Techniques for monitoring secure cloud based content

• US 9,215,264 B1
• Filed: 08/20/2010
• Issued: 12/15/2015
• Est. Priority Date: 08/20/2010
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sokolov, Ilya, Newstadt, Keith
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US12/860,551
• Time in Patent Office: 1,943 Days
• Field of Search: 709223-225
• US Class Current: 1/1
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Techniques for monitoring secure cloud based content are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for monitoring secure cloud based content comprising monitoring, using a browser component, a secure session accessing cloud based content, the monitoring capable of accessing content other than content requested by a user of the browser, identifying content meeting a specified criteria, and performing a specified action based at least in part on the identified content.

Claims

1. A method for monitoring secure cloud based content comprising:

monitoring, using a browser component of a browser comprising an iframe, a secure session accessing cloud based content, wherein the monitoring comprises concurrently accessing from the browser cloud based content other than cloud based content requested by a user of the browser;

identifying specific cloud based content meeting a specified criteria; and

performing, via a response component, a specified action based at least in part on the identified specific cloud based content, wherein the specified action comprises emulating a user action in the browser.

2. The method of claim 1, wherein the browser component monitors the secure session by creating a hidden inline frame in a Web document of the browser.

3. The method of claim 1, wherein the monitoring is performed without periodic authorization of a user of the browser.

4. The method of claim 1, wherein the monitoring of the secure session is performed using a same connection created by a user of the browser.

5. The method of claim 1, wherein the browser component comprises a browser plug-in.

6. The method of claim 1, wherein identifying content meeting a specified criteria comprises identifying content matching one or more of:

a malware signature, a blacklisted network address, a footprint, reputation based analysis, objectionable content restrictions, and behavioral analysis.

7. The method of claim 1, wherein identifying specific content meeting a specified criteria comprises identifying a content provider for which one or more specified actions are provided.

8. The method of claim 7, wherein the content provider comprises at least one of:

a social networking site, an online gaming site, and an e-commerce site.

9. The method of claim 7, wherein the specified action comprises collecting secure content specific to the identified content provider.

10. The method of claim 7, wherein the one or more specified actions comprise at least one of collecting profile information from a social networking site, collecting age information from a social networking site, collecting lists of friends, collecting chat conversations, blocking a communication, blocking an action, emulating a user action, logging an action, and providing a notification.

11. The method of claim 10, wherein emulating a user action comprises at least one of uninstalling a user application, unsubscribing from a list, unsubscribing from a group, blocking a communication, modifying a privacy setting, modifying an access setting, modifying a friends list, and modifying a contacts list.

12. The method of claim 7, wherein identification of a content provider with one or more specified actions is performed using a site signature, the site signature providing one or more content provider site identifiers and one or more actions.

13. The method of claim 12, further comprising receiving one or more site signatures from a remote host.

14. The method of claim 7, wherein the one or more specified actions include logging secure cloud based content and providing one or more portions to a remote host.

15. The method of claim 1, wherein the specified action is specified by at least one of:

a parent, a guardian, and an administrator.

16. The method of claim 1, wherein the monitoring is performed at least one of:

periodic intervals and based on usage.

17. The method of claim 1, wherein the specific cloud based content is associated with a content provider for which no specified actions are provided and one or more portions of the specific cloud based content are provided to a remote host for analysis.

18. At least one non-transitory processor readable storage medium for storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method as recited in claim 1.

19. An article of manufacture for monitoring secure cloud based content, the article of manufacture comprising:

at least one non-transitory processor readable storage medium; and

instructions stored on the at least one non-transitory processor readable storage medium;

wherein the instructions are configured to be readable from the at least one medium by at least one processor and thereby cause the at least one processor to operate so as to;

monitor, using a browser component of a browser comprising an iframe, a secure session accessing cloud based content, wherein the monitoring comprises concurrently accessing from the browser cloud based content other than cloud based content requested by a user of the browser;

identify cloud based content meeting a specified criteria; and

perform, via a response component, a specified action based at least in part on the identified specific cloud based content, wherein the specified action comprises emulating a user action in the browser.

20. A system for monitoring secure cloud based content comprising:

one or more processors communicatively coupled to a network;

wherein the one or more processors are configured to;

monitor, using a browser component of a browser comprising an iframe, a secure session accessing cloud based content, wherein the monitoring comprises concurrently accessing from the browser cloud based content other than cloud based content requested by a user of the browser;

identify cloud based content meeting a specified criteria; and

perform, via a response component, a specified action based at least in part on the identified specific cloud based content, wherein the specified action comprises emulating a user action in the browser.