Distributed split browser content inspection and analysis

• US 9,635,041 B1
• Filed: 06/16/2014
• Issued: 04/25/2017
• Est. Priority Date: 06/16/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Warman, Leon Robert, Kufeld, Kurt, Vosshall, Peter Sven, Johansson, Jesper Mikael, Peterson, Kyle Bradley, Hill, Peter Frank
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US14/306,141
• Time in Patent Office: 1,044 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Distributed split browser content inspection and analysis are described. A server, comprising a browser engine, stores a definition of sets of browser policies. A definition of one or more sets of users is stored. The server stores an association with a respective set of browser policies for the one or more sets of users. A request is received from a client browser associated with a user, wherein the client browser is configured to communicate with the server browser engine. The server determines which set of users the user is associated with. The server identifies a first set of browser policies that is associated with the determined set of users and applies the identified first set of browser policies to the request. A determination is made, for one or more browser processes, which browser processes are to be executed by the server browser engine and which browser processes are to be executed by the client browser.

Claims

1. A computer-implemented method of enabling the management of browsers, the method comprising:

receiving and storing at a server system comprising one or more computing devices a definition of one or more sets of browser policies, wherein the server system comprises a browser engine hosted on the server system, the server browser engine including a rendering engine;

receiving and storing at the server system a definition of one or more sets of users;

for the one or more sets of users, receiving at the server system an association with a respective set of browser policies;

receiving at the server system a first request from a first client browser associated with a first user, wherein the first client browser is hosted on a device remote from the server system and is configured to communicate with the server system browser engine;

determining by the server system which set of users the first user is associated with;

based at least in part on the determination as to which set of users the first user is associated with, identifying by the server system a first set of browser policies that is associated with the determined set of users;

applying by the server system the identified first set of browser policies, that is associated with the determined set of users, to the first request from the first client browser;

determining, for one or more browser processes, including at least one pre-rendering process that pre-renders at least a portion of a network resource corresponding to the first request;

which browser processes are to be executed by the server system browser engine, and executing such browser processes by the server system browser engine, and

which browser processes are to be executed by the first client browser and causing such browser processes to be executed by the first client browser; and

transmitting to the first client browser the pre-rendered portion of the network resource corresponding to the first request or corresponding graphics painting commands.

2. The method of claim 1, wherein the server system comprises a data store configured to store historical data related to requests from a plurality of client browsers being managed by the server system, wherein the server system is configured to utilize such historical data to identify patterns or threats, or both patterns and threats.

3. The method of claim 1, wherein the server system comprises a data store configured to store historical data related to interactions of a plurality of client browsers with items of content, wherein the server system is configured to detect if an interaction of given client browser with a given item of content indicates that the given item of content comprises malware, and at least partly in response, prevent one or more other client browsers from accessing the given of item content indicated to be malware.

4. The method of claim 1, wherein the server system comprises a detonation chamber configured to isolate potential malware for examination.

5. The method of claim 1, wherein the first request from the first client browser comprises a request for a first network resource the method further comprising:

requesting the first network resource;

determining if the first network resource comprises embedded resources;

if the first network resource comprises embedded resources, requesting at least a portion of the embedded resources;

wherein applying the identified first set of browser policies to the first request from the first client browser comprises determining whether one or more of the embedded resources are to be provided to the first client browser.

6. The method of claim 1, wherein the first request from the first client browser comprises a request to change a first client browser setting pertaining to browser security, wherein applying the identified first set of browser policies to the first request from the first client browser comprises determining whether the change to the first client browser setting in permitted by the first set of browser policies.

7. The method of claim 1, wherein the first set of browser policies indicates which browser functions are to be disabled.

8. The method of claim 1, wherein applying the identified first set of browser policies to the first request from the first client browser further comprising determining if the first request is to be complied with, and at least partly in response to determining that the first request is not to be complied with, causing a corresponding notification to be displayed via the first client browser.

9. The method of claim 1, wherein the first set of browser policies indicates that pattern matching is to be utilized to determine whether dynamic content is to be provided to the first client browser in response to the first request.

10. The method of claim 1, wherein the first set of browser policies indicates that requests for a network resource that has been in existence less than a threshold period of time are to be denied.

11. The method of claim 1, wherein at least a portion of the sets of users are identified based at least in part on metadata associated with respective users, wherein the metadata data comprises one or more of:

user title, employee type classification, job function descriptor, department name, or length of employment.

12. The method of claim 1, wherein at least a portion of the sets of users are identified based at least in part on metadata associated with respective users, wherein the metadata data indicates what type of data the respective user has access to.

13. A system, comprising:

a computer data repository that stores sets of browser policies and definitions of sets of users, said computer data repository comprising a non-transitory storage device; and

a computing system comprising one or more computing devices, said computing system programmed to implement;

a server configured to receive requests from browsers hosted on remote computing devices and to perform one or more browser functions on behalf of the browsers hosted on remote computing devices using a server browser engine comprising a rendering engine;

a browser administration system that is configured to;

access the sets of browser policies and the definitions of user sets;

for a first request from a first client browser associated with a first user received by the server, determine which set of users the first user is associated with;

based at least in part on the determination as to which set of users the first user is associated with, identify a first set of browser policies that is associated with the determined set of users;

apply the identified first set of browser policies to the first request from the first client browser to control at least in part processing by the server related to the first request;

determine, for one or more browser processes, including at least one pre-rendering process that pre-renders at least a portion of a network resource corresponding to the first request;

which browser processes are to be executed by the server browser engine, and execute such browser processes by the server system browser engine, and

which browser processes are to be executed by the first client browser, and cause such browser processes to be executed by the first client browser; and

transmit to the first client browser the pre-rendered portion of the network resource corresponding to the first request or corresponding graphics painting command.

14. The system of claim 13, wherein the computing system comprises a data store configured to store historical data related to requests from a plurality of browsers being managed by the computing system, wherein the computing system is configured to utilize such historical data to identify patterns or threats, or both patterns and threats.

15. The system of claim 13, wherein the computing system comprises a data store configured to store historical data related to interactions of a plurality of client browsers with items of content, wherein the computing system is configured to detect if an interaction of given client browser with a given item of content indicates that the given item of content comprises malware, and at least partly in response, prevent one or more other client browsers from accessing the given item of content indicated to be malware.

16. The system of claim 13, wherein the computing system comprises a detonation chamber configured to isolate potential malware for examination.

17. The system of claim 13, wherein the server is configured to access a first network resource identified in the first request, determine if the first network resource comprises embedded resources, and if the first network resource comprises embedded resources request at least a portion of the embedded resources;

wherein the browser administration system is configured to determine, based at least in part on the applied identified first set of browser policies, whether one or more of the embedded resources are to be provided to the first client browser by the server.

18. The system of claim 13, wherein the first request from the first client browser comprises a request to change a first client browser security setting, wherein the browser administration system is configured to determine, based at least in part on the applied identified first set of browser policies whether the change to the first client browser security setting in permitted by the first set of browser policies.

19. The system of claim 13, wherein the first set of browser policies indicates which browser functions are to be disabled.

20. The system of claim 13, wherein the browser administration system is configured to determine, based at least in part on the applied identified first set of browser policies, if the first request is to be complied with, and at least partly in response to determining that the first request is not to be complied with causing a corresponding notification to be displayed via the first client browser.

21. The system of claim 13, wherein the first set of browser policies indicates that pattern matching is to be utilized to determine whether dynamic content is to be provided to the first client browser in response to the first request.

22. The system of claim 13, wherein the first set of browser policies indicates that requests for a network resource that has been in existence less than a threshold period of time are to be denied.

23. The system of claim 13, wherein at least a portion of the sets of users are identified based at least in part on metadata associated with respective users, wherein the metadata data comprises one or more of:

user title, employee type classification, job function descriptor, department name, or length of employment.

24. The system of claim 13, wherein at least a portion of the sets of users are identified based at least in part on metadata associated with respective users, wherein the metadata data indicates what type of data the respective user has access to.

25. A computer storage system comprising a non-transitory storage device, said computer storage system having stored thereon executable program instructions that direct a computer system to at least:

receive and store a definition of one or more sets of browser policies;

receive and store an identification of one or more sets of users;

for the one or more sets of users, receiving an association with a respective set of browser policies;

receive a first request from a first client browser associated with a first user;

determine which set of users the first user is associated with;

based at least in part on the determination as to which set of users the first user is associated with, identify a first set of browser policies that is associated with the determined set of users;

apply the identified first set of browser policies to the first request from the first client browser; and

determine, for one or more browser processes, including at least one pre-rendering process that pre-renders at least a portion of a network resource corresponding to the first request;

which browser processes are to be executed by a browser engine hosted by the computer system, and execute such browser processes by the browser engine hosted by the computer system;

and which browser processes are to be executed by the first client browser, and cause such browser processes to be executed by the first client browser; and

transmit to the first client browser the pre-rendered portion of the network resource corresponding to the first request or corresponding graphics painting command.