Cloudflare

Abstract A claim is granted over a partition to a consumer. The claim is valid for a period and allows only that consumer to consume data of the partition during the period. The consumer consumes the data until the claim expires or the data in the partition is fully consumed. If the consumer fully consumes the data of the partition prior to the claim expiring, another claim can be granted over another partition to the consumer. Once the claim over the partition expires, the partition is available to be claimed by another consumer.

Abstract A server receives a request for a network resource from a client network application. The server retrieves the network resource and detects an online advertisement tag in it. The server determines that it has access to an identity cookie for the requesting client. The server modifies the network resource including causing the tag from being processed directly by the client and adds a reference to a client-side script that will inject the online advertisement into the modified network resource. The server transmits a request for the online advertisement to an advertisement supply source, transmits a push-promise to the requesting client for the client-side script, and transmits the modified network resource to the requesting client. The server receives, from the advertisement supply source, a response to the request for the online advertisement. The server transmits the client-side script to the requesting client without receiving a separate request for the client-side script.

Abstract Controlling access to external capabilities exposed by a resource server for artificial intelligence models. An access server receives an authorization request from a resource client for authorization of a resource server. The access server determines a set of capabilities associated with the resource server and enforces access policies to identify permitted capabilities subject to user consent. A consent page is presented to the user agent for selective approval of capabilities. After receiving user consent, the access server generates an access token that is capable of being used as a credential for the consented capabilities. Subsequent requests from the resource server are validated and routed to the appropriate capabilities, with responses returned accordingly.

Abstract A condition exists that triggers an HTTP server to modify one or more HTTP connections for one or more HTTP clients that are connected to the HTTP server. The HTTP server dynamically modifies the one or more HTTP connections including dynamically modifying one or more runtime behaviors for the one or more HTTP connections. For each of the one or more HTTP clients, the HTTP server monitors that HTTP client to determine whether it is complying with the modified one or more runtime behaviors. If one of the one or more HTTP clients is not complying with the modified one or more runtime behaviors, the HTTP server performs a mitigation action on that HTTP client.

Abstract An intermediary server operates an application proxy. An access request is received for access to an application, where an access policy is associated with the application that specifies authentication method(s) acceptable for satisfying an authentication requirement enforced by the application proxy. The user agent is redirected to submit an authentication request to an identity provider for identity verification. An authentication response generated by the identity provider is received and includes information that specifies authentication method(s) used during the identity verification. If the authentication method(s) used during the identity verification match the authentication method(s) acceptable for satisfying the authentication requirement, the user will not be prompted to perform those authentication method(s) and the authentication requirement enforced by the application proxy is met. If they do not match, the user will be prompted to perform the authentication method(s) as a condition to access the application.

Abstract Traffic is received at a distributed cloud computing network. The traffic originates from a computing device using a mobile data connection. The traffic is associated with an identifier that identifies a SIM of the computing device. Using the SIM identifier, an identity for identity-based policy enforcement at the distributed cloud computing network is determined. The identity is uniquely associated with the SIM identifier. An identity-based policy that is applicable for the received traffic for the determined identity is determined. The identity-based policy is enforced.

Abstract A server receives from a client device that is executing a client application a request to initiate a remote application in the server. The server instantiates an instance of the remote application. The server intercepts draw commands associated with the remote application instance. The server provides the draw commands to the client to cause the client application to render portion(s) of output based on the draw commands. The server receives an input event from the client application. The server provides the client one or more draw commands based on the input event to cause the client application to render portion(s) of output based on those draw commands.

Abstract Methods, systems, and techniques for application isolation by remote-enabling applications are provided. Example embodiments provide an Adaptive Rendering Application Isolation System (“ARAIS”), which transparently enables applications to run in an isolated execution environment yet be rendered locally in a manner that facilitates preventing theft of sensitive information while allowing users to interact with any third-party application or website via the local environment without overburdening available bandwidth or computational resources by, in some cases, evaluating only select information responsive only to select events, as compared to whitelist/blacklist techniques, monitoring all information provided by the user, or other techniques. The ARAIS typically includes an orchestrator server that comprises one or more of a sensitive-information theft-prevention logic engine, information-theft prevention engines, or a rules engine. These components cooperate to deliver isolation-ready technology with sensitive-information theft prevention to client applications.