Cloud suffix proxy and a method thereof

• US 10,324,702 B2
• Filed: 09/08/2015
• Issued: 06/18/2019
• Est. Priority Date: 09/12/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Israel Research And Development (2002) Ltd (Microsoft Corporation)
• Inventors: Vishnepolsky, Gregory, Moysi, Liran
• Primary Examiner(s): Kang, Insun
• Application Number:
  US14/847,469
• Publication Number:
  US 20160077824A1
• Time in Patent Office: 1,379 Days
• Field of Search: None
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 2101/355 containing special suffixes
• CPC Class Codes: H04L 61/301 Name conversion
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A method and system for modifying network addresses of at least one cloud application. The method comprises receiving a webpage sent to a client device from the at least one cloud application, wherein a webpage designates at least one script loaded to the client device during runtime; injecting a piece of code to the webpage; receiving, by the injected piece of code, an attempt to load each of the at least one script; modifying the at least one script by suffixing each network address designated in the at least one script with a predefined network address; and sending the modified at least one script to the client device, wherein runtime execution of the modified at least one script on the client device causes redirection of future requests from the client device to the cloud application to the suffixed network address.

Claims

1. A method for modifying network addresses of at least one cloud application, comprising:

receiving a webpage sent to a client device from the at least one cloud application, wherein a the received webpage designates at least one script loaded to the client device during runtime;

injecting, by a suffix proxy device, a piece of code to the received webpage, wherein the suffix proxy device is connected between the client device and a cloud platform hosting the at least one cloud application;

receiving, by the injected piece of code, an indication on an attempt to load each of the at least one script;

modifying the at least one script by suffixing each network address designated in the at least one script with a predefined network address, wherein the suffixing includes wrapping at least one instruction in the at least one script to call an alternative instruction configured for the suffixing; and

sending the modified at least one script to the client device, wherein runtime execution of the modified at least one script on the client device causes redirection of future requests from the client device to the cloud application to the suffixed network address.

2. The method of claim 1, further comprising:

modifying each static network address designated in the received webpage.

3. The method of claim 2, wherein suffixing each static network address further comprises:

parsing the webpage to identify the static network address; and

suffixing each identified static network address designated in the at least one script with the predefined network address.

4. The method of claim 3, wherein each of the network addresses to be modified is included in a list of network addresses.

5. The method of claim 4, wherein each of the network addresses to be modified is at least a uniform resource locator (URL).

6. The method of claim 1, wherein modifying the at least one script further comprises:

parsing the at least one script to identify at least one instruction configured for generating a network address.

7. The method of claim 6, further comprising:

detecting, during runtime, at least one wrapped instruction that does not affect a network address; and

ignoring the respective wrapper applied on the at least one wrapped instruction that does not affect the network address.

8. The method of claim 6, wherein the at least one script is any one of:

a JavaScript code and a Cascading Style Sheets (CSS) file.

9. The method of claim 6, wherein wrapping each of the at least one identified instruction further comprises:

converting the at least one script into an abstract syntax tree;

recursively traversing the abstract syntax tree; and

wrapping nodes of the abstract syntax tree to generate a patched abstract syntax tree.

10. The method of claim 9, further comprising:

rebuilding the modified at least one script from the patched abstract syntax tree.

11. The method of claim 6, further comprising:

caching the at least one script and the modified script.

12. The method of claim 1, further comprising:

determining if at least one modified script has been cached upon identifying a request to load the at least one script; and

sending the cached modified script to the client device without retrieving a webpage requested by the client device from a remote server executing the at least one cloud application.

13. The method of claim 1, wherein the method is performed without requiring any modification of a default client device configuration.

14. The method of claim 6, further comprising:

executing in a sandbox the at least one script to monitor any attempts to change a document object model (DOM) of the webpage;

suffixing, at runtime, any write of a network address to the DOM; and

un-suffixing, at runtime, any read of a network address from the DOM.

15. The method of claim 14, further comprising:

monitoring access to the DOM; and

preventing at least one operation that can modify the DOM.

16. The method of claim 15, wherein the at least one operation includes any one of:

loading plugins to the client device, a cross domain access, and an asynchronous request between the webpage and a web server.

17. The method of claim 1, wherein the method is performed by a suffix proxy device.

18. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1.

19. A system for modifying network addresses of at east one cloud application, comprising:

a processor; and

a memory containing instructions that, when executed by the processor, configure the system to;

receive a webpage sent to a client device from the at east one cloud application, wherein a the received webpage designates at east one script loaded to the client device during runtime;

inject, by the system, a piece of code to the received webpage, wherein the suffix proxy device is connected between the client device and a cloud platform hosting the at least one cloud application;

receive, by the injected piece of code, an indication on an attempt to load each of the at least one script;

modify the at least one script by suffixing each network address designated in the at least one script with a predefined network address, wherein the suffixing includes wrapping at least one instruction in the at least one script to call an alternative instruction configured for the suffixing and

send the modified at least one script to the client device, wherein runtime execution of the modified at least one script on the client device causes redirection of future requests from the client device to the cloud application to the suffixed network address.

20. The system of claim 19, wherein the system is further configured to:

modify each static network address designated in the received webpage.

21. The system of claim 20, wherein the system is further configured to:

parse the webpage to identify the static network address; and

suffix each identified static network address designated in the at least one script with the predefined network address.

22. The system of claim 21, wherein each of the network addresses to be modified is included in a list of network addresses.

23. The system of claim 22, wherein each of the network addresses to be modified is at least a uniform resource locator (URL).

24. The system of claim 19, wherein the system is further configured to:

parse the at least one script to identify at least one instruction configured for generating a network address.

25. The system of claim 24, wherein the system is further configured to:

detect, during run-time, at least one wrapped instruction that does not affect a network address; and

ignore the respective wrapper applied on the at least one wrapped instruction that does not affect the network address.

26. The system of claim 24, wherein the at least one script is any one of:

a JavaScript code and a Cascading Style Sheets (CSS) file.

27. The system of claim 24, wherein the system is further configured to:

convert the at least one script into an abstract syntax tree;

recursively traverse the abstract syntax tree; and

wrap nodes of the abstract syntax tree to generate a patched abstract syntax tree.

28. The system of claim 27, wherein the system is further configured to:

rebuild the modified at least one script from the patched abstract syntax tree.

29. The system of claim 24, wherein the system is further configured to:

cache the at least one script and the modified script.

30. The system of claim 19, wherein the system is further configured to:

determine if at least one modified script has been cached upon identifying a request to load the at least one script; and

send the cached modified script to the client device without retrieving a webpage requested by a client device from a remote server executing the at least one cloud application.

31. The system of claim 24, wherein the system is further configured to:

execute in a sandbox the at least one script to monitor any attempts to change a document object model (DOM) of the webpage;

suffix, at run-time, any write of a network address to the DOM; and

un-suffix, at run-time, any read of a network address from the DOM.

32. The system of claim 31, wherein the system is further configured to:

monitor access to the DOM; and

prevent at least one operation that can modify the DOM.

33. The system of claim 32, wherein the at least one operation includes any one of:

loading plugins to the client device, a cross domain access, and an asynchronous request between the webpage and a web server.