Patent ID: 12231433

In the appended figures, similar components and/or features may have the same reference label. Further, various components of the same type may be distinguished by following the reference label by a dash and a second label that distinguishes among the similar components. If only the first reference label is used in the specification, the description is applicable to any one of the similar components having the same first reference label irrespective of the second reference label.

DETAILED DESCRIPTION

The ensuing description provides preferred exemplary embodiment(s) only, and is not intended to limit the scope, applicability or configuration of the disclosure. Rather, the ensuing description of the preferred exemplary embodiment(s) will provide those skilled in the art with an enabling description for implementing a preferred exemplary embodiment. It is understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope as set forth in the appended claims.

Referring first toFIG.1, a block diagram of an embodiment of a policy-based security system100is shown. The policy-based security system100(or policy controlled communication system) includes client device(s)102, a web server104, end user(s)106, a mid-link server108, a policy store110(or a policy component), and services112. The client device(s)102such as smartphones, tablets, PCs, and any other computers communicate with the web server104over encryption links using the internet. The encryption links deliver cloud services to the client device(s)102. The client device(s)102can be secured by using the mid-link server108that remotely hosts the software environment that is secured. The client device(s)102run on any popular operating system (OS) such as Windows™, iOS™, Android™, Linux, set-top box OSes such as Real-Time Operating System (RTOS), Unix OS, Linux-Kernel, and Linux OS in the Internet of Things (IoT)/Industrial control systems (ICS)/Distributed Control Systems (DCS)/Operational Technology (OT), and Chromebook™. Third-party apps are applications running on the operating system of the client device(s)102. The policy store110holds policies for each client device(s)102and the mid-link server108.

The client device(s)102use content and processing from the web server104including content sites for example, web sites, streaming content, etc., and the services112for example, SaaS tools, databases, cloud service providers, etc. Under policy control, the client device(s) 102 routes some interaction to the mid-link server108that hosts a controlled software environment for each end user106to securely interact with the web server104and the services112or enterprise tools in a way limited by specified policies. For example, policies can specify configuration settings of encryption protocols and secure tunnels that are used for establishing a secure connection between the client device(s)102and the web server104while using the controlled software environment by remote access.

Policies control the manner in which the content is accessed, stored, processed, printed, stored, forwarded, emailed, or otherwise captured at the client device(s)102. Other policies can enable certain software or interaction on the client device(s)102while physically on-premise and allowing different software or interaction while working in the field or at home away from the enterprise premises. In one example, policy on the client device(s)102, cut-and-paste to/from the remote software environment can be disabled for some or all applications when accessed from the client device(s)102on a specific encryption link to the web server104. In some cases, enforcement of the policy depends on whether the client device(s)102is within the enterprise or away from the office. The encryption link provides communication along with a network in an encrypted manner. The encryption link uses protocols for establishing secure links between the client device(s)102and the content sites of the web server104. For example, Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), or any other encryption protocols are used for establishing authenticated and encrypted links between the client device(s)102and the web server104. The policies can specify a direct link between the client device(s)102and the web server104if the client device(s)102meet encryption protocol standards like TLS or SSL. If the client device(s)102do not meet the encryption protocol standards but still need secure web access, then the policies protect the client device(s)102via a secure tunnel. One or more secure tunnels are configured between the client device(s)102and the mid-link server108to provide secure access to such client device(s)102that do not meet the encryption protocol standards. The secure tunnels between the client device(s)102and the mid-link server108are dedicated for secure connections and offer protection to the communication. An example of the policies is illustrated in Table 1 discussed below.

Table 1 below illustrates a list of policies, a list of parameters, and corresponding connection links stored in the policy store110. The connection links are used for establishing connections using encryption protocols.

TABLE 1PoliciesParametersConnectionsPolicy 1User ConnectionSSL3.0/TLS 1.1/TLS1.2/HTTP 2.0 connectionPolicy 2Destination ConnectionTLS 1.2/HTTPS connectionPolicy 3Source, Source LocationTLS 1.1, TLS 1.2connectionPolicy 4Destination, DestinationTLS 1.3 connectionLocationPolicy 5User ApplicationSSL 3.0/TLS 1.1/TLS1.2/TLS1.3 connection/HTTPSPolicy 6Destination ApplicationTLS 1.3/TLS 1.3PFS connectionPolicy 7Data Classification: secret,TLS 1.3 connectionconfidential, encryptedPolicy 8Data Type: text/html,TLS 1.1/TLS 1.2video/mpeg, image/png,connectiontext/css, audio/basicPolicy 9User groups, UEBA,TLS 1.2/HTTP 1.0/1.1/metadata, user role1.2/2/0 connectionPolicy 10Encryption Type:TLS 1.3 connectionAES, DES, RSAPolicy 11Performance Parameters:TLS 1.2/TLS 1.3latency, bandwidth,connectionthroughputPolicy 12User/Destination connection,Secure TunnelsSource/Destination/Geolocations/User/Source/DestinationApplication, UEBA, DataType/Classification,Encryption Type,Performance Parameters

As illustrated in Table 1, the policies are specified with respective parameters and connections. For example, Policy1is associated with user connection at the client device(s)102which has respective SSL 3.0/TLS 1.1/TLS 1.2/HTTP 2.0 connections. That is based on the user connection, the policy requires a connection when the encryption protocols of the encryption links are one of SSL 3.0, TLS 1.1, TLS 1.2, or HTTP 2.0 connections else connection is established through the secure tunnel comprising HTTP or HTTPS connection. HTTP 2.0 connection is used when other connections like SSL 3.0/TLS 1.1/TLS 1.2 are not available. The secure tunnels are used when the client device(s)102do not meet the security standards of encryption protocols like TLS or SSL as described in policy12. In another embodiment, when the connections are not met at the encryption links, an alert can be notified to an administrator or the end user106of the client device(s)102that the encryption link does not meet the policy1and therefore, a connection is unable to be established or the secure tunnel is used for the connection.

The web server104includes the content sites such as web sites, streaming content, etc. in order to provide content to the client device(s)102. The web server104also allows the end user(s)106of the client device(s)102to upload and download content from the content sites. The web server104is in communication with the client device(s)102through the mid-link server108over the internet. In another embodiment, the policy-based security system100includes one or more application servers (not shown) for providing dynamic content to the client device(s)102.

The mid-link server108for the work systems resides as a “man-in-the-middle” intentionally take over some or all: processing, application execution and/or content sites at the web server104and the services112interaction. The remote software environment is hosted by the mid-link server108for a policy-controlled experience using the policy store110for direction. Provisioning the policies between the client device and the web server is performed on the mid-link server108. For example, the content sites at the web server104can have certain features disabled, filtered or modified by the mid-link server108so that the client device(s)102behaves as if it were to directly connect to the content sites of the web server104. For example, a policy can specify connection using Transport Layer Security (TLS)1.3session links.

Some embodiments have policies that selectively direct traffic to the mid-link server108based on a label or tag of the content. A classifier can identify the label or the tag of the content. For example, the content can be classified as confidential, encrypted, restricted, public, or any other type associated with the content. For example, a secret document, encrypted file, or zipped folder is being transmitted by the client device(s)102to the content site of the web server104. By way of another example, a file labeled as “secret” that is the secret document can be shared from the client device102on a TLS 1.3 perfect-forward-secrecy (PFS) encryption link. If the encryption link does not meet the policy requiring TLS 1.3 PFS encryption link, the document is not shared from the client device(s)102and the connection is established to the content site of the web server104via the secure tunnel including HTTP/HTTPS connection. In another embodiment, a policy can be established for allowed usage based on established security protocols. In yet another embodiment, based on a highly confidential document for sharing and the employee sharing the document being a junior level associate, even though the TLS 1.0 connection might be available as per the policy, the connection is established through the secure tunnel as it offers better security than the TLS 1.0. The policy may be modified based on the type of confidential document. In another embodiment, a president sharing the highly confidential document within office premises may be allowed to use the TLS 1.0 connection based on the policies.

The policy store110is a database that includes set of predefined policies for content sharing. The policy store110also includes parameters associated with the policies. The parameters include a user connection, content type, a destination application, data classification, a data type, a type of shared content, the confidentiality of the shared content, network data traffic, user role, user groups, tags, encryption type, application type, user's geographical location, protocol type, algorithm, threat, metadata, user and entity behavior analytics (UEBA) information, residency, and/or type of user connection, and/or performance. Performance parameters include latency, bandwidth, or throughput. The policies are defined based on the parameters. For example, a policy for an end user A in department XYZ of the enterprise restricts the communication from the client device(s)102on TLS 1.2 encryption links. Further, the end user A is barred from sending files labeled as “secret” and “confidential” to unauthenticated users outside of the enterprise network, the connection in this case can be established through the secure tunnels.

In an embodiment, the policy-based security system100allows multiple-tenants in different domains to communicate with the web server104over the internet such as cloud-based multi-tenant systems. The policy-based security system100allows multiple tenants or enterprises (not shown) to all use the same network separated by domain or some other logical separation. Encryption, leased/encrypted tunnels, firewalls, and/or gateways can be used to keep the data from one enterprise separate from other enterprises. Each client device(s)102can communicate with the web server104for services and storage using the internet. The mid-link server108provides multi-tenancy control, policies and routing for each domain.

Referring toFIG.2, this embodiment of the client device102uses a client210to establish connections with the mid-link server108. A remote app206uses the client210to communicate with the mid-link server108to maintain security for the operation of the remote app206. An endpoint tunnel216(or a client endpoint) digitally segregates the traffic using protocols and/or encryption to avoid interception over the Local Area Network (LAN)204and Internet. Certain embodiments could use the SSL/TLS, HTTP, and/or HTTPS or a VPN to secure the endpoint tunnel216. The client210communicates with the mid-link server108either via the secure tunnel configured from the endpoint tunnel216or a direct link. The direct link is used when the client device102meets security standards of the encryption protocols like TLS or SSL. The direct link establishes a session for the client device102with the web server104using the encryption protocols. The secure tunnel is used when the client device102do not meet the security standards of the encryption protocols. The secure tunnel establishes a session for the client device102with the web server104using a tunnel protocol like HTTP or HTTPS.

Display of the remote software environment is performed by the remote app206. The whole interface of the remote software environment could be displayed or the interface of a single remote app could be displayed. Several instances of the remote app206could display several remote app interfaces respectively. Multiple instances of the remote app206could have several remote software environments respectively running. For example, a user of Chromebook™ can have one remote app206running iOS™ and another remote app206running Linux™ with the ability to switch back-and-forth in full-screen or windowed mode. The remote app206is a browser or a video player in some embodiments merely displaying a stream of video and gathering information with a local probe218to provide information for the remote software environment.

The local probe218in the client210gathers information of the client device102, such as a user input (keyboard, mouse, touch screen, touchpad, gestures, haptic feedback, etc.), sensor information (trilateration location, compass, gyro, accelerometer, ambient light, video, camera, 3D movement detection, sound, sound arrays, temperature, etc.), and software environment (clock set time, time zone, installed or running apps212, power status, battery status, app permissions, app settings, etc.). The local probe218gathers every information possible by the particular OS, computer hardware, OSI layer, or elsewhere to allow mimicry of those conditions at the software environment hosted on the mid-link server108for the client device102. For example, the video camera on the client device102being a phone could be used by the software environment running iOS to participate in a video conference even when the user device116cannot natively support that video conference software.

The client210can apply policies that are stored locally in a policy cache208to the client device102. The policy cache208is populated with policies from the policy store110that are relevant for the respective client device102. As conditions change, the policies that are in effect could also change. For example, the camera/video sensors on the phone could be disabled inside the office or factory, but re-enabled outside of a geofenced area. Certain features, functions or applications might be disabled by the policy until certain conditions exist. For example, there may be a policy that: requires a recent anti-virus scan before establishing a connection to the LAN204on a TLS 1.2 encryption link, disables certain programs to be installed, and/or prevents emails to certain address(es), etc. from the client device102.

This embodiment includes the endpoint tunnel216in the client210. The endpoint tunnel216digitally separates packet traffic between the client device102and the mid-link server108. There may be a number of endpoint tunnels216in operation simultaneously to support the remote app206, any apps212or a browser202in communication with the mid-link server108. A virtual private network (VPN) connection, HTTP, HTTPS connection, and/or public or private key encryption, or TLS encryption can be used for the endpoint tunnel216for different connections.

An Information Technology (IT) module214provides an interface for an administrator or IT staff for analyzing log reports and assigning policies to the client device(s)102. The administrator of the enterprise reviews the policies, established connections, and the encryptions links. The administrator may also modify the policies by updating and/or upgrading the policies using the IT module214.

Referring next toFIG.3A, an embodiment of the mid-link server108is shown that hosts software environments that the client device(s)102remote into. Traffic is passed with an Internet310accessed through a router324to enable the various depicted components of the mid-link server108to communicate with each one another, specifically, endpoint tunnel216, a policy database304, remote devices306, remote instances308, a security developer312, a linker314, a tunnel selector316, a policy enforcer318, a security regulator320, and a mid-link endpoint322.

The mid-link server108hosts many different enterprises and domains keeping usage from their different client device(s)102separated. In other cases, the mid-link server108could be dedicated to a particular enterprise and hosted inside their network or the LAN204or with a third party hosting service. In any event, each remote instance308is dedicated to a client device102for use, although information technology (IT) staff have access to update software, apply policies, make configuration changes, modify admin settings and rights, etc. to maintain the remote instance308. The endpoint tunnel216connects the client device(s)102with the mid-link endpoint322of the tunnel selector316over the Internet310in digitally segregated connections.

Both physical remote devices306and virtual-machine remote instances308are supported to run software environments. For example, the physical remote devices306may be tablets, smartphones, personal computers (Mac or PC), Chromebooks™, Linux™ servers, kiosks, or any personal computing device that employees might use. Any operating system running in a virtual machine on a physical device is supported to enable any enterprise to have their software environments running in a secure, controlled and potentially high performance instantiations. The remote instances308host content sites, websites or streaming content for the client device(s)102.

The remote devices306are physical hardware that hosts a remote instance308and is dedicated to the client device102currently connected to the mid-link server108. Not all operating systems enable running in a development mode or as a virtual machine to support all the functionality of the remote instance308. For those situations, the operating system is running on a physical device temporarily dedicated to the client device102with software to enable the end user106to control the remote instance308.

The policy database304includes a list of policies for setting up the connection between the client device102and the remote instances308. The policy database304also includes a list of parameters based on which the connection with the remote instances308is established. The content to be shared and the connection to be established are matched within the list of parameters and their corresponding policies for establishing the connection. By way of an example, encrypted content to be uploaded to a content site requires TLS 1.2 connection to be established at the remote instance308. Here, in this example, a parameter is data type—encrypted document, and the corresponding policy associated with the data type—encrypted is TLS 1.2 connection. In other embodiments, encryption keys, encryption protocols, quality of service, authentication requirements, performance parameters for the client device(s)102, and/or other requirements for the client device(s)102are included in the list of parameters. By way of another example, the endpoint tunnel216cannot connect with the client device(s)102that have a modified HTTP stack that wouldn't have the same level of trust as one built into the operating system. A connection other than TLS 1.3 will result in a connection through HTTP/HTTPS that is via the secure tunnel from the endpoint tunnel216and the mid-link endpoint322. The policy database304is distributed from the policy store110and updated for each client device102, their enterprise, their country, current location of the client device102, etc.

The policy enforcer318identifies the policies for the client device102requesting to connect with the web server104. The policies are identified based on a set of parameters corresponding to the client device102such as a type of requested service, application type, remote instance type, the content involved or user information, device profiling, among others. A set of policies are identified and provided to the security developer312and the tunnel selector316for further processing.

The security developer312retrieves the policies corresponding to the parameters of the content for the client device102and identifies the connection or an encryption link to be established. For example, if the content to be shared is of an encrypted type, a policy that requires only TLS 1.3 connection be established. The security developer312identifies the policies from the policy enforcer318and provides them to the linker314for establishing the connection via the encryption link. The encryption link is used for connecting with the web server104.

The linker314inspects the connection corresponding to the policy received from the security developer312for selecting one or more encryption protocols corresponding to the connection or the encryption link. The encryption protocols being TLS, SSL, TLS PFS. The linker314identifies the encryption protocols for the connection through the router324to the remote instances308for the client device102. For example, the linker314identifies TLS 1.3 protocol for the policy requiring connection to only TLS 1.3 connection. The linker314inspects the connections and identifies the TLS 1.3 protocol using which the connection is to be established. The linker314initiates the TLS 1.3 connection using the router324to the corresponding remote instance308. The linker314provides the identified encryption protocols to the security regulator320.

The security regulator320determines whether the client device102satisfies the security standards of the encryption protocols. For example, whether the client device102satisfies the requirements for a TLS 1.0/1.2/1.3 connection. The policies for the client device102enable the client device102to satisfy the requirements of the encryption protocols based on the type of service requested, the user application, the user role in the enterprise, the confidentiality of the content being shared, or the UEBA information associated with the client device102. If the client device102satisfies the security standards of the encryption protocols, then the connection is established via the direct link with the web server104using an encryption protocol selected from the encryption protocols and the corresponding encryption link. However, if the client device102does not satisfy the security standards of the encryption protocols, then the connection is established via the security tunnel from the tunnel selector316.

The tunnel selector316establishes the connection for the client device102with the web server104via the mid-link server108using the secure tunnels. A secure tunnel from a number of secure tunnels between the client device102and the mid-link server108is selected by the tunnel selector316. A tunnel protocol such as HTTP or HTTPS corresponding to the secure tunnel is selected by the tunnel selector316to establish the secure session with the web server104. The mid-link endpoint322establishes the connection of the secure tunnel and the router324further establishes the connection to the web server104using the encryption link and the tunnel protocol.

Referring next toFIG.3B, an embodiment of the mid-link server108is shown where a direct link including encryption links302are used for a secure connection between the client device102and the web server104in accordance with a set of policies. Policies exist at different stages of connection between the client device102and the web server104. The mid-link server108facilitates the connection between the client device102and the web server104. The policies enforced at the client device102are referred to as a first mile, the policies inspected at the mid-link server108are referred to as a middle mile, and the policies enforced at the web server104are referred to as the last mile.

An administrator or IT staff of an enterprise has control over the policies at the first mile that is at the client device102. The administrator enforces the policies at the client device102based on a user group, business unit, user profile, user device, remote working, and/or geolocation. The policies are associated with the connections that are used to be established to communicate with the web server104. For example, a policy requires a TLS 1.3 connection to communicate.

The mid-link server108performs a check at the web server104of the connections corresponding to the policies. The mid-link server108performs inspection at the middle mile using the policies from the list of policies stored in the policy store110. The mid-link server108controls web traffic for establishing the connection between the client device102and the web server104. If the mid-link server108determines that the connections to the web server104conform with the policies, the connection is established via the direct link. The determination can be based on machine learning algorithms. However, if the mid-link server108determines that the connection is in accordance with the policies, then a secure connection is established by the mid-link server108via the direct link using the encryption protocols.

At the web server104, the last mile policies are checked to establish the connection. For example, the web server104checks for the policies provided by the mid-link server108and responds to the mid-link server108. If the connections are in accordance with the policies for example, TLS 1.3 connection, the connection is established with the client device102through the mid-link server108. The connections between the middle mile and the last mile are encryption links302. The various encryption links available with the web server104can be TLS 1.0 link302-1, TLS 1.1 link302-2, TLS 1.2 link302-3, and TLS 1.3 link302-4. Among these encryption links302, one of the encryption links302that is in accordance with the policies are used to connect with the client device102.

Referring next toFIG.3C, an embodiment of the mid-link server108is shown where secure tunnels326are used for providing a secure connection between the client device102and the web server104in accordance with a set of policies.

The secure tunnels326are used when the client device102does not meet the requirements of the security standards that is the encryption protocols. The policies specify the secure tunnels326for the encryption links302of the client devices102connecting to the web server104that do not meet common security standards such as TLS or SSL but still need secure web access. The secure tunnel would connect the client device102to the mid-link server108and would be configurable. For example, HTTP over HTTPS tunneling provides a secure tunnel for communication.

The secure tunnels326offer high security to the client device102. The secure tunnels326may be used for connections when highly confidential contents are shared or suspicious activities from the client device102(based on UEBA analysis) are identified. The policies associated with the connection may be modified if the secure tunnels326are used over the direct link and the tunnel protocol is used instead of the encryption protocols.

Referring toFIG.4, an embodiment of an Information Technology (IT) module214configured to enforce policies on the client device102and review log reports of established connections between the client device102and the web server104. The IT module214includes a policy database402, a parameter database404, a policy comparator406, a compliance tester408, a security enforcer410, a modifier412, a reporter414, a data classifier416, and a logger418.

The policy database402and the parameter database404have stored policies and parameters from the policy store110, respectively. To initiate a connection requests from the client device(s)102to the web server104, the policy comparator406matches the policies from the policy database402with the parameters from the parameter database404based on the client device(s)102, a type of connection, a service type, and a type of content of the request. The policy database402includes a list of policies with the corresponding parameters and connection types. The parameter database404includes parameters corresponding to the client device(s)102, the type of connection, the service type, and the type of content of the request.

The policy database402and the parameter database404also include respective threshold values. Based on the request from the client device102, the parameters are determined from the parameter database404. The determined parameters are compared with the parameters in the policy database402for determining the policies corresponding to the parameters. The policies and the corresponding connections are determined from the match of the parameters with the policies in the policy database402. The threshold values of the policies and the parameters are also compared. For example, a policy threshold value of SSL or TLS 1.0 connection or TLS connections higher than the TLS 1.0. A parameter threshold value of the type of content—secure or confidential and type of encryption such as AES. Meeting the policy and the parameter threshold values provides options for connection.

Further, the policy comparator406extracts tags of content to be shared from the client device(s)102to content sites or websites of the web server104. For example, Data Loss Prevention (DLP) techniques can be used to read the tags. The tags are extracted by the data classifier416. The data classifier416identifies a tag having a header and metadata of the content and provides it to the policy comparator406. For example, the content can be classified by tagging as confidential, encrypted, restricted, public or any other type of tag can be associated with the content.

The policy comparator406uses the tag as one of the parameters for comparison with the parameters in the policy database402. The policy and connections are determined based on the parameters matched with the policies in the policy database402. The determined policies are provided to the compliance tester408for verification.

The compliance tester408verifies the received policies in accordance with government regulations of the geographical location. The policies are checked for any kind of violation of the government rules and regulations. In case the policies are in violation of the government regulations or are in compliance with the government regulations, an indication is sent to the security enforcer410for further actions.

The security enforcer410enforces the policies on the client device102based on the indication received from the compliance tester408when the policies comply with the government regulations. In case the policies violate the government regulations, an alert is displayed to the administrator on the reporter414and the client device102so that the administrator and/or the end user106may take action regarding the issue.

The logger418is a repository of log reports of past and current connections of the client device(s)102, alerts of non-connected client devices, client reports on the client device(s)102for compliance with the policies, and analytics on the usage of the cloud services by the client device(s)102. The logger also stores historical log reports of policies implemented on the client device(s)102. The logger continuously monitors the connections of the client device102and gathers log data from the client device(s)102. The log reports are provided to the reporter414for further analysis.

The reporter414is a display device coupled with a processor and a memory to facilitate the administrator to analyze the log reports of the past and current connections of the client device(s)102obtained from the logger418. Security of the connections, violations of the standards and performance parameters are analyzed by the administrator using the display device. The reporter414also indicates alerts regarding violations of the policies from the government regulations so that the administrator may perform certain actions with respect to the violations. The analyzed data is provided to the modifier412for further processing.

The modifier412processes the analyzed data from the reporter414to modify the policies if required. For example, client device(s)102may be enforced with updated policies and connections. TLS connections or any other kind of connections are updated and/or upgraded from time to time. Accordingly, the policies also update and further the list of policies in the policy database402is updated. Further, parameters also change, user profiles and client device(s)102may also update, accordingly the parameters and their policies are updated. Based on a history of established connections, client device(s)102, content types and the destinations at the web server104, the policies may be modified and implemented. The policies are modified for the secure session based on an update and/or an upgrade of the encryption protocols or the secure tunnel that is being used. The administrator provides approval to the modified policies after which the policies are stored in the policy database402for implementation.

Referring toFIG.5, a flow diagram500of an embodiment of the policy-based security system100is shown where policies are deployed at the client device102by an administrator502of an enterprise.

An administrator502uses a display device with a web user interface (UI)504to enforce configuration settings for policies at the client device102. A customer user506of the client device102is able to share content with the web server104based on the enforced policies. The policies are further deployed by the administrator502on the mid-link server108. The mid-link server108becomes aware of the policies and establishes communication with the web server104based on the policies.

The mid-link server108negotiates with the web server104according to the policies and establishes a connection when the web server104complies with the policies. For example, a policy requires TLS 1.3 PFS connection, in this case the mid-link server108establishes a connection with the TLS 1.3 PFS connection via the direct link else the connection is established via the secure tunnel, and an alert may be generated to the administrator502for performing an action.

The administrator502analyzes log reports of the connections and policies. The administrator also receives alerts from the mid-link server108regarding non-compliance with the policies. In such situations, the administrator may modify the policies such that the connection is established or may instruct the mid-link server108to establish the connection via the secure tunnel or HTTP/HTTPS connections. A threshold value for each of the policies may also be predetermined and defined by the administrator502or may be predefined by a third party which may help establish secure connections. For example, in case a TLS 1.3 connection is available and the content to be shared is not confidential, the administrator502may modify the policies with TLS 1.3 PFS to also include TLS 1.3 connection. The threshold value being the parameter—type of content—not confidential. According to the modified policies and the parameters meeting the predetermined threshold value, the mid-link server108may establish the connection. In another example, a policy may be modified when the secure tunnel is used for connection instead of the direct link using HTTP/HTTPS protocols.

The negotiated configuration settings, device usage, alerts including notices on non-connected client device(s)102, the established connections, and the communications are analyzed by the administrator502through the log reports. Analysis of links and checking compliance with government regulations are other functions performed by the administrator502using the log reports of the connections.

Referring next toFIG.6, a flowchart of an embodiment of a policy controlled connection process600for a client device102is shown. The depicted portion of the process begins at block602where a user of the client device102loads browser or a remote application at the client device102. The user desires to access a content site or upload a document to another site of the web server104at a first mile. The user initiates the request for connection to the web server104to the mid-link server108. The mid-link server108acts as an intermediate server controlling the connection at a middle mile based on a set of policies. The web server104provides connection at a last mile.

An administrator of an enterprise of the user of the client device102enforces the set of policies at the client device102. The policies are enforced based on a set of parameters including a user connection, a destination application, data classification, data type, content type, user groups, tags, application type, encryption type, user's geographical location, user and entity behavior analytics (UEBA) information, user residency, and/or type of user connection, and/or performance. The administrator confirms compliance with the policies with government regulations.

At block604, the user of the client device102selects a cloud service for access using the remote application, the cloud service is accessed from the web server104. The cloud service can be downloading or browsing content from a website, streaming content from the website or uploading or sharing content to the website or remote instances of the web server104.

At block606, the request for accessing the cloud service is made to the mid-link server108by the client device102. The mid-link server108determines the policies for the client device102, checks the policies enforced at the client device102, and compares them with the policies determined and the policies enforced at the web server104.

At block608, if the web server104is able to provide a connection in accordance with the policies, then the mid-link server108initiates the connection using an encryption link determined based on the policies else the connection is not initiated. An alert is provided to the administrator in this case for further action.

At block610, session protocols are determined in accordance with the encryption link and the policies. For example, TLS 1.3 connection protocol, TLS 1.2 connection protocol etc. Machine learning algorithms may be set to select the most secure connection protocol in accordance with the encryption link and the policies. For example, TLS 1.3 connection may be insecure if there exists an upgraded TLS connection. In such situations, the machine learning algorithms determine the most secure session protocol. If the TLS 1.3 or TLS 1.2 connection is not available, the machine learning algorithms determine HTTP or HTTPS session protocol for connection.

At block614, a secure tunnel or a direct link to establish the connection is determined based on whether the client device102meets the security standards of the session protocols. If the client device102meets the security standards of the session protocols, then the direct link with the web server104is used for connection using the session protocols and the encryption link. If the client device102meets the security standards of the session protocols, then the secure tunnel and the corresponding tunnel protocol such as HTTP or HTTPS are used for the connection using the encryption links.

At block616, a secure connection or a secure session is established with the web server104in accordance with the policies and based on the secure tunnel or the direct link used. Based on the established connection, the client device102communicates with the web server104. The secure session can also be established based on modified policies when the alert is generated. The alert indicates that the policies at the web server104do not meet the policy requirements of the client device102and also do not satisfy a policy threshold value and/or a parameter threshold value associated with the policies. The administrator can modify the policies at the client device102as a remedial action to the alert. The administrator can also indicate not to establish the session based on non-compliance with the policies or establish connections using the secure tunnel.

Referring next toFIG.7, a flowchart of an embodiment of a policy enforcement process700for a client device102is shown. The depicted portion of the process700begins at block702where an administrator of an enterprise determines a set of policies for each of the client device(s)102of the enterprise. One or more of the client device(s)102may desire to share content with content sites of the web server104. The policies are determined based on a set of parameters.

At block704, the set of parameters for respective client device(s)102are identified from a policy store110. The set of parameters may also be identified using metadata from integrations of the client device(s)102. The set of parameters are stored in the policy store110. The respective set of parameters are the user connection, the destination connection, a user application, the destination application, a source, a source location, a destination, a destination location, application type, type of connection, geographical location, residency, the data classification, data type, user groups, encryption type, and/or performance.

At block706, the policies are compared with the set of parameters using a list of policies stored in the policy store110. The list of policies includes policies against the set of parameters. The list of policies also includes connections for each of the policies. Based on the comparison in the list of policies, the connections for each of the policies is determined.

At block708, a tag associated with the content to be shared is declassified. The tag includes a header and metadata. The tag is read to declassify the information of the tag. For example, the tag can be confidential, secure, non-confidential, encrypted, high importance, or restricted. Based on the tag, the policies are further filtered.

At block710, compliance of the policies with government rules and regulations is verified. The set of policies are in accordance with the government regulations. The administrator verifies the compliance with the government regulations.

At block712, the policies are enforced on the respective client device102by the administrator. The policies are based on the set of parameters and the tag associated with the content. Communication with the web server104is based on the enforced policies.

At block714, the administrator reviews log reports, device usage of the client device(s)102, alerts on non-connected client device(s)102(if any), and the established connections of the client device(s)102. The administrator analyzes the policies and determines whether the policies require modification. In case of non-compliance with the government policies or the policies not being met at the web server104as determined by the mid-link server108, the administrator may modify the set of policies depending on the case. The policies may be modified to establish a connection via the secure tunnel including the HTTP/HTTPS connection when the policies are not met.

At block716, the set of policies are modified based on the determination that the policies require updating. The policies are modified by updating or upgrading the set of policies based on the analysis. The modified policies are enforced on the respective client device102.

Referring next toFIG.8, a flowchart of an embodiment of a link selection process800for a client device102is shown. The depicted portion of process800begins at block802where policies are determined for the requesting client device102. The client device102requests to access a cloud service from a web server104using a local application of the client device102. The policies for the client device102are determined based on the parameters. The parameters include a user connection, a user application, a user location, a type of source, a source location, a destination, a destination location, a destination connection, a destination application, an application type, a type of shared content, confidentiality of the shared content, network data traffic, metadata, user role, user team, user and entity behavior analytics (UEBA) information, and/or user residency.

At block804, based on the policies, an encryption link is determined to establish the connection with the web server104. The encryption link facilitates the connection of the client device102with the web server104.

At block806, a number of session protocols are determined based on the policies. The session protocols include encryption protocols such as TLS, SSL, HTTP, HTTPS or other types of encryption connection protocols.

At block808, it is determined whether the client device102meets the encryption standards of the session protocols, that is, whether the client device102can establish a connection using one of the session protocols or not. If the client device102meets the encryption standards of the session protocols, a direct link is selected at block814. A secure session is established with the web server104via the direct link at block812.

If the client device102does not meet the encryption standards of the session protocols, then a secure tunnel is selected at block810. The secure session is established with the web server104via the secure tunnel using a tunnel protocol including HTTP/HTTPS at block812.

Specific details are given in the above description to provide a thorough understanding of the embodiments. However, it is understood that the embodiments may be practiced without these specific details. For example, circuits may be shown in block diagrams in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

Implementation of the techniques, blocks, steps and means described above may be done in various ways. For example, these techniques, blocks, steps and means may be implemented in hardware, software, or a combination thereof. For a hardware implementation, the processing units may be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, other electronic units designed to perform the functions described above, and/or a combination thereof.

Also, it is noted that the embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a swim diagram, a data flow diagram, a structure diagram, or a block diagram. Although a depiction may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed, but could have additional steps not included in the figure. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination corresponds to a return of the function to the calling function or the main function.

Furthermore, embodiments may be implemented by hardware, software, scripting languages, firmware, middleware, microcode, hardware description languages, and/or any combination thereof. When implemented in software, firmware, middleware, scripting language, and/or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine readable medium such as a storage medium. A code segment or machine-executable instruction may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a script, a class, or any combination of instructions, data structures, and/or program statements. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, and/or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, etc.

For a firmware and/or software implementation, the methodologies may be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. Any machine-readable medium tangibly embodying instructions may be used in implementing the methodologies described herein. For example, software codes may be stored in a memory. Memory may be implemented within the processor or external to the processor. As used herein the term “memory” refers to any type of long term, short term, volatile, nonvolatile, or other storage medium and is not to be limited to any particular type of memory or number of memories, or type of media upon which memory is stored.

Moreover, as disclosed herein, the term “storage medium” may represent one or more memories for storing data, including read only memory (ROM), random access memory (RAM), magnetic RAM, core memory, magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other machine readable mediums for storing information. The term “machine-readable medium” includes, but is not limited to portable or fixed storage devices, optical storage devices, and/or various other storage mediums capable of storing that contain or carry instruction(s) and/or data.

While the principles of the disclosure have been described above in connection with specific apparatuses and methods, it is to be clearly understood that this description is made only by way of example and not as limitation on the scope of the disclosure.