GB2508086A - Enterprise network applying enterprise policies to secure WebRTC interactive sessions - Google Patents

Abstract

A method for applying an enterprise policy to a WebRTC interactive session comprises receiving by a distributed policy enforcement agent 12 of a recipient device 28, a WebRTC session description object directed to the recipient device originating from a sender device 40 via a secure network connection 52. The method further comprises the distributed policy enforcement agent determining, through reference to an enterprise policy data store 26 associated with the enterprises demilitarized zone (DMZ) policy enforcement point 22 for controlling enterprise firewalls, one or more enterprise policies based on the WebRTC session description object. These one or more enterprise policies are then applied to the WebRTC session description object. In this manner, an enterprise may permit establishment of a secure, encrypted WebRTC interactive session that crosses an enterprise network boundary, while at the same time ensuring that the WebRTC interactive session complies with the one or more enterprise policies.

Description

DISTRIBUTED APPLiCATION OF ENThEPRISE POLICIES TO WEB REAL-TIME COMMUNICATIONS (WEBRTC) INTERACTIVE SESSIONS, AND RELATED METHODS, SYSTEMS, AND COMPUTER-READABLE MEDL4 Pmonn' ArnicATtoNs 100011 The present application claims priority to U.S. Provisional Patent Application Serial No. 61/706,951 filed September 28, 2012, and entitled 4'ENTERPRISE

COMMUNICATIONS AND COLLABORATION SYSTEMS BASED ON REAL-TIME

COMMUNICATIONS AND/OR MARKUP PROTOCOL& AND RELATED METHODS, APPARATUSES, AND COMPUTER-READABLE MEDIA," and to U.S. Provisional Patent Application Serial No, 611781,122 filed on March 14, 2013, and entitled "DISTRIBUTED APPLICATION OF ENTERPRISE POLICIES TO WEB REAL-TIME COMMUNICATIONS (WEBRTC) INTERACTIVE SESSIONS, AND RELATED METHODS, SYSTEMS. AND COMPUTER-READABLE MEDIA," which are hereby incorporated herein by reference in theft entireties.

BAaGRQUND

Field of the Discloaure

[0002] The technology of the disclosure relates generally to Web Rea-Time Communications (WebRTC) interactive sessions.

Technical Background

[0003] Web Real-Time Communications (WebRTC) is an ongoing effort to develop industry standards for integrating real-time communications functionality into web clients, such as web browsers, to enable direct interaction with other web clients. This real-time communications functionality is accessible by web developers via standard markup tags, such as those provided by version 5 of the Hypertext Markup Language (HTML5), and client-side scripting Application Programming Interfaces (APIs) such as JavaScript APIs.

More information regarding WebRTC may be found in "WebRTC: APIS and RTCWEB Protocols of the HTML5 Real-Time Web," by Alan B. Johnston and Daniel C. Burnett (2012 Digital Codex LLC), which is incorporated in its entirety herein by reference.

[0004] WebRTC provides builtin capabilities for establishing real-time video, audio, and/or data streams in both point4o-point interactive sessions2 as well as multi-party interactive sessions. The. WebRTC standards are currently under joint development by the World Wide Web Consortium (W3C) and the Internet Engineering Task Force (IETF).

Information on the current state of WebRTC standards can be found at, e.g, http://www.wSc.org and http://www/ietf.org.

[0005] To establish a WebRTC interactive session (e.g, a real-time video, audio, and/or data exchange), two web clients may retrieve WebRTC-enabled web applications, such as HTML5/JavaScript web applications, from a web application server. Through the web applications, the two web clients then engage in a media negotiation to communicate and reach an agreement on parameters that define characteristics of the interactive session, This media negotiation is known as a WehRTC "offer/anawe?' exchange. A WebRTC coffer/answer" exchange typically occurs via a secure network connection such as a Hypertext Transfer Protocol Secure (HTPS) connection or a Secure WebSockets connection. In an offer/answer exchange, a first web client on a sender device sends an "offer" to a second web client on a recipient device. The offer includes a WebRTC session description object that specifies media types and capabilities that the first web client supports and prefers for use in the WebRTC interactive session. The second web client then responds with a WebRTC session description object "answer" that indicates which of the offered media types and capabilities are supported and acceptable for the WebRTC interactive session. Once the WebRTC offer/answer exchange is complete, the web clients may then establish a direct "peer connection" with one another, and may begin an exchange of media or data packets transporting the realtime communications. The peer connection between the web clients typically employs the Secure Real-time Transport Protocol (SRTP) to transport real-time media flows, and may utilize various other protocols for real-time data interchange [0006] The secure namre of a WebRTC offer/answer exchange and peer connection poses challenges for real-time communications across enterprise network boundaries. To determine whether to allow traffic to cross network edges, enterprises often rely on network security elements (e.g., firewalls and session border controllers (SBCs)). These network security elements hay examine protocols at various levels in a network stack, including the a acnial content of the network traffic, Such in-depth analysis of network traffic may enable an enterprise to apply enterprise policies to achieve fine-grainS control over the network raffle, However, because the WebRTC offer/answer exchange and peer connection may take place over secure network connections or otherwise be encrypted, the WebRTC session description objects and the WebRTC interactive flow exchanged between the web clients may be opaque to the enterprise. Thus, the enterprise may lack the ability to apply enterprise policies to a WebRTC interactive session using conventional network security elements. The secure nature of WebRTC may also present risks to the enterprise in the form of a new path for attack by virus vectors and/or maiware.

SUMMARY OF THE DEnILEU DESCRIYflON

[0fl07] Embodiments disclosed in the detailed description provide distributed application of enterprise policies to Web Real-Time Communications (WebRit) interactive sessions. Related methods, systems, and computer-readable media are also disclosed. In this regard, in one embodiment, a method for applying an enterprise policy to a WebRTC interactive session is provided. The method comprises receiving, by a distributed policy enforcement agent of a recipient device, a WebRTC session description object directed to the recipient device originating from a sender devke, The method further comprises detenatning by the distributed policy enforcement agent. one or more enterprise policies based on the WebRTC session description object. The method also comprises applying the one or more enterprise policies to the WebRTC session description object.

Use of the distributed policy enforcement agent of the recipient device allows in-depth analysis of the contents of the WebRl'C session description obiect, including the packets transporting the WebRTC session description object, after it is received at the recipient device and before a WebRTC interactive session is established, in this manner, an enterprise may permit establishment of a WebRTC interactive session that crosses an enterprise network boundary while at the same time ensuring that the WebRTC interactive session complies with the one or more enterprise policies.

(0008] In another embodiment, a system for applying an enterprise policy to a WebRTC interactive session is provided. The system comprises at least one communications interface, and a recipient device associated with the at least one comnurnications interface and comprising a distributed policy enforcement agent. The distributed policy enforcement agent is configured to receive a WCbRTC session description object directed to the recipient device originating from a sender device via a secure network connection. The distributed policy enforcement agent is further configured to determine one or more enterprise policies based on the WebRTC session description object. The distributed policy enforcement agent is also configured to apply the one or more enterprise policies to the WebRTC session description object.

[0009] In another embodiment, a non-transitory computer-readable methum is provided. The non-transitoiy computer-readable medium has stored thereon computer-executable instructions to cause a processor to implement a method comprising rcceivingt by a distributed policy enforcement agent of a recipient device, a WebRTC session description object directed to the recipient device originating from a sender device. The method implemented by the computer-executable instructions further comprises determining, by the distributed policy enforcement agent, one or more enterprise policies based on the WebRTC session description object. The method implemented by the computer-executable instructions also comprises applying the one or more enterprise

policies to the WebRTC session description object.

ThUEF DESCRtVUON OF TUE FIGCRIiS (00101 The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the disclosure, and together with the description

serve to explain the principles of the disclosure.

[00111 Figure 1 is a conceptual diagram showing an exemplary "triangle" topology of a Web Real-Time Conimunicadons (WebRTC) interactive session between an enterprise web client on a recipient device including a distributed policy enforcement agent and an external web client on a sender device; (0012] Figure 2 is a diagram illustrating exemplary communications flows within an exemplary system including a distributed policy enforcement agent of a recipient device; (0013] Figure 3 is a flowchart illustrating exemplary operations for distributed application of enterprise policies to WebRTC interactive sessions; [0014] Figures 4A and 413 tire flowcharts illustrating more detailed exemplary operations for distributed application of enterprise policies to WebRTC session description objects and interactive flows; [OOl5J Figure 5 is a flowchart illustrating exemplary operations for distributed application of enterprise policies to WebRIC interactive flows; and (0016] Figure 6 is a block diagram of an exemplary processor-based system that may include the distributed policy enforcement agent of Figure 2.

L)n'AILED DEsclun'ON [0017] With reference now to the drawing figures, several exemplary embodiments of the present disclosure are described, The word "exemplary" is used herein to mean sexving as an example, instance, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments.

(0018] Embodiments disclosed in the detailed description provide distributed application of enterprise policies to Web Rea1Time Communications WebRTC) interactive sessions. Related methods, systems, and computer-readable media are also disclosed. In this regard, in one embodiment, a method for applying an enterprise policy to a WebRTC interactive session is provided. The method comprises receiving, by a distributed policy, enforcement agent of a recipient device, a WebRTC session description object directed tote recipient device originating from a sender device. The method further comprises determining, by the distributed policy enforcement agent, one or more enterprise policies based on the WebRTC session description object The method also comprises applying the one or more enterprise policies to the WebRTC session description objectS Use of the distributed policy enforcement agent of the recipient device allows in4epth analysis of the contents of the WebRTC session description okiect, including the packets transporting the WebRTC session description object, after it is received at the recipient device and before a WebRTC interactive session is established, In this manner, an enterprise may permit establishment of a WebRTC interactive session that crosses an enterprise networl boundary, while at the same time ensuring that the WebRTC interactive session complies with the one or more enterprise policies.

[0019] In this regard, Figure 1 shows an exemplary interactive communications system providing distributed application of enterprise policies as disclosed herein, In particular, the exemplary system 10 includes a distributed policy enforcement agent 12 that provides a point at which enterprise policies may be applied to \VebRiC interactive sessions, which otherwise may be inaccessible to enterprise network security elements. As used herein, the team "distributed" in the context of the distributed policy enforcement agent 12 refers to the application of enterprise policies taking place at one or more WebRTC interactive session endpoints, rather than at a centralized network security element.

[6020] As seen in Figure 1, the exemplary system 10 includes an enterprise network 14 providing networked computing and communications resources to users within an enterprise. As used herein, an "enterprise" refers to any organization for the purpose of a business venture or other organized activity, private or public. The enterprise network 14 includes an enterprise "demilitarized zone" (DMZ) 16 to secure the enterprise network 14 while permitting both enterprise users and external users access to enterprise resources (not shown) within the enterprise DMZ 16. The enterprise DMZ 16 may provide an outer firewall 13 that prevents unauthorized access to the enterprise network 14 by users outside the enterprise netWork 14. The enterprise DMZ 16 nay also provide an inner firewall 20 that permits only external traffic passing through the enterprise DMZ 16 to reach users [0021) The enterprise DMZ 16 of Figure 1 may further include a DMZ policy enforcement point 22. The DMZ policy enforcement point 22 filters or alters network trafflc passing through the enterprise DMZ 16 in accordance with enterprise policies2 As indicated by bidirectional arrow 24, the DMZ policy enforcement point 22 may be communicatively coupled to an enterprise policy data store 26 that provides a central point for storage, maintenance, and dissemination of enterprise policies. As is commonly understood, an enterprise policy is a formulation of rules that defines levels of permission and access rights in order to secure data, control user access, and regulate traffic within the enterprise network 14. Virtually all aspects of activity within the enterprise network 14 may be subject to enterprise policies. As non-limiting examples, enterprise policies may specify users that have been granted access to the enterprise network 14, external websites that enterprise users may or may not access, or types of allowed or disallowed network traffic. It is to be understood that the enterprise DMZ 16 may include additional elements not illustrated in Figure 1, or may integrate multiple elements illustrated in Figare I into a single element, [00221 The ability of the DMZ policy enforcement point 22 to apply enterprise policies to network traffic passing through the enterprise DMZ 16 may depend on whether the network traffic i-s unencrypted, or is transported in an encrypted format. In the former scenario, the DMZ policy enforcement point 22 may analyze various protocols within the network stack and/or the actual content of the network traffic, and apply enterprise policies to the network traffic based on its analysis. However, in the latter scenario, the DMZ policy enforcement point 22 may have access only to liSted information about the network traffic, such as a source Internet Protocol (IF) address, a destination IP address, a source port number, a destination port number, and/or a network protocol in use, In such case, the DMZ policy enforcement point 22 may be forced to apply enterprise policies based only on this limited information, Moreover, even where the network traffic is unencrypted, the DMZ policy enforcement point 22 may not be capable of applying enterprise policies at an endpoint within the enterprise network 14 based on data received at the endpoint.

Accordingly, as discussed in greater detail below, the distributed policy enforcement agent 12 is provided to enable the enterprise to enforce enterprise policies at an endpoint within the enterprise network 14, based on an indepth analysis of packets and their contents received at the endpoinL [0023] Before discussing details of the distributed policy enforcement agent 12, the establishment of a WebRTC interactive session in the system 11) of Fig-tire I is first described. As used herein, a WebRTC interactive session refers to operations for carrying out a WebRTC offer/answer exchange, establishing a peer connection, and commencing a WebRTC interactive flow between two or more endpoints. A WebRTC interactive flow may comprise an interactive media flow and/or an interactive data flow between the two or more endpoints. Within the enterprise network 14 of Figure 1 is an enterprise user device 28 executing an enterprise web client 30. In some embodiments, the enterprise user device 28 may be any computing or communications device having netwoEk communications capabilities, such as a smartphone. a tablet computer, a dedicated web appliance, or a desktop computer, as non-limiting examples. The enterprise web client 30 in this example a may be a web browser application, a dedicated communications application, or an interface4ess application such as a daemon or service application, as non-limiting exarnpleL [0024] In this embodiment, the enterprise web client 30 comprises a scripting engine 32 and a WebRTC functionality provider 34. The scripting engine 32 enables client-side applications written in a scripting language, such as JavaScript, to be executed within the enterprise web client 30. The scripting engine 32 also provides an application programming interface (API) to facilitate communications with other functionaihy providers within the enterprise web client 30 and/or the enterprise user device 28, and/or with other web clients, user devices, or web servers. The WebRTC functionality provider 34 implements the protocols, codecs, and APIs necessary to enable real-time interactive sessions via WebKTC, The scripting engine 32 and the WebRTC functionality provider 34 are communicatively coupled via a set of defined APIs, as indicated by bidirectional arrow 35.

[00251 The enterprise network 14 may also include an enterprise device 36, which is communicatively coupled to the WehRTC functionality provider 34 as indicated by bidirectional arrow 37. As discussed in greater detail below, the enterprise device 36 may be operative to record, log, or redirect a WebRTC interactive flow received from the WebRTC functionality provider 34 according to enterprise policies.

[00261 External to the enterprise network 14 is a web application server 38, which serves a WebRTC-enabled web application (not shown) to requesting web clients. In some embodiments, the web application server 38 may be a single server, while in some applications the web application server 38 may comprise multiple servers that are communicatively coupled to each other. It is to be understood that the web application server 38 may reside in the enterprise DMZ 16 of the enterprise network 14, or may reside within an enterprise DMZ of an enterprise network external to the enterprise network 14.

[0027] Also external to the enterprise network 14 is an external user device 40 executing an exteinal web client 42. The external user device 40 may be any computing or communications device having network communications capabilities, such as a smartphone, a tablet computer, a dedicated web appliance, or a desktop computer, as non-limiting examples. The external web client 42 may be a web browser application, a dedicated communications application, or an interface4ess application such as a daemon or service application, as non-limiting examples. Th this embodiment, the external web client 42 comprises a scripting engine 44 and a WebRTC functionality provider 46, the functionality of which corresponds to the functionality of the scripting engine 32 and the WebRTC functionality provider 34 of the enterprise web client 30, respectively. The scripting engine 44 and the WebRTC functionality provider 46 are communicatively coupled via a set of defined APIs, as indicated by bidirectional arrow 4& It is to be further understood that the external web client $2 may reside wilbin an enterprise network external to the enterprise network 14.

[0028J Figure 1 further illustrates the characteristic WebRTC "triangle" topology that results from establishing a WebRTC interactive session between the enterprise web client and the external web client 42. To establish a WebRTC interactive session, the enterprise web client 30 and the external web client 42 both download the same WebRit web application (not shown) from the web application server 38. in some embodiments, the WebRTC web application comprises art HTMLS/JavaScript web application that provides a rich user interface using HTML5, and uses JavaScript to handle user input and to communicate with the web application server 38.

[0929] The enterprise web client 30 and the external web client 42 then establish secure web connections 50 and 52, respectively, with the web application server 38, and engage in a WebRTC offer/answer exchange. This is accomplished through an exchange of WebRTC session description objects indicated by an-ows 54 and 56. The exchanged WebRTC session description objects 54 and 56 are used to determine the media types and capabilities for the desired WebRTC interactive session. Once the WebRTC offer/answer exchange is complete, a WebRTC interactive flow 58 may he established via a secure peer connection between the enterprise web client 30 and the external web client 42. Accordingly in Figure 1 the vertices of the WebRTC "triangle" are the web application server 38. the outer firewall 18 (which serves as the outer edge of the enterprise network 14 through which the enterprise web client 30 communicates), and the external web client 42, The edges of the "triangle" are represented by the secure web connections 50 and 52 and the secure peer connection 60.

[0030] it is to be understood that some embodiments may utilize topographies other than the WebRTC "triangle" topography illustrated in Figure 1. For example, some embodiments may employ a "trapezoid" topography in which two web servers communicate directly with each other via protocols such as Session Initiation Protocol (SIP) or Jingle, as non-limiting examples. It is to be further understood that, instead of the enterprise web client 30 and/or the external web client 42, the enterprise user device 28 and/or the external user device 40 respectively may comprise a SIP client device, a Jingle client device, or a Pabllc Switched Telephone Network (PTSN) gateway device that is communicatively coupled to a telephone.

[0031] As seen in Figure 1, the WebRTC session description object 54 received by the enterprise web client 30 from the external web client 42 during the %\TebRTC offer/answer exchange as well as the resulting WebRTC interactive flow 58 must pass through the enterprise DMZ 16 via the secure web connection 50 and the secure peer connection 60, respectively. Consequently, the DMZ policy enforcement point 22 is not aware of the actual contents of the WebRTC session description object 54 or the WebRTC interactive flow 58 received by the enterprise web client 30. Thus, the DMZ policy enforcement point 22 cannot apply enterprise policies to the WebRTC interactive session based on the content o the WebRTC session description object 54 or the WebRTC interactive flow 58.

[00321 In this regard, the distributed policy enforcement agent 12 of Figure 1 is provided. In some embodiments, the distributed policy enforcement agent 12 is implemented as an extension or plug-in for the enterprise web client 30 for receiving and processing packets received by the enieprise web client 30. In the case of encrypted network traffic, the distributed policy enforcement agent 12 is able to access the content of the encrypted network traffic after it is decrypted within the enterprise web client 30. The distributed policy enforcement agent 12 may also access data provided by the packets transporting the network traffic, such as a source Internet Protocol (I?) address, a destination I? address, a source port number, a destination port number, and/or a network protocol in use, as non4imiting examples. Accordingly, during establishment of a WebRTC interactive session, the distributed policy enforcement agent 12 receives a WebRTC session description object 54 transported over the secure web connection 50. The distributed policy enforcement agent 12 then determines and applies enterprise policies based on the WebRTC session description object 54, including the content of the WebRTC session description object 54 and/or data prvvided by the packets transpothng the WebRTC session description object 54. In the case of unsecured network traffic, the distributed policy enforcement agent 12 may similarly analyze the WebRTC session description object 54 for the purpose of applying enterprise policies at the enterprise web client 30. As non-limiting examples, the distributed policy enforcement agent 12 may apply enterprise policies via one or more of the following methods: validating the WebRTC session description object format; establishing or declining a WebRTC interactive session; providing options for an alternative WebRTC interactive session to the external user device 40; modifyIng the contents of a WebRTC session description object; and/or causing a WebRTC interactive flow to be redirected, cloned, logged, or recorded.

[00331 In some embodiments, the distributed policy enforcement agent 12 is communicatively coupled to the scripting engine 32, as indicated by bidirectional nn'ow 62 in Figure 1. Som.e embodiments may provide that the disthbuted policy enforcement agent 1.2 is ftrther communicatively coupled to the enterprise policy data store 26 via a communications link 64. In this manner, the distributed policy enforcement agent 12 may query the enterprise policy data store 26 for enterprise policies to apply to the secure web connection 50. Sonic embodiments may provide that data exchanged between the external user device 40 and the enterprise user device 28, as part of establishing the secure peer connection 60 or as part of the WebRTC interactive flow 58, is received and analyzed by the distributed policy enforcement agent 12 before being passed to the WebRTC functionality provider 34. As discussed below, this may permit the distributed policy enforcement agent 12 to apply enterprise policies during the establishment of the secure peer connection 60 and!or during the exchange of the WebRTC interactive flow 58. In embodiments where the WebRTC interactive flow 58 comprises an interactive data interchange, the distributed policy enforcement agent 12 may examine the contents of the WebRTC interactive flow 58 to detect maiware, viruses, or unauthorized enterprise intellectual property, as non4imiting examples.

(00341 To illustrate exemplary communications flows during the establishment of a WebRTC interactive session including the distributed policy enforcement agent 12 of Figure 1, Figure 2 is provided. In Figure 2, the enterprise policy data store 26. the enterprise web client 30 on the enterprise user device 28, the web application server 38, and the external web client 42 on the external user device 40 of Figure 1 are each represented by vertical dotted lines. The WebRTC functionality provider 34, the scripting engine 32, and the distributed policy enforcement agent 12 of the enterprise web client 30 are shown as separate elements to better illustrate communications flows therebetween, It is to be understood that the external web client 42 may comprise a scripting engine 44 and a WebRTC functionality provider 46, which for the sake of clarity are omitted from this example, It is to be further understood that, in this example, the distributed policy enforcement agent 12 on the enterprise user device 28 examines the WebRTC session description object received from the external user device 40. Accordingly, the enterprise user device 28 is considered the "recipient" device, while the external user device 40 is considered the "sender" device, Finally, it is assumed for this example that the enterprise web client 30 and the external web client 42 have each downloaded a WebaTCcnabled web application; ludi as an}ITMLS/JavaScript WebRTC application, from the web application server 38.

[0035] As seen in Figure 2, the establishment of a WebRTC interactive session begins with the external web client 42 sending a session description object (SDP) to the web application server 38 in an encrypted format (in this example, via an HTFPS connection).

In this example, the WebRTC session description object is referred to as SDP Object A and is indicated by arrow 66. SDP Object A represents the offer" in a WCbRTC offer/answer exchange. SDP Object A specifies the media types and capabilities that the external web client 42 supports, and prefers for use in the WebRTC interactive session. The web application server 33 forwards the SDP Object A by a secure web connection to the distributed policy enforcement agent 12 of the enterprise web client 30 of the enterprise user device 28, as indicated by an'ow 68.

[00361 As noted above, the distributed policy enforcement agent 32 may access the contents of network traffic received over a secure web connection after the network traffic has been decrypted, and may additionally examine data provided by the packets transporting the network traffic. Thus, the distributed policy enforcement agent 12 is able to examine the contents of the SDP Object A as well as data provided by packets transporting the SDP Object A. In some embodiments, the distributed policy enforcement agent 12 at this point may compare the format of the SDP Object A to an expected WebRTC session description object fomrnt, If the SD? Object A does not conform to the expected fonnat, the distributed policy enforcement agent 12 may discard SD? Object A, and a WebRTC interactive session will not be established. If the SOP Object A appears valid, then establishment of the WebRTC interactive session may continue.

[0037] Based on the contents of the SD? Object A, the distributed policy enforcement agent 12 sends a query for enterprise policies to the enterprise policy data store 26, as indicated by arrow70, The query may he based on or include data extracted from contents of the SD? Object A andfor other available data related to the SD? Object A, such as characteristics of or data in the packets comprising the SOP Object A As non$imiting examples, such data may include an identity associated with the external user device 40, an identity of an intermediary that forwarded the SD? Object A to the enterprise user device 23. an exchange of encryption keys, or a type of WebRTC interactive flow. In response to the query, the enterprise policy data store 26 returns the requested enterprise policies to the distributed policy enforcement agent 12, indicated by arrow 72 in Figure 2 The distributed policy enforcement agent 12 then applies the enterprise policies to the SD? Object A. In some embodiments, applying the enterprise policies to the SD? Object A may comprise the following: further validating the WebRTC session description object format; establishing or declining to establish a WebRTC interactive session; providing options to the external user device 40 for an alternative WebRTC interactive session; and/or modifying the contents of a WebRTC session description object, as non4imiting exampleL [00381 Assuming the enterprise policies applied by the distributed policy enforcement agent 12 permit the establishment of the WebRTC interactive session to proceed, the distributed policy enforcement agent 12 next passes the WebRTC session description object to the scripting engine 32 for conventional processing, as indicated by snow 74. As noted above, the distributed policy enforcement agent 12 may have modified the contents of SD? Object A in applying the enterprise policies. Thus, the WebRTC session description object forwarded to the scripting engine 32 is designated SD? Object A'.

[0039] After the scripting engine 32 receives the SOP Object A' from the distributed policy enforcement agent 12, the scripting engine 32 in response sends a WebRTC session description object, referS to as SOP Object B, to the distributed policy enforcement agent 12, as indicated by arrow 76. The SDP Object B in this example represents the "answef in the WebRTC offer/answer exchange. In some embodiments, the distributed policy enforcement agent 12 may apply enterprise policies by modifying a content of the SDF Object B prior to forwarding it on to the web application server 38. Accordingly, the WebRIC session description object forwarded by the distributed policy enforeement agent 12 is referred to as SDP Object B', SDP Object B' is sent to the web application server 38 via a secure network connection, as indicated by arrow 78. The web application server 38, in turn, forwards the SDP Object B' to the external user device 40, as shown by arrow 80.

[00401 With continuing reference to Figure 2, the external web client 42 on the external user device 40 and the enterprise web client 30 (in particular, the WebRTC functionality provider 34) then begin "hole punching" to determine the best way to establish direct communications. This is indicated by bidirectional arrows 82 and 83 in Figure 2. Hole punching is a technique, often using protocols such as Interactive Connectivity Establishment (ICE), in which both web clients establish a connection with an unrestricted thirdparty server (not shown) that uncovers external and internal address information for use in direct communications In this example, the distributed policy enforcement agent 12 may receive, analyze, and modify data exchanged as part of hole punching. For example, the distributed policy enforcement agent 12 may add or remove a Session Traversal Utilities for NAT (STUN) server and/or a Traversal Using Relays around NAT (TURN) server used by the enterprise user device 28 for hole punching. In this manner, the distributed policy enforcement agent 12 may apply enterprise policies to the WebRTC interactive session even after the WebRTC offer/answer exchange has concluded.

[0041) Once the hole punching indicated by arrows 82 and 83 is successful, the external web client 42 and the WebRTC functionality provider 34 of the enterprise web client 30 begin key negotiations to establish a secure peer connection (bidirectional arrow 84). Upon establishing a secure peer connection, the external web client 42 and the WebRTC functionality provider 34 of the enterprise web client 30 begin exchanging secure WebRTC media or data flows, as shown by bidirectional arrow 86.

[0042] To generally describe exemplary operations of the distributed policy enforcement agent 12 of Figure 1 for distributed application of enterprise policies to Web1flC interactive sessions, Figure 3 is provided. Figure 3 is a flowchart illustrating exemplary operations for distributed application of enterprise policies to WebRTC interactive sessions, In this example of Figure 3, operations begin with the distributed policy enforcement agent 12 receiving a WebRTC session description object directed to a recipient device (such as the enterprise user device 28) originating from a sender device (such as the external user device 40) via a secure network connection (block 88). In some embodiments, the WebRTC session description object received by the distributed policy enforcement agent 12 may represent an "offer" from the sender device in a WebRTC offer/answer exchange, or may represent an "answer" sent in response to a previously sent offer.

[0043] With continuing reference to Figure 3, the distributed policy enforcement agent 12 next determines one or more enterprise policies based on the WóbRTC session description object (block 90). In some embodiments, the enterprise policies may be determined based on a content of the WebRTC session description object, and/or on data provided by packets transporting the WebRTC session description object. According to some embodiments, the content of the WebRTC session description object and/or data provided by packets transporting the WebRTC session description object may include an identity associated with the sender device, an identity of an intennediary that forwarded the WebRTC session description object to the recipient device, an exchange of encryption keys, or a type of WebRTC interactive flow, Some embodiments may provide that the distributed policy enfortement agent 12 determines the one or more enterprise policies by sending a query for enterprise policies to an enterprise policy data store (not shown), such as the enterprise policy data store 26 of Figure 1.

[0044] With continuing reference to Figure 3, the distributed policy enforcement agent 12 applies the one or more enterprise policies to the WebRTC session description object (block 92). As non4imiting examples, the distributed policy enforcement agent 12 may apply the enterprise policies by validating the WebRTC session description object format, by establishing or declining a WebRTC interactive session, by providing options for an alternative WcbRTC intenctive session to the sender device, by modifying the contents of a WebRTC session description object, and/or by causing a WebRTC interactive flow to be redirected, cloned, logged, or recorded.

[0045] Figures 4A and 4f1 are provided to illustrate in more detail an exemplary generalized process for the distributed policy enforcement agent 12 of Figure 1 to provide distributed application of enterprise policies to WebRTC interactive sessions. Figure 4A details operations for receiving and validating a WebRTC offer/answer exchange, and determining appropriate enterprise policies to apply to a WebRTC interactive session, Figure 4B shows operations for applying the enterprise policies to the WebRTC offerlanswer exchange and a resulting WebRTC interactive flow. For illustrative purposes, Figures 4A and 4B refer to elements of the exemplary system 10 and the distributed policy enforcement agent 12 of Figure 1.

[0046] Referring now to Figure 4A, the distributed policy enforcement agent 12 receives a WebRTC session description object directed to a recipient device (such as the enterprise user device 28) originating from a sender device (such as an external user device 40) via a secure network connection (block 94). The WehRTC session description object received by the distributed policy enforcement agent 12 may represent an "offer" from the sender device in a WebRTC offer/answer exchange, or may represent an "answer" seat in response to a previously sent offer, The distributed policy enforcement agent 12 next determines whether the WebRTC session description object conforms to an expected WebRTC session description object format (block 96). If the distributed policy enforcement agent 12 determines that the WebRTC session description object fails to conform to an expected format, the distributed policy enforcement agent 12 may simply discard the WebRTC session description object (block 9). This may provide an extra measure of security against attack by maiware and/or viruses seeking access to the enterprise network 14 via a WehRTC interactive session.

[0047] If the distributed policy enforcement agent 12 determines at block 96 of Figure 4A that the WebRTC session description object is in an appropriate format, the distributed policy enforcemen agent 12 next determines one or more enterprise policies to enforce. In this example, the distributed policy enforcement agent i 2 queries an enterprise policy data store (such as the enterprise policy data store 26 of Figure 1) to determine one or more enterprise policies based on the WebRTC session description object (block 100). In some embodiments, the enterprise policies may be determined based on a content of the WebRTC session description object, and/or on data provided by packets transporting the WebRTC session description object. The content of the WebRTC session description object and/or the data provided by packets transporting the WebRTC session description object may include as nonlimidng examples an identity associated with the sender device, an identity of an intennediaxy that forwarded the WcbRTC session description object to the recipient device, an exchange of encryption keys, or a type of WebRIC interactive flow. In some embodiments, an identity associated with the sender device may include an identity of the Lender device, a user ID of the sender, and/or a name of the sender. The distributed policy enforcement agent 12 then receives one or more enterprise policies from the enterprise policy data store (block 102). Processing then continues at block 104 of Figure 413.

(00881 Referring now to Figure 48, the distributed policy enforcement agent 12 evaluates whether the WebRTC session description object complies with the one or more enterprise policies (block 104). As non-limiting examples, the enterprise policies may dictate what WebRTC interactive flow types are permitted. or may expressly allow or deny WebRTC interactive sessions based on an identit.y associated with the sender device or sender domain or identity. if the WebRTC session description object is determined not to comply with the one or more enterprise policies at block 10$, the distributed policy enforcement agent 12 may decline to establish a WebRTC interactive flow between the sender device and the recipient device (block 106). The distributed policy enforcement agent 12 may optionafly provide one or more options for an Mtemative WehRTC interactive flow to the sender device (block 108).

(0049] 11 the distributed policy enforcement agent 12 determines at block 104 that the WebRTC session description object complies with the one or more enterprise policies, the distributed policy enforcement agent 12 permits a secure peer connection to be established between the recipient device and the sender device, as discussed above with respect to Figure 2 (block 1 10). Ia some embodiments, establishing a secure peer connection may include the distributed policy enforcement agent 12 modifying one or moit ICE packets used in hole punching based on the one or more enterprise policies. The recipient device then receives a first WebRTC interactive flow originating from the sender device via the secure peer connection, and the WebRTC interactive session commences (block 112).

[005() In some embodiments, the distributed policy enforcement agent 12 nay optionally apply the one or more enterprise policies to the first WebRTC interactive flow (block 114). For example, the enterprise policies may require that the first %VebRTC interactive flow be recorded, logged, or redirected. Where the first WcbRTC interactive flow is an interactive data interchange, applying the one or more enterprise policies may include examining the contents of the interactive data interchange to determine compliance with the one or more enterprise policies.

(0051] In this regard, Figure 5 illustrates exempaiy operations for applying enterprise policies to a WebRTC interactive flow, as described in block 114 of Figure 48. In Figure 5, operations begin with the distributed policy enforcement agent 12 requesting that a second WebRTC interactive flow including data from the first WebRTC interactive flow be established between the recipient device and an enterprise device, such as the enterprise device 36 of Figure 1 (block 116). In response to the request, the second WebRTC interactive flow is received at the enterprise device (block 118). The second WebRTC interactive flow is then processed by the enterprise device in accordance with the one or more enterprise policies (block 120). In some examples, the second WebRTC interactive flow may be recorded or logged as required by the enterprise policies, or may be redirected to another device within the enterprise, nuch as a media anchor device (not shown).

(00521 Some embodiments may provide variations of the WebRTC topology described above with respect to Figure 5. For example, the distributed policy enforcement agent 12 may request that the first WebRTC interactive flow be established directly between an external user device and the enterprise device, and that the second WehRTC interactive flow be received at the recipient device. In some embodiments, the distributed policy enforcement agent 12 may access the contents of the first WebRTC interactive flow, and may apply enterprise policies by directly manipulating, redirecting, logging, or copying the contents of the first WebR.TC interactive flow as non-limiting examples.

(0053] Figure 6 provides a schematic diagram representation of a processing system 122 in the exemplary form of an exemplary computer system 124 adapted to execute instructions to perform the functions described herein. in sonic embodiments, the processing system 122 may execute instructions to perform the functions of the distributed policy enforcement agent 12 of Figure 1. in this regard, the processing system 122 may comprise the computer system 124. within which a set of instructIons for causing the processing system 122 to perform any one or more of We methodologies discussed herein may be executed, The processing system 122 may be connected (as a nonlimsting example, networked) to other machines in a local area network (LAN), an intranet. an extranet, or the Internet. The processing system 122 may operate in a clientserver network environment, or as a peer machine in a peertopeer (or distributed) network environment.

While only a single processing system 122 is illustrated, the terms "controlle?' and "server" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of hsstructions to perform any one or more of the methodologies discussed herein. The processing system 122 may be a server, a personal computer, a desktop computer, a laptop computer, a personal digital assistant (PDA), a computing pad, a mobile device, or any other device and may represent, as non4inliting examples, a server or a user's computer.

(0054] The exemplary computer system 124 includes a processing device or processor 126, a main memory 128 (as non$imiting examples, read'only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM), etc.), and a static memory 130 (as non4imiting examples, flash memory, static random access memory (SRAM), etc.), which may communicate with each other via a bus 132. Alternatively, the processing device 126 may be connected to the main memory 128 and/or the static memory 130 directly or via some other connectivity means.

OO5SJ The processing device 126 represents one or more processing devices such as a microprocessor, central processing unit (CPU), or the like. More particularly, the processing device 126 may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word VLIW) microprocessor, a processor implementing other instruction sets, or processors implementing a combination of instruction sets. The processing device 126 is configured to execute processing logic in instructions 134 and/or cached instructions 136 for performing the operations and steps discussed herein.

(00561 The computer system 124 may further include a communications interface in the form of a network interface device 138. It also may or may not include an input 140 to receive input and selections to be communicated to the computer system 124 when executing the instructions 134, 136. It also may or may not include an output 142, including but not limited to display(s) 144. The display(s) 144 may be a video display unIt (as non4imiting examples, a liquid crystal display (LCD) or a cathode ray tube (CRTB, an alphanumeric input device (as a non4imiting example, a keyboard), a cursor control device (as a non-limiting example, a mouse), and/or a touch screen device (as a non-limiting example, a tablet input device or screen).

[0057] The computer system 124 may or may not include a data storage device 145 that includes using drIve(s) 146 to store the functions described herein in a computer-readable medium 148, on which is stored one or more sets of instructions 150 (e,g., software) embodying any one or more of the methodologies or functions described herein. The functions can inclUde the methods and/or other functions of the processing system 122, a participant user device, and/or a licensing server, as non-limiting examples. The one or mom sets of instructions 150 may also reside, completely or at least partially, within the main memory 128 and/or within the processing device 126 during execution thereof by the computer system 124, The main memory 128 and the processing device 126 also constitute machine-accessible storage media. The instructionS 134, 136, and/or 150 may further be transmitted or received over a network 152 via the network interface device 13$. The network 152 may be an intra-network or an Inter-network, [00581 While the computer.readable medium 148 is shown in an exemplary embodiment to be a single medium, the term "machine-accessible storage medium" should be taken to include a single medium or multiple media (as non-limiting examples, a centralized or distributed database, and/or associated caches and servers) that store one or more sets of instructions, The term "machine-accessible storage medium." shall also be taken to include any medium that is capable of storing, encoding, or carrying a set of instructions for execation by the machine, and that cause the machine to perform any one or more of the methodologies disclosed herein, The term ".machineaccessible storage medium" shall accordingly be taken to include, but not be limited to, solid-state memories, optical and magnetic media, and can'ier wave signals.

[0059] The embodiments disclosed herein may be embodied in hardware and in instructions that are stored in hardware, and may reside, as non-limiting examples, in Random Access Memory (RAM.), flash memory, Read Only Memory (ROMX Electrically Programmable ROM (EPROM). Electrically &asable Programmable ROM (EEPROM).

registers, a hard disk, a removable disk, a CD-ROM, or any other form of computer readable medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the prncessor The processor and the storage medium may reside in an Application SpecifIc integrated Circuit (ASlC) The ASIC may reside in a remote station, in the alternative, the processor and the storage medium may reside as discrete components in a remote station, base station, or server, [0060] It is also noted that the operational steps described in any of the exemplary embodiments herein are described to provide examples and discussion. The operations described may be performed in numerous different sequences other than the Iflusb'ated sequenceL Furthermore, operations described in a single operational step may actually be performed in a number of different steps. Additionally one or more operational steps discussed in the exemplary embodiments may be combined, It is to be understood that the operational steps illustrated in the flow chart diagrams may be subject to numerous different modifications as will be readily apparent to one of skill in the art. Those of skill in the art would also understand that infomiation and signals may be represented using any of a variety of different technologies and techniquet As non-limiting examples, data.

instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, custents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereot [0061] The previous description of the disclosure is provided to enable any person skilled in the art to make or use the disclosure, Various modifications to the disclosure will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other variations without departing from the spirit or scope of the disclosure Thus, the disclosure is not intended to be limited to the examples and designs described herein, but is to he accorded the widest scope consistent with the principles and novel features disclosed herein,

Claims (24)

1. What is claimed is: 1. A method for applying an enterprise policy to a Web R.ealTime Communications (WebRTC) interactive session, comprising: receiving, by a distributed policy enforcement agent of a recipient device, a WebRTC session description object directed to the recipient device originating from a sender device; detemiining by the distributed policy enforcement agent, one or more enterprise policies based on the WebRTC session description object; and applying the one or more enterprise policies to the WebRTC session description object.
2. 2 The method of claim I, wherein receiving the WCbRTC session description object comprises receiving the WebRTC session description object via a secure network connection.
3. 3. The method of claim 1, further comprising: determining whether the WebRTC session description object conforms to an expected WebRTC session description object format; and responsive to determining that the WebRTC session description object does not cortfonn to the expected WebRTC session description object format,discarding the WebRTC session description object
4. 4. The method of claim 1. wherein detenrdning the one or more enterprise policies comprises: querying an enterprise policy data store by the distributed policy enforcement agent; and responsive to the querying, receiving by the distributed policy enforcement agent the one or more enterprise policies from the enterprise policy data store.
5. 5, The method of claim 1, wherein determining the one or more enterprise policies based on the WebRTC session description object comprises determining the one or more enterprise policies based on an identity associated with the sender device, an identity of an intermediary that forwarded the WebRTC session description object to the recipient device, an exchange of encryption keys, or a type of WebRTC interactive flow, or combinations thereof.
6. 6. The method of claim I, wherein applying the one or more enterprise policies to the WebRTC session description object comprises determining whether the WebRTC session description object complies with the one or more enterprise policies.
7. 7. The method of claim 6, further comprising, responsive to determining that the WCbRTC session description object complies with the one or more enterprise policies, establishing a first WebRTC interactive flow between the sender device and the recipient device,
8. S. The method of claim 7, wherein establishing the first WebRTC interactive flow comprises: establishing a secure peer connection between the recipient device and the sender device; receiving, at the recipient device, the first WebRTC interactive flow originating from the sender device via the secure peer connection; and applying the one or more enterprise policies to the first WebRTC interactive flow.
9. 9. The method of claim 8, wherein establishing the secure peer connection comprises modifying one or more Interactive Connectivity Establishment (ICE) packets based on the one or more enterprise policies,
10. 10. The method of claim 8, wherein the first WebRTC interactive flow is an interactive data interchange; and wherein applying the one or more enterprise policies to the rust WebRTC interacdve flow comprises examining the contents of the interactive data interchange to determine compliance with the one or more enterprise policies.
11. 11. The method of claim 3, wherein applying the one or more enterprise policies to the first WebRTC interactive flow comprises: requesting, by the distributed policy enforcement agent, that a second WebRTC interactive flow including data from the first WebRIC interactive flow be established between the recipient device and an enterprise device; receiving, at the enterprise device, the second WebRTC interactive flow; and processing, by the enterprise device, the second WebRTC interactive flow in accordance with the one or more enterprise policies.
12. 12. The method of claim 6, further comprising, responsive to detennining that the WebRTC session description object does not comply with the one or more enterprise policies, decinina to establish a WCbRTC interactive flow between the sender device and the recipient device.
13. 13. The method of claim 6, further comprising, responsive to determining that the WSRTC session description object does not comply with the one or more enterprise policies, providing one or more options for an alternative WebRTC interactive flow to the sender device.
14. 14. A system for applying an enterprise policy to a Web Real-Time Communications (WebRTC) interactive session, comprising: at least one communications interface; and a recipient device associated with the at least one communications interface and comprising a disuibuted policy enforcement agent, the distributed policy enforcement agent configured to: receive a WebRTC session description object directed to the recipient device originating from a sender device; determine one or more enterprise policies based on the WebRTC session description obiect; and apply the one or more enterprise policies to the WebltTC session description object
15. 15. The system of claim 14, wherein the. distributed policy enforcement agent is further configured to: determine whether the WebRTC session description object conforms to an expectedWebRTC session description object fonnat; andresponsive to determining that the WehRTC session description object does not conform to the expected WebRTC session description object format, discardthe WebRTC session description object.
16. 16. The system of claim 14, wherein the distributed policy enforcement agent is configured to determine the one or more enterprise policies by: querying an enterprise policy data store; and responsive to the querying, receiving the one or more enterprise policies from the enterprise policy data store.
17. 17. The system of claim 14, wherein the distributed policy enforcement agent is configured to apply the one or morn enterprise policies to the WebRTC session description object by determining whether the WebRTC session description object compiles with the one or more enterprise policies.
18. 18. The system of claim 17, wherein the distributed policy enforcement agent is further configured to, responsive to determining that the WebRTC session description object complies with the one or more enterprise-policies, establish a first WebRTC interactive flow between the sender device and the. recipient device,
19. 19. The system of claim 18, wherein the distributed policy enforcement agent is configured to establish the first WebRTC interactive flow by: establishing a secure peer connection between the recipient device and the sender device; receiving, at the recipient device, the first WebRTC interactive flow originating from the sender device via the secure peer connection; and applying the one or more enterprise policies to the first WCbRTC interactive flow.
20. 20. A non-transitory computer-readable medium having stored thereon computer-executable instructions to cause a processor to implement a method, comprising: receiving, by a distributed policy enforcement agent of a recipient device, a Web Real-Time Communications (WebRTC) session description object directed to the recipient device orìgrnatmg from a sender device via a secure network connection; determining, by the distributed policy enforcement agent, one or more enterprise policies based on the WebRTC session description object; and applying the one or morn enterprise policies to the WebRTC session description object.
21. 21. The non-transitory computeNreadable medium of claim 20 having stored thereon the computer-executable instructions to cause the processor to implement the method, further comprising: determining whether the WebRTC session description object conforms to an expected WebRTC session description object format; and responsive to determining that the WebRTC session description object does not conform to the expected WebRTC session description object format,discarding the WebRTC session description object.
22. 22, The non-transitory computer-readable medium of claim 20 having stored thereon the computer-executable instructions to cause the processor to implement the methods wherein determining the one or more enterprise policies comprises: querying an enterprise policy data store by the distributed policy enforcement agent; and responsive to the queying, receiving by the distributed policy enforcement agent.the one or more enterprise policies from the enterprise policy data store.
23. 23. The non-transitory computer-readable medium of claim 20 having stored thereon the computer-executable instructions to cause the processor to implement the method, wherein applying the one or more enterprise policies to the WebRTC session description object comprises determining whether the WebRTC session description object complies with the one or more enterprise policies.
24. 24. The non-transitory computer-readable medium of claim 23 having stored thereon the computer-executable instructions to cause the processor to implement the method further comprising, responsive to determining that the WebRTC session description object complies with the one or more enterprise policies, establishing a first WebRTC interactive flow between the sender device and the recipient device.

    25, The non-transitory computer-readable medium of claim 24 having stored thereon the computer-executable instructions to cause the processor to implement the metho& wherein establishing the first WebRTC interactive flow comprises: establishing a secure peer connection between the recipient device and the sender device; receiving, t the recipient device, the first WebRTC interactive flow originating from the sender device via the secure peer connection; and applying the one or more enterprise policies to the first WebRTC interactive flow.