Cloudflare

Abstract A claim is granted over a partition to a consumer. The claim is valid for a period and allows only that consumer to consume data of the partition during the period. The consumer consumes the data until the claim expires or the data in the partition is fully consumed. If the consumer fully consumes the data of the partition prior to the claim expiring, another claim can be granted over another partition to the consumer. Once the claim over the partition expires, the partition is available to be claimed by another consumer.

Abstract A server receives a request for a network resource from a client network application. The server retrieves the network resource and detects an online advertisement tag in it. The server determines that it has access to an identity cookie for the requesting client. The server modifies the network resource including causing the tag from being processed directly by the client and adds a reference to a client-side script that will inject the online advertisement into the modified network resource. The server transmits a request for the online advertisement to an advertisement supply source, transmits a push-promise to the requesting client for the client-side script, and transmits the modified network resource to the requesting client. The server receives, from the advertisement supply source, a response to the request for the online advertisement. The server transmits the client-side script to the requesting client without receiving a separate request for the client-side script.

Abstract Controlling access to external capabilities exposed by a resource server for artificial intelligence models. An access server receives an authorization request from a resource client for authorization of a resource server. The access server determines a set of capabilities associated with the resource server and enforces access policies to identify permitted capabilities subject to user consent. A consent page is presented to the user agent for selective approval of capabilities. After receiving user consent, the access server generates an access token that is capable of being used as a credential for the consented capabilities. Subsequent requests from the resource server are validated and routed to the appropriate capabilities, with responses returned accordingly.

Abstract A condition exists that triggers an HTTP server to modify one or more HTTP connections for one or more HTTP clients that are connected to the HTTP server. The HTTP server dynamically modifies the one or more HTTP connections including dynamically modifying one or more runtime behaviors for the one or more HTTP connections. For each of the one or more HTTP clients, the HTTP server monitors that HTTP client to determine whether it is complying with the modified one or more runtime behaviors. If one of the one or more HTTP clients is not complying with the modified one or more runtime behaviors, the HTTP server performs a mitigation action on that HTTP client.

Abstract Traffic is received at a distributed cloud computing network. The traffic originates from a computing device using a mobile data connection. The traffic is associated with an identifier that identifies a SIM of the computing device. Using the SIM identifier, an identity for identity-based policy enforcement at the distributed cloud computing network is determined. The identity is uniquely associated with the SIM identifier. An identity-based policy that is applicable for the received traffic for the determined identity is determined. The identity-based policy is enforced.

Abstract An intermediary server operates an application proxy. An access request is received for access to an application, where an access policy is associated with the application that specifies authentication method(s) acceptable for satisfying an authentication requirement enforced by the application proxy. The user agent is redirected to submit an authentication request to an identity provider for identity verification. An authentication response generated by the identity provider is received and includes information that specifies authentication method(s) used during the identity verification. If the authentication method(s) used during the identity verification match the authentication method(s) acceptable for satisfying the authentication requirement, the user will not be prompted to perform those authentication method(s) and the authentication requirement enforced by the application proxy is met. If they do not match, the user will be prompted to perform the authentication method(s) as a condition to access the application.

Abstract Systems and methods for zero trust authentication. In certain embodiments, a method may comprise providing, from a client computing system to an identity provider (IdP) authority, an authentication nonce value generated by hashing a random value and a public key of the client computing system, and receiving, at the client computing system from the IdP authority, an authorization token including the authentication nonce value, where the authorization token is signed by a private key of the IdP authority. The method may further comprise providing a message including the authorization token from the client computing system to a target computing system via an intermediary co-signer (ICS) configured to authenticate the message.

Abstract Traffic is received at an interface of a compute server. Identity information associated with the traffic is determined including an identifier of a customer to which the traffic is attributable. An egress policy configured for the first customer is used to determine whether the traffic is allowed to be transmitted to a destination where that destination is a resource of a second customer. If the traffic is allowed to be transmitted, the traffic and identity information is transmitted over a cross-customer GRE tunnel to a namespace of the second costumer on the compute server. An ingress policy configured for the second customer is used to determine whether the traffic is allowed to be transmitted to the destination, and if it is, then the traffic is transmitted.