing) may be employed by many users and organizations to store, manage, and process data using a shared network of remote servers. Users and organizations may develop applications on the cloud platform to handle the storage, management, and processing of data. In some cases, the cloud platform may utilize a multi-tenant database system. Users and organizations may access the cloud platform using various user devices (e.g., desktop computers, laptops, smartphones, tablets, or other computing systems, etc.).

The use of cloud platform systems and computer-related technologies continues to increase at a rapid pace. The expansive use of cloud platform systems has influenced the advances made to computer-related technologies. Cloud platform systems have increasingly become an integral part of the business world and the activities of individual consumers. Cloud platform systems may be used to carry out several business, industry, and academic endeavors. The widespread use of cloud platforms across various user devices has caused an increased presence in security threats including data theft, embedding malware and viruses, and the like. Due to security threats in cloud platform systems and computer-related technologies, methods for securing cloud applications may be beneficial in preventing security threats to various user devices and organizations.

SUMMARY

A method for securing cloud applications is described. The method may include establishing a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

A computing device for securing cloud applications is described. The computing device may include a processor, memory in electronic communication with the processor, and instructions stored in the memory. The instructions may be executable by the processor to cause the computing device to establish a connection between the computing device, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and manage, via the computing device and the cloud access security broker, a session between the cloud application and a second computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

A non-transitory computer-readable medium storing code at a computing device for securing cloud applications is described. The code may include instructions executable by a processor to establish a connection between the computing device, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, the cloud access security broker in communication with the cloud application isolation portal and the cloud application monitors and controls traffic associated with the cloud application. In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, managing, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user may be further based at least in part on monitoring and controlling of the traffic associated with the cloud application.

Some examples of the method, computing devices, and non-transitory computer-readable medium described herein may further include operations, features, means, or instructions for identifying traffic associated with the cloud application between the cloud application and the computing device associated with the end user, and isolating the traffic associated with the cloud application to the cloud application isolation portal during the session. In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, managing, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user may be further based at least in part on the isolating.

Some examples of the method, computing devices, and non-transitory computer-readable medium described herein may further include operations, features, means, or instructions for rendering, to a browser of the computing device associated with the end user and via the cloud application isolation portal, the cloud application or the traffic associated with the cloud application, or both. In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, managing, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user may be further based at least in part on the rendering.

In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, rendering, via the cloud application isolation portal, the cloud application or the traffic associated with the cloud application, or both, to the browser of the computing device associated with the end user may be based at least in part on a forward proxy mode.

Some examples of the method, computing devices, and non-transitory computer-readable medium described herein may further include operations, features, means, or instructions for preventing the computing device associated with the end user to process the traffic associated with the cloud application based at least in part on the isolating. In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, managing, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user may be further based at least in part on the preventing.

Some examples of the method, computing devices, and non-transitory computer-readable medium described herein may further include operations, features, means, or instructions for providing an interface to a browser of the computing device associated with the end user. In some cases, the interface emulates an interface of the cloud application.

Some examples of the method, computing devices, and non-transitory computer-readable medium described herein may further include operations, features, means, or instructions for receiving the set of credentials associated with the end user of the cloud application based at least in part on the cloud application receiving a request via a browser of the computing device associated with the end user to access the cloud application.

In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, the cloud application forwards the browser of the computing device associated with the end user to a single sign-on resource based at least in part on an identifier of the computing device or an identifier of the end user, or both.

In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, the single sign-on resource may be a proxy.

In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, the single sign-on resource forwards the identifier of the computing device, the identifier of the end user, metadata, or a combination thereof, to an identity provider network entity to authenticate the set of credentials.

In some examples of the method, computing devices, and non-transitory computer-readable medium described herein, the cloud application isolation portal resides remotely from the computing device associated with the end user.

DETAILED DESCRIPTION

The described techniques relate to improved methods, systems, or devices, that support cloud platforms. More specifically, the methods, systems, or devices, described herein relate to securing cloud applications associated with cloud platforms. Some organizations (e.g., corporations, businesses, and the like) may support use of cloud applications to provide access (e.g., to aspects and operations of the organization) to various user devices globally to benefit end user experience and productivity for the organizations. For a managed endpoint, organizations may implement a scheme (e.g., a security agent that may be configured on an endpoint of the organization) to control certain operations and functionalities of the endpoint to reduce or mitigate security threats, such as data loss. A managed endpoint may be an end user device within an organization's network that may be registered to the organization, controlled by the organization, monitored by the organization, or the like.

Some present techniques may be effective in preventing security threats, such as data theft, however these techniques may be only suitable as long as the endpoint is configured (e.g., a managed endpoint configured with a security agent). For example, some techniques introduce a reverse proxy, which may rewrite cloud application universal resource locators (URLs), so that the reverse proxy can integrate with a security agent (e.g., network entity) to enforce certain operations and functionalities of a device. This however requires extensive resources to prevent the cloud application from failing due to changes to the cloud application (e.g., the number of applications allowed to run in the existing reverse proxy model are often limited due to the relatively high resource-intensive tasks associated with maintaining the application functionality). Further, these techniques have shortcoming that include a limitation on the number of cloud applications that can be supported by the security agent using the reverse proxy scheme. Therefore, unmanaged user devices accessing cloud applications expose an organization to data loss risks and create blind spots due to the lack of monitoring capabilities of the unmanaged user devices (e.g., security state, cloud application traffic that are rendered, cached and downloaded to the unmanaged device, etc.).

To address the challenges of securing cloud applications and shortcoming of existing techniques, the methods, systems, or devices, described herein may improve the way that data sessions associated with cloud applications from unmanaged devices are secured, by utilizing a network entity that authenticates an end user of the unmanaged device and redirects the data session through a cloud application isolation portal. The cloud application isolation portal may use a cloud access security broker to control access to the cloud application. For example, the methods, systems, or devices, described herein may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application. As a result, the methods, systems, or devices, described herein may manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application. The cloud application isolation portal may also provide a seamless user experience, for example, by providing an interface to a browser of the computing device associated with the end user that emulates an interface of the cloud application, while preventing any client-side, local data processing of data associated with the cloud application that could potentially result in data loss.

Accordingly, benefits of the present disclosure may include eliminating disadvantages of existing techniques for securing cloud applications. Further benefits of the present disclosure may include enabling a device (e.g., an end user terminal, a server, a network entity, and the like) to secure data sessions associated with cloud application access by an unmanaged device by isolating the data session associated with the cloud application to a cloud application isolation portal residing remotely from the unmanaged device. The benefits of the present disclosure may also include preventing the unmanaged device from performing client-side processing (e.g., storing or caching data locally, etc.) of any data associated with the data session. The benefits of the present disclosure may also include providing the same seamless, secure access to a cloud data environment across multiple unmanaged devices. Thus, benefits of the present disclosure may allow the cloud application to run in isolation on an end user device browser with all the functionality of the cloud application, but without the risk of uncontrolled breaking out of the isolation, preventing data loss based on the active avoidance of processing data locally on the unmanaged device.

Aspects of the disclosure are initially described in the context of an environment. Aspects are then described with respect to process flow that supports securing cloud applications in accordance with aspects of the present disclosure. Aspects of the disclosure are further illustrated by and described with reference to apparatus diagrams, system diagrams, and flowcharts that relate to securing cloud applications in accordance with aspects of the present disclosure.

FIG.1illustrates a block diagram of an environment100that supports securing cloud applications in accordance with aspects of the present disclosure. As depicted, the environment100may include a device105-a, a device105-b, a server120-a, a server120-b, and a cloud platform125. The techniques described herein may be performed on a device (e.g., the device105or the server120, or a combination thereof). In the illustrated embodiment, the device105-a, the device105-b, the server120-a, the server120-b, and the cloud platform125may be communicatively coupled via a network130(e.g., via communication links155).

The devices105in the environment100may be used by way of example. While, the environment100illustrates two devices105, the present disclosure applies to any system architecture having one or more devices105. Furthermore, while a single network is coupled to the device105-a, the device105-b, the server120-a, the server120-b, and the cloud platform125, the present disclosure applies to any system architecture having any number of networks that may be communicatively coupled to the device105-a, the device105-b, the server120-a, the server120-b, and the cloud platform125. Similarly, while the environment100illustrates two servers120, the present disclosure applies to any system architecture having one or more servers.

In some cases, the device105-a, the device105-b, the server120-a, or the server120-b, or a combination thereof may include a personal electronic device such as a cellular phone, a personal digital assistant (PDA), a tablet computer, a laptop computer, or a personal computer. The device105-amay include an application110-a, while the device105-bmay include an application110-b. The applications110may be a same or a different application downloaded, installed, and running on the devices105. The applications110may be referred to herein as a cloud application or cloud-based application (e.g., web-based application accessible via a browser of the device105). A browser may be a software program running on devices105that provides an interface for displaying application interfaces, supports navigating the Internet via network130, and the like. In some cases, the devices105may have one or more additional applications installed.

The servers120may include an application isolation manager as described with reference toFIGS.3through6, where at least a portion of the functions of the application isolation manager are performed separately or concurrently on the devices105or the servers120, or both. For example, server120-amay include an application isolation manager135as described with reference toFIGS.3through6. Additionally, or alternatively, the devices105may include an application isolation manager as described with reference toFIGS.3through6, where at least a portion of the functions of the application isolation manager are performed separately or concurrently on the devices105or the servers120, or both. Similarly, in some cases, a person may access the functions of the devices105(directly or through the devices105via an application isolation manager).

The device105-amay include a cloud-based application that interfaces with one or more functions of the application isolation manager135residing on the server120-a, as described with reference toFIGS.3through6. It is noted that in some cases, the devices105may not include an application isolation manager as described with reference toFIGS.3through6. For example, the devices105may include the applications110that allows the devices105to interface with an application isolation manager that may be located on another device or the servers120(e.g., the server120-a). Although the components of the devices105are depicted as being internal to the device105, it is understood that one or more of the components may be external to the devices105and connect to the devices105through wired or wireless connections, or both (e.g., via the communication links155).

The servers120may be a computing system or an application that may be an intermediary node in the environment100between the device105-a, the device105-b, or the cloud platform125, or a combination thereof. The servers120may include any combination of a social network server, data server, a cloud server, a server associated with an automation service provider, proxy server, mail server, web server, application server, database server, communications server, file server, home server, mobile server, name server, or any combination thereof. In some cases, the servers120may include an application distribution platform.

The servers120may receive a request from one or more of the devices105seeking resources from the servers120and/or the cloud platform125. In some cases, the devices105may communicate with the servers120via the network130. Examples of the network130may include any combination of cloud networks, local area networks (LAN), wide area networks (WAN), virtual private networks (VPN), wireless networks (using 802.11, for example), cellular networks (using 3G, LTE, or new radio (NR) systems (e.g., 5G) for example), etc. In some cases, network130may include the Internet. In some cases, the servers120may communicate with each other via a communication link160. The communication link160may be a wired connection or a wireless connection.

In some examples, the servers120may receive requests from the devices105instructing the servers120to provide an executable file to install an application (e.g., the applications110) from the application distribution platform (e.g., via the cloud platform125) to the devices105. For example, a person may, using at least one of the devices105, install one or more software applications from the cloud platform125, which may be hosted by at least one of the servers120via the communication links155. The person may discover, browse, share, and download software applications from the application distribution platform. In some examples, applications offered by the application distribution platform may be characterized based on a category, and the person may select a category to discover and download (e.g., install) an application on one or more of the devices105. For example, an application category may include books, business, finance, among others. As such, applications110may include at least one example of a cloud-based service or cloud-based application, as described above.

Cloud platform125may be an example of a public or private cloud network. Devices105may also be referred to here as a cloud client, which may access the cloud platform125over network130. The network130may implement transfer control protocol and internet protocol (TCP/IP), such as the Internet, or may implement other network protocols. In some examples, a device105may be operated by an end user that is part of a business, an enterprise, a non-profit, a startup, or any other organization type. A cloud client may access cloud platform125to store, manage, and process data associated with an application110. In some cases, devices105may have an associated security or permission level where access to data may be limited based on a policy associated with one or more user accounts (e.g., a first permission level for a first user and a second permission level for a second user where access of the first permission level is limited to the same or a different access as the second permission level). A cloud client may have access to certain applications, data, and database information within the cloud platform125based on the associated security or permission level, and may not have access to others. The cloud platform125may offer an on-demand database service to the devices105. In some cases, the cloud platform125may be an example of a multi-tenant database system. In this case, the cloud platform125may serve multiple cloud clients with a single instance of software. However, other types of systems may be implemented, including—but not limited to—client-server systems, mobile device systems, and mobile network systems.

Some organizations (e.g., companies, industries, and the like) may support use of cloud applications (e.g., applications110) to provide access to aspects and operations of the organization to various devices105. For a managed endpoint, organizations may implement a scheme (e.g., a security agent that may be configured on an endpoint of the organization) to control certain operations and functionalities of the endpoint to decrease or mitigate security threats. For example, a managed endpoint may be at least one device105(e.g., the device105-a), which may be within an organization's network that may be registered to the organization, controlled by the organization, monitored by the organization, or the like. Some data loss prevention schemes may be effective in preventing security threats, such as data theft, however these schemes may be only suitable as long as the device105is within the organization's network. However, unmanaged user devices, for example, such as device105-baccessing cloud applications on the cloud platform125may expose an organization to data loss risks and create blind spots due to lack of monitoring capabilities of the unmanaged device (e.g., security state, cloud application traffic that are rendered, cached and downloaded to the unmanaged device). To solve the problems of securing cloud applications and shortcoming of present techniques, the present disclosure described herein may improve the way that data sessions associated with cloud applications (e.g., of cloud platform125) and accessed by unmanaged devices (e.g., device105-aor device105-b, or both) are secured, by utilizing one or more network entities to authenticate an end user of the unmanaged device and redirects the data session through a secure network entity (e.g., proxy), which may be associated with or reside on the server120-aor the server120-b, or both. The network entity may be part of or include the server120-aor the server120-b, or both.

By way of example, application isolation manager135may receive a request from one or more of the devices105seeking resources from the servers120and/or the cloud platform125. For example, an end user may submit a request to access resources of a cloud application (e.g., application110) associated with the cloud platform125. In some examples, the request may include a set of credentials associated with the end user of the cloud application submitted via a browser of the device105. In some examples, the cloud application may forward the browser of the device105to a single sign-on resource based at least in part on an identifier of the device105or an identifier of the end user, or both. A single sign-on resource may be a proxy that may utilize, for example, lightweight directory access protocol (LDAP) and stored LDAP databases on the servers120. Although LDAP may be an example of a single sign-on resource, it is understood that other single sign-on resources may be applicable. For example, any single sign-on resource that uses SAML for transferring authentication information between the identity provider (e.g., a server120) and the service provider (e.g., a server120) may be used. A proxy may include the server120-aor the server120-b, or both. In some examples, the single sign-on resource may forward the identifier of the device105, the identifier of the end user, metadata, or a combination thereof, to an identity provider network entity (e.g., a server120) to authenticate the set of credentials.

The cloud application isolation portal140, which may be associated with or reside on the server120-aor the server120-b, or both, may use a cloud access security broker145to control access to a cloud application (e.g., application110) associated with the cloud platform125. The cloud access security broker145may be an on-premises or cloud-based security policy enforcement point that may be positioned between cloud service consumers (e.g., devices105) and cloud service providers (e.g., cloud platform125) to combine and interject enterprise security policies as cloud-based resources are accessed. For example, the cloud application isolation portal140may establish a connection with the cloud access security broker145or a cloud application (e.g., application110associated with the cloud platform125), or both, based at least in part on an indication of the cloud application and the set of credentials associated with an end user of the cloud application.

The cloud application isolation portal140may manage, with the cloud access security broker145, a session between the cloud application and a device105(e.g., an unmanaged device105-aor105-b) based at least in part on the connection between the cloud application isolation portal140with the cloud access security broker145and the cloud application. The cloud application isolation portal140may also provide a unified user experience, for example, by providing an interface to a browser of the device105that emulates an interface of the cloud application, while performing a security action, for example, including preventing any client-side data processing of data associated with the cloud application at the device105. In some examples, the cloud access security broker145in communication with the cloud application isolation portal140and the cloud application may monitor and control traffic associated with the cloud application. As such, the cloud application isolation portal140, which may be associated with or reside on the server120-aor the server120-b, or both, may manage, with the cloud access security broker145, the session between the cloud application and at least one of the devices105(e.g., device105-b) based at least in part on monitoring and controlling of the traffic associated with the cloud application.

The cloud application isolation portal140in combination with the cloud access security broker145may identify traffic associated with the cloud application between the cloud application and at least one of the devices105, and isolate the traffic associated with the cloud application to the cloud application isolation portal140during the session. Here, the cloud application isolation portal140may manage, with the cloud access security broker145, the session between the cloud application and at least one of the devices105based at least in part on the isolating. In some examples, the cloud application isolation portal140in combination with the cloud access security broker145may render to a browser of at least one of the devices105the cloud application or the traffic associated with the cloud application, or both to provide a seamless user experience and mirror an interface of the cloud application to prevent potential data leakage. In some examples, cloud application isolation portal140in combination with the cloud access security broker145may render the cloud application or the traffic associated with the cloud application, or both, to the browser of the device105based at least in part on a forward proxy mode. The cloud application isolation portal140in combination with the cloud access security broker145may prevent one or more of the devices105from processing locally the traffic associated with the cloud application based at least in part on the isolating the cloud application from at least one of the devices105.

As such, the cloud application isolation portal140with the cloud access security broker145may allow a device105to connect to a cloud application through a browser. Once the cloud application identifies an end user (or device105), the cloud application may redirect the browser to a configured single-sign on resource. For example, a security assertion markup language (SAML) proxy. The SAML proxy may identify the end user (or the device105) and redirect this information to a network entity (e.g., Identity Provider) to authenticate the end user (or the device105) before being redirected to the cloud application isolation portal140. Additionally or alternatively, the SAML proxy may identify metadata associated with an end user and/or device (e.g., browser type, browser version, device operating system, device processor type or related processor information, media access control (MAC) address, IP address, etc.) and may send at least a part of this metadata to the network entity (e.g., Identity Provider) to authenticate the end user (or device105). The cloud application isolation portal140may then use the credentials of the request and establish a connection with the cloud application on behalf of the browser of the device105. From that point the cloud application isolation instance may leverage the cloud application isolation portal140and the cloud access security broker145(e.g., forward proxy mode) to access and control the cloud application.

By running a cloud application in isolation, the techniques described herein enables the cloud application isolation portal140and the cloud access security broker145to treat the isolation instance like an endpoint and therefore support any number of cloud-based applications. As an example, the present techniques are an improvement over existing techniques that use a reverse proxy and limit the number of simultaneous instances that may be ran at a given time. Another benefit of isolating the cloud application traffic is that the rendering of the cloud application and data is contained and controlled within the cloud application isolation portal140. This enables the techniques described herein to prevent client-side processing of any data, as the cloud application isolation portal140is a remotely controlled instance.

The cloud application isolation portal140with the cloud access security broker145may support post authentication (e.g., post Identity Provider), for example, when the device105may post an SAML response into the cloud application isolation portal140(e.g., a mirror gateway backend (e.g., SAML proxy)), and being capable of responding and opening a data session associated with the cloud application to the device105while the cloud application isolation portal140takes over the credentialed request to the cloud application to render the application in isolation to enforce security policies. As a result, the techniques described herein may protect and control an organizations' data regardless of what browsing device is interacting with a cloud application, and prevent any sensitive data from remaining on the devices105(i.e. cloud data remaining in the browser cache of a device105) to prevent potential data leakage.

Accordingly, the techniques described herein beneficially provide improvements to securing cloud applications to decrease or mitigate data loss and protect devices105against data leakage and malicious attacks. Furthermore, the techniques described herein provide improvements to the operation of the devices105. For example, by securing cloud applications and mitigating potential security risks of malicious entities embedding malware onto a device, the operating characteristics such as processer usage and memory usage of the devices105may be conserved. In addition, the techniques described herein may improve security of cloud applications, cloud application traffic data, cloud-based services, cloud-based subscriptions, and the like.

FIG.2illustrate a process flow200that supports securing cloud applications in accordance with aspects of the present disclosure. In some examples, the process flow200may implement aspects of the environment100. The process flow200may include a device205, a cloud applications isolation portal210, a cloud access security broker215, and a cloud platform220, which may be examples of the corresponding devices described with reference toFIGS.1,3through6,10, and11.

In the following description of the process flow200, the operations between the device205, the cloud applications isolation portal210, the cloud access security broker215, and the cloud platform220may be transmitted in a different order than the exemplary order shown, or the operations performed by the device205, the cloud applications isolation portal210, the cloud access security broker215, and the cloud platform220may be performed in different orders or at different times. Certain operations may also be left out of the process flow200, or other operations may be added to the process flow200.

At225, the device205may submit (e.g., transmit) a request to the cloud platform220to access a cloud application. For example, the device205may submit the request to access the cloud application via a browser of the device205. At230, the cloud platform220may redirect the device205to a single sign-on resource. For example, upon the cloud application identifying the device205, the cloud platform220may redirect a browser of the device205to a configured single sign-on resource.

At235, the device205may provide a set of credentials (e.g., username, password, a personal identification code, biometric information, two-factor authentication, or any combination thereof) to the single sign-on resource, which may be a SAML proxy. The SAML proxy may identify the device205, as well as metadata, and redirect this information to an identity provider, which may authenticate an end user of the device205(e.g., authenticate credentials provided by the end user) before redirecting the device205to the cloud application isolation portal210. At240, the cloud application isolation portal210may receive the set of credentials associated with the request. At245, cloud application isolation portal210may establish a connection with the cloud access security broker215and the cloud platform220(e.g., the cloud application for which the device205is requesting access to) based at least in part on the received credentials.

At250, the cloud platform220may communicate traffic (e.g., cloud application traffic) to the cloud access security broker215. In some cases, the cloud access security broker215may monitor the traffic to assess the traffic and apply security policies according to the policies associated with the authenticated end user. At255, the cloud application isolation portal210and the cloud access security broker215may manage the traffic before providing it to the device205. At260, the cloud application isolation portal210may provide the traffic associated with the cloud application to the device205. For example, the cloud application isolation portal210may provide an interface to a browser of the device205that emulates an interface of the cloud application.

Benefits of the process flow200may include eliminating disadvantages of existing techniques for securing cloud applications (e.g., data leakage, limited number of simultaneous instances, etc.). For example, benefits of the process flow200may include enabling devices (e.g., an end user terminal, a server, a network entity, and the like) to secure data sessions associated with cloud application from an unmanaged device by isolating the data session associated with the cloud application to a cloud application isolation portal residing remotely from the unmanaged device. The process flow200may also include preventing the unmanaged device from performing client-side processing of data associated with the data session (e.g., data of cloud platform220).

FIG.3shows a block diagram300of a device305that supports securing cloud applications in accordance with aspects of the present disclosure. The device305may be an example of aspects of a device as described herein. The device305may include a receiver310, an application isolation manager315, and a transmitter320. The device305may also include a processor. Each of these components may be in communication with one another (e.g., via one or more buses).

The receiver310may receive information such as packets, user data, or control information associated with various information channels (e.g., control channels, data channels, and information related to cloud applications, etc.). Information may be passed on to other components of the device305. The receiver310may be an example of aspects of the transceiver620described with reference toFIG.6. The receiver310may utilize a single antenna or a set of antennas.

The application isolation manager315may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

The transmitter320may transmit signals generated by other components of the device305. In some examples, the transmitter320may be collocated with a receiver310in a transceiver module. For example, the transmitter320may be an example of aspects of the transceiver620described with reference toFIG.6. The transmitter320may utilize a single antenna or a set of antennas.

FIG.4shows a block diagram400of a device405that supports securing cloud applications in accordance with aspects of the present disclosure. The device405may be an example of aspects of a device305or a device as described herein. The device405may include a receiver410, an application isolation manager415, and a transmitter420. The device405may also include a processor. Each of these components may be in communication with one another (e.g., via one or more buses).

The receiver410may receive information such as packets, user data, or control information associated with various information channels (e.g., control channels, data channels, and information related to cloud applications, etc.). Information may be passed on to other components of the device405. The receiver410may be an example of aspects of the transceiver620described with reference toFIG.6. The receiver410may utilize a single antenna or a set of antennas.

The application isolation manager415may be an example of aspects of the application isolation manager315as described herein. The application isolation manager415may include a connection component425and a management component430. The application isolation manager415may be an example of aspects of the application isolation manager610described herein.

The connection component425may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application. The management component430may manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application. In some examples, the cloud access security broker in communication with the cloud application isolation portal and the cloud application may monitor and control traffic associated with the cloud application. In these examples, the management component430may manage, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user is further based at least in part on monitoring and controlling of the traffic associated with the cloud application.

The transmitter420may transmit signals generated by other components of the device405. In some examples, the transmitter420may be collocated with a receiver410in a transceiver module. For example, the transmitter420may be an example of aspects of the transceiver620described with reference toFIG.6. The transmitter420may utilize a single antenna or a set of antennas.

FIG.5shows a block diagram500of an application isolation manager505that supports securing cloud applications in accordance with aspects of the present disclosure. The application isolation manager505may be an example of aspects of an application isolation manager315, an application isolation manager415, or an application isolation manager610described herein. The application isolation manager505may include a connection component510, a management component515, a traffic component520, and a rendering component525. Each of these components may communicate, directly or indirectly, with one another (e.g. via one or more buses).

The connection component510may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application. The connection component510may receive the set of credentials associated with the end user of the cloud application based at least in part on the cloud application receiving a request via a browser of the computing device associated with the end user to access the cloud application. In some examples, the cloud application forwards the browser of the computing device associated with the end user to a single sign-on resource based at least in part on an identifier of the computing device or an identifier of the end user, or both. In some examples, the single sign-on resource may include a proxy. In some examples, the single sign-on resource forwards the identifier of the computing device, the identifier of the end user, metadata, or a combination thereof, to an identity provider network entity to authenticate the set of credentials. The cloud application isolation portal may reside remotely from the computing device associated with the end user.

The management component515may manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application. In some examples, the cloud access security broker in communication with the cloud application isolation portal and the cloud application may monitor and control traffic associated with the cloud application. In these examples, the management component515may manage, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user is further based at least in part on monitoring and controlling of the traffic associated with the cloud application. The management component515may prevent the computing device associated with the end user to process the traffic associated with the cloud application based at least in part on the isolating. In these examples, the management component515may manage, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user is further based at least in part on the preventing.

The traffic component520may identify traffic associated with the cloud application between the cloud application and the computing device associated with the end user, and isolate the traffic associated with the cloud application to the cloud application isolation portal during the session. In these examples, the management component515may manage, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user is further based at least in part on the isolating.

The rendering component525may render, to a browser of the computing device associated with the end user and via the cloud application isolation portal, the cloud application or the traffic associated with the cloud application, or both. In these examples, the management component515may manage, via the cloud application isolation portal and the cloud access security broker, the session between the cloud application and the computing device associated with the end user may be further based at least in part on the rendering. In some examples, rendering, via the cloud application isolation portal, the cloud application or the traffic associated with the cloud application, or both, to the browser of the computing device associated with the end user is based at least in part on a forward proxy mode. The rendering component525may provide an interface to a browser of the computing device associated with the end user. In some cases, the interface emulates an interface of the cloud application.

FIG.6illustrates a block diagram of a system600including a device605that supports securing cloud applications in accordance with aspects of the present disclosure. The device605may be an example of or include components of device305,405, or a device as described herein, for example, such as a server (e.g., a cloud application isolation portal). The device605may include components for bi-directional data communications including components for transmitting and receiving data communications, including an application isolation manager610, an I/O controller615, a transceiver620, an antenna625, a memory630, and a processor640. These components may be in electronic communication via one or more buses (e.g., bus645).

The application isolation manager610may establish a connection between the device605(e.g., a cloud application isolation portal), a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and manage, via the device605(e.g., a cloud application isolation portal) and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

The I/O controller615may manage input and output signals for the device605. The I/O controller615may also manage peripherals not integrated into the device605. In some cases, the I/O controller615may represent a physical connection or port to an external peripheral. In some cases, the I/O controller615may utilize an operating system such as iOS, ANDROID, MS-DOS, MS-WINDOWS, OS/2, UNIX, LINUX, or another known operating system. In other cases, the I/O controller615may represent or interact with a modem, a keyboard, a mouse, a touchscreen, or a similar device. In some cases, the I/O controller615may be implemented as part of a processor. In some cases, a user may interact with the device605via the I/O controller615or via hardware components controlled by the I/O controller615.

The transceiver620may communicate bi-directionally, via one or more antennas, wired, or wireless links as described above. For example, the transceiver620may represent a wireless transceiver and may communicate bi-directionally with another wireless transceiver. The transceiver620may also include a modem to modulate packets (e.g., associated with cloud application traffic) and provide the modulated packets (e.g., associated with cloud application traffic) to the antennas for transmission, and to demodulate packets (e.g., associated with cloud application traffic) received from the antennas. In some examples, the device605may include a single antenna625. However, in some examples the device605may have more than one antenna625, which may be capable of concurrently transmitting or receiving multiple wireless transmissions.

The memory630may include a read-only memory (ROM), flash memory, a random-access memory (RAM), a flash RAM, or the like. The memory630may store computer-readable, computer-executable code including instructions that, when executed, cause the processor to perform various functions described herein. In some cases, the memory620may contain, among other things, a BIOS which may control basic hardware or software operation such as the interaction with peripheral components or devices.

The code635may include instructions to implement aspects of the present disclosure, including instructions to support securing cloud applications. The code635may be stored in a non-transitory computer-readable medium such as system memory or other type of memory. In some cases, the code635may not be directly executable by the processor640but may cause a computer (e.g., when compiled and executed) to perform functions described herein.

The processor640may include an intelligent hardware device, (e.g., a general-purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some cases, the processor640may be configured to operate a memory array using a memory controller. In other cases, a memory controller may be integrated into the processor640. The processor640may be configured to execute computer-readable instructions stored in a memory (e.g., the memory630) to cause the device605to perform various functions (e.g., functions or tasks supporting securing cloud applications).

FIG.7shows a flowchart illustrating a method700that supports securing cloud applications in accordance with aspects of the present disclosure. The operations of method700may be implemented by a device or its components described herein. For example, the operations of method700may be performed by an application isolation manager (e.g., a cloud application isolation portal) as described with reference toFIGS.3through6. In some examples, a device may execute a set of instructions to control the functional elements of the device to perform the functions described below. Additionally, or alternatively, a device may perform aspects of the functions described below using special-purpose hardware. In the following description of the method700, the operations may be performed in a different order than the exemplary order shown, or the operations may be performed in different orders or at different times. Certain operations may also be omitted from the method700, and/or other operations may be added to the method700.

At705, the device (e.g., a cloud application isolation portal) may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application. The operations of705may be performed according to the methods described herein. In some examples, aspects of the operations of705may be performed by a connection component as described with reference toFIGS.4and5.

At710, the device (e.g., a cloud application isolation portal) may manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application. The operations of710may be performed according to the methods described herein. In some examples, aspects of the operations of710may be performed by a management component as described with reference toFIGS.4and5.

Benefits of the method700may include enabling a device (e.g., an end user terminal, a server, a network entity, and the like) to secure data sessions associated with a cloud application from an unmanaged device by isolating the data session associated with the cloud application to a cloud application isolation portal. Other benefits of the method700may further include preventing client-side processing of any data associated with the data session.

FIG.8shows a flowchart illustrating a method800that supports securing cloud applications in accordance with aspects of the present disclosure. The operations of method800may be implemented by a device or its components described herein. For example, the operations of method800may be performed by an application isolation manager (e.g., a cloud application isolation portal) as described with reference toFIGS.3through6. In some examples, a device may execute a set of instructions to control the functional elements of the device to perform the functions described below. Additionally, or alternatively, a device may perform aspects of the functions described below using special-purpose hardware. In the following description of the method800, the operations may be performed in a different order than the exemplary order shown, or the operations may be performed in different orders or at different times. Certain operations may also be omitted from the method800, and/or other operations may be added to the method800.

At805, the device (e.g., a cloud application isolation portal) may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application. The operations of805may be performed according to the methods described herein. In some examples, aspects of the operations of805may be performed by a connection component as described with reference toFIGS.4and5.

At810, the device (e.g., a cloud application isolation portal) may manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application The operations of810may be performed according to the methods described herein. In some examples, aspects of the operations of810may be performed by a management component as described with reference toFIGS.4and5.

At815, the device (e.g., a cloud application isolation portal) may identify traffic associated with the cloud application between the cloud application and the computing device associated with the end user. The operations of815may be performed according to the methods described herein. In some examples, aspects of the operations of815may be performed by a traffic component as described with reference toFIG.5.

At820, the device (e.g., a cloud application isolation portal) may isolate the traffic associated with the cloud application to the cloud application isolate portal during the session. The operations of820may be performed according to the methods described herein. In some examples, aspects of the operations of820may be performed by a management component as described with reference toFIGS.4and5.

At825, the device (e.g., a cloud application isolation portal) may render, to a browser of the computing device associated with the end user and via the cloud application isolation portal, the cloud application or the traffic associated with the cloud application, or both. The operations of825may be performed according to the methods described herein. In some examples, aspects of the operations of825may be performed by a rendering component as described with reference toFIG.5.

Benefits of the method800may include enabling a device (e.g., an end user terminal, a server, a network entity, and the like) to secure data sessions associated with a cloud application from an unmanaged device by isolating the data session associated with the cloud application to a cloud application isolation portal residing remotely from the unmanaged device. Further benefits of the method800may include providing an interface to a browser of the unmanaged device that emulates an interface of the cloud application. Other benefits of the method800may further include rendering of the cloud application and cloud application traffic within the cloud application isolation portal, as well as additionally controlling the cloud application traffic within the cloud application isolation portal, thereby preventing client-side processing of any data associated with the data session.

FIG.9shows a flowchart illustrating a method900that supports securing cloud applications in accordance with aspects of the present disclosure. The operations of method900may be implemented by a device or its components described herein. For example, the operations of method900may be performed by an application isolation manager (e.g., a cloud application isolation portal) as described with reference toFIGS.3through6. In some examples, a device may execute a set of instructions to control the functional elements of the device to perform the functions described below. Additionally, or alternatively, a device may perform aspects of the functions described below using special-purpose hardware. In the following description of the method900, the operations may be performed in a different order than the exemplary order shown, or the operations may be performed in different orders or at different times. Certain operations may also be omitted from the method900, and/or other operations may be added to the method900.

At905, the device (e.g., a cloud application isolation portal) may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application. The operations of905may be performed according to the methods described herein. In some examples, aspects of the operations of905may be performed by a connection component as described with reference toFIGS.4and5.

At910, the device (e.g., a cloud application isolation portal) may manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application. The operations of910may be performed according to the methods described herein. In some examples, aspects of the operations of910may be performed by a management component as described with reference toFIGS.4and5.

At915, the device (e.g., a cloud application isolation portal) may identify traffic associated with the cloud application between the cloud application and the computing device associated with the end user. The operations of915may be performed according to the methods described herein. In some examples, aspects of the operations of915may be performed by a traffic component as described with reference toFIG.5.

At920, the device (e.g., a cloud application isolation portal) may isolate the traffic associated with the cloud application to the cloud application isolate portal during the session. The operations of920may be performed according to the methods described herein. In some examples, aspects of the operations of920may be performed by a management component as described with reference toFIGS.4and5.

At925, the device (e.g., a cloud application isolation portal) may prevent the computing device associated with the end user to process the traffic associated with the cloud application based at least in part on the isolating. The operations of925may be performed according to the methods described herein. In some examples, aspects of the operations of925may be performed by a management component as described with reference toFIGS.4and5.

Benefits of the method900may include enabling a device (e.g., an end user terminal, a server, a network entity, and the like) to secure data sessions associated with cloud application from an unmanaged device by isolating the data session associated with the cloud application to a cloud application isolation portal residing remotely from the unmanaged device. Further benefits of the method900may include preventing the unmanaged device from performing client-side processing of any data associated with the data session.

FIG.10illustrates a block diagram of a computing system1000that supports securing cloud applications in accordance with aspects of the present disclosure. For example, all or a portion of the computing system1000may perform and be a means for performing, either alone or in combination with other elements, one or more of the operations described herein (such as one or more of the operations as described inFIGS.1through9). All or a portion of the computing system1000may also perform or be a means for performing any other operations, methods, or processes described and illustrated herein.

The computing system1000may be any single or multi-processor computing device or system capable of executing computer-readable instructions. The computing system1000may be an example of the computing device105or the server120as described with reference toFIG.1. For example, the computing system1000may include, but is not limited to, workstations, laptops, client-side terminals, servers, distributed computing systems, handheld devices, or any other computing system or device.

In some cases, the computing system1000may include at least one central processor1010and a system memory1015. The central processor1010may include any type or form of physical processing unit (e.g., a hardware-implemented central processing unit) capable of processing data or interpreting and executing instructions. In some cases, the central processor1010may receive instructions from a computer software application. These instructions may cause the central processor1010to perform the functions of one or more of the exemplary cases described and illustrated herein. The system memory1015may include any type or form of volatile or non-volatile storage device or medium capable of storing data and other computer-readable instructions. Examples of the system memory1015include Random Access Memory (RAM), Read Only Memory (ROM), flash memory, or any other suitable memory device. In one example, an application isolation manager, as described with reference toFIGS.1through9, may be loaded into the system memory1015.

In some cases, the computing system1000may include a bus1005which interconnects major subsystems of the computing system1000, such as the central processor1010, the system memory1015, an input/output controller1020, an external audio device, such as a speaker system1025via an audio output interface1030, an external device, such as a display screen1035via display adapter1040, an input device1045(e.g., remote control device interfaced with an input controller1050), multiple USB devices1065(interfaced with a universal serial bus (USB) controller1070), and a storage interface1080. Also included are at least one sensor1055connected to the bus1005through a sensor controller1060and a network interface1085(coupled directly to bus1005).

The bus1005allows data communication between the central processor1010and the system memory1015, which may include ROM or flash memory, and RAM, as previously noted. The RAM is generally the main memory into which the operating system and application programs are loaded. The ROM or flash memory may contain, among other code, BIOS or UEFI, which controls basic hardware operation such as the interaction with peripheral components or devices. Applications (e.g., the applications110) resident with the computing system1000are generally stored on and accessed via a non-transitory computer readable medium, such as a hard disk drive (e.g., a fixed disk1075) or other storage medium. Additionally, applications may be in the form of electronic signals modulated in accordance with the application and data communication technology when accessed via the interface1085.

The storage interface1080, as with the other storage interfaces of the computing system1000, may connect to a standard computer readable medium for storage and/or retrieval of information, such as the fixed disk drive1075. The fixed disk drive1075may be a part of the computing system1000or may be separate and accessed through other interface systems. The network interface1085may provide a direct connection to a remote server via a direct network link to the Internet via a POP (point of presence). The network interface1085may provide such connection using wireless techniques, including digital cellular telephone connection, Cellular Digital Packet Data (CDPD) connection, digital satellite data connection, or the like.

Conversely, all of the devices shown inFIG.10need not be present to practice the present techniques. The devices and subsystems may be interconnected in different ways from that shown inFIG.10. The aspect of some operations of a system such as that shown inFIG.10are readily known in the art and are not discussed in detail in this application. Code to implement the present disclosure may be stored in a non-transitory computer-readable medium such as one or more of the system memory1015or the fixed disk1075. The operating system provided on the computing system1000may be iOS, ANDROID, MS-DOS, MS-WINDOWS, OS/2, UNIX, LINUX, or another known operating system.

The signals associated with the computing system1000may include wireless communication signals such as radio frequency, electromagnetics, local area network (LAN), wide area network (WAN), metropolitan area network (MAN), virtual private network (VPN), wireless network (using 802.11, for example), cellular network (using 3G, Long Term Evolution (LTE), Next Generation 5G new radio (NR) for example), and/or other signals. The network interface1085may enable one or more of WWAN (GSM, CDMA, and WCDMA), WLAN (including BLUETOOTH and Wi-Fi), WMAN (WiMAX) for mobile communications, antennas for Wireless Personal Area Network (WPAN) applications (including RFID and UWB), etc.

The I/O controller1020may operate in conjunction with the network interface1085or the storage interface1080, or both. The network interface1085may enable the computing system900with the ability to communicate with client devices (e.g., device105ofFIG.1), or other devices over the network110ofFIG.1, or both. The network interface1085may provide wired or wireless network connections, or both. In some cases, the network interface1085may include an Ethernet adapter or Fiber Channel adapter. The storage interface1080may enable the computing system1000to access one or more data storage devices. The one or more data storage devices may include two or more data tiers each. The storage interface1080may include one or more of an Ethernet adapter, a Fiber Channel adapter, Fiber Channel Protocol (FCP) adapter, a SCSI adapter, and iSCSI protocol adapter.

FIG.11illustrates a block diagram of an exemplary network architecture1100in which client systems1105,1110, and1115and servers1120-aand1120-bmay be coupled to a network1130to support securing cloud applications, in accordance with aspects of the present disclosure. As provided above, all or a portion of the network architecture1100may perform or be a means for performing, either alone or in combination with other elements, one or more of the operations disclosed herein (such as one or more of the operations illustrated inFIGS.1through10). All or a portion of network architecture1100may also be used to perform or be a means for performing other operations and features set forth in the present disclosure.

The client systems1105,1110, and1115may represent any type or form of computing device or system, such as exemplary in the computing system1000inFIG.10. Similarly, the servers1120-aand1120-bmay represent computing devices or systems, such as application servers or database servers, configured to provide various database services and run software applications. The network1130may represent any telecommunication or computer network including, for example, an intranet, a WAN, a LAN, a Personal Area Network (PAN), a cellular network (e.g., LTE, LTE-Advanced (LTE-A), Next Generation 5G NR network, or the Internet. In some cases, the client systems1105,1110, and1115and the server1120-aor1120-bmay include all or a portion of the environment100fromFIG.1.

The application isolation manager, as described with reference toFIGS.1through10, may be located within one of the client systems1105,1110, or1115, or any combination thereof to implement the present techniques. For example, the application isolation manager may establish a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based at least in part on an indication of the cloud application and a set of credentials associated with an end user of the cloud application and manage, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based at least in part on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application. In some cases, the application isolation manager may isolate traffic associated with the cloud application to the cloud application isolation portal during the session. Alternatively, the application isolation manager, as described with reference toFIGS.1through10, may optionally be located within one of the server1120-aor the server1120-bto implement the present techniques.

The server1120-ais further depicted as having storage devices1125-a-1through1125-a-jdirectly attached, and server1120-bis depicted with storage devices1125-b-1through1125-b-kdirectly attached. SAN fabric1140supports access to storage devices1135-1through1135-mby servers1120-aand1120-b, and so by the client systems1105,1110, and1115via the network1130. Intelligent storage array1145is also shown as an example of a specific storage device accessible via SAN fabric1140. With reference to the computing system1000, the network interface1085or some other means or method may be used to provide connectivity from each of the client systems1105,1110, and1115to the network1130.

With reference to the computing system600, the transceiver625or some other means or method may be used to provide connectivity from each of the client systems1105,1110, and1115to the network1130. The client systems1105,1110, and1115are able to access information on the server1120-aor the server1120-busing, for example, a web browser or other client software. Such a client allows the client systems1105,1110, and1115to access data hosted by the server1120-aor1120-bor one of the storage devices1125-a-1through1125-a-j,1125-b-1through1125-b-k,1135-1through1135-m, or the intelligent storage array1145.FIG.11depicts the use of a network such as the Internet for exchanging data, but the present techniques are not limited to the Internet or any particular network-based environment.

In some cases, all or a portion of one or more of the exemplary cases disclosed herein may be encoded as a computer program and loaded onto and executed by the server1120-aor server1120-b, or the storage devices1125-a-1through1125-a-j, the storage devices1135-1through1135-m, the intelligent storage array1145, or any combination thereof. All or a portion of one or more of the exemplary cases disclosed herein may also be encoded as a computer program, run by the server1120-aor the stored in server1120-b, and distributed to the client systems1105,1110, and1115over the network1130. As detailed above, the computing system1000and/or one or more components of the network architecture1100may perform and/or be a means for performing, either alone or in combination with other elements, one or more operations of an exemplary method for securing cloud applications from computing devices.

Furthermore, while various cases have been described and/or illustrated herein in the context of fully functional computing systems, one or more of these exemplary cases may be distributed as a program product in a variety of forms, regardless of the particular type of computer-readable media used to actually carry out the distribution. The cases disclosed herein may also be implemented using software components that perform certain tasks. These software components may include script, batch, or other executable files that may be stored on a computer-readable storage medium or in a computing system. In some cases, these software components may configure a computing system to perform one or more of the exemplary cases disclosed herein.

The foregoing description, for purpose of explanation, has been described with reference to specific cases. However, the illustrative discussions above are not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations are possible in view of the above teachings. The cases were chosen and described in order to best explain the principles of the present techniques and their practical applications, to thereby enable others skilled in the art to best utilize the present techniques and various cases with various modifications as may be suited to the particular use contemplated.

Unless otherwise noted, the terms “a” or “an,” as used in the specification and claims, are to be construed as meaning “at least one of.” In addition, for ease of use, the words “including” and “having,” as used in the specification and claims, are interchangeable with and have the same meaning as the word “comprising.” In addition, the term “based on” as used in the specification and the claims is to be construed as meaning “based at least upon.”

As used herein, the term “security action” may refer to any number of actions the systems described herein may take after determining a packet injection. For example, types of security actions may include preventing the packet from performing any actions on the computing device, alerting an administrator to the potential maliciousness of the connection, quarantine a file related to the connection, delete the file, block a download of the file, and/or warn a user about the connection. In addition, the systems described herein may perform a security action on objects other than a file. For example, the systems described herein may blacklist malicious URLs and/or IP addresses. Thus, the security actions in conjunction with the methods and systems described herein may improve the security and operating integrity of one or more computing devices by protecting the hardware, firmware, software, or any combination thereof of the one or more computing devices from malicious attack. It should be appreciated that these are not exhaustive lists of the types of security actions which may be performed by the systems described herein. Other security actions are also included in this disclosure.