System and method for transcoding support of web content over secure connections

• US 20030061387A1
• Filed: 09/24/2001
• Published: 03/27/2003
• Est. Priority Date: 09/24/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Schwerdtfeger, Richard Scott, Fairweather, Peter Gustav, Detweiler, Samuel R., Brown, Frances C., Tibbitts, Beth Rush, Crayne, Susan, Hanson, Vicki Lynne, Farrell, Stephen Paul
• Granted Patent: US 6,970,918 B2
• Time in Patent Office: Days
• US Class Current: 709/246
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method and system using for establishing an intermediary connection between a client device and a secure website using a web proxy machine. In the preferred embodiment, a secure connection is established between the web proxy and the secure content server. A response from the content server, typically in HTML format, is sent to the proxy machine through a secure connection. The proxy machine is then able to manipulate the secure response from the secure server, in ways such as transcoding the response to a format readable by the user device, storing sensitive financial data in cookies in the proxy machine, and to return a response from the content provider to the client device with or preferably without cookies.

Claims

1. A method for establishing a secure connection between a user device and a secure content server, said method comprising:

connecting a proxy machine between a user device and a plurality of content servers, wherein the plurality of content servers comprises a secure content server and a non-secure content server;

accessing an authorized web page from the plurality of content servers by utilizing the proxy machine, in response to a request to the authorized web page by the user device;

capturing a secure content uniform resource indicator from the authorized web page;

rewriting the captured secure content uniform resource indicator in order to redirect a web page response for a subsequent request to a secure web page from the secure content server by the user device, such that a secure connection is established between the secure content server and the proxy machine; and

passing the secure web page as a parameter to the user device.

2. The method of claim 1, further comprising:

assigning a user identity, from a database of user identities, to identify the connection between the proxy machine and the secure content server.

3. The method of claim 2, wherein the user identity is defined by an Internet Protocol address for the client device.

4. The method of claim 2, wherein the user identity is defined in a cookie in an HTTP header.

5. The method of claim 1, further comprising:

retrieving cookies for a specific user for a specific content provider from a cookie database;

deleting any expired cookies from the cookie database; and

placing the retrieved unexpired cookies into an HTTP request header from the proxy machine to the secure content server.

6. The method of claim 1, further comprising:

receiving at the proxy machine cookies for a specific user from a specific content provider; and

storing the received cookies in the proxy machine.

7. The method of claim 1, wherein the established connection between the user device and the proxy machine is secure.

8. The method of claim 1, where said step of accessing through the proxy machine the authorized web page further comprises:

sending a URI capturing web page from the proxy machine to the user device, said URI capturing web page having an address text field;

entering a desired URI address in the address text field in the URI capturing web page; and

directing the entered URI address to a browser application generator in the proxy machine.

9. The method of claim 1, further comprising transcoding the web page response from the secure content server into a protocol understood by the user device.

10. A system for establishing a secure connection between a user device and a secure content server, said system comprising:

means for connecting a proxy machine between a user device and a plurality of content servers, wherein the plurality of content servers comprises a secure content server and a non-secure content server;

means for accessing an authorized web page from the plurality of content servers by utilizing the proxy machine, in response to a request to the authorized web page by the user device;

means for capturing a secure content uniform resource indicator from the authorized web page;

means for rewriting the captured secure content uniform resource indicator in order to redirect a web page response for a subsequent request to a secure web page from the secure content server by the user device, such that a secure connection is established between the secure content server and the proxy machine; and

means for passing the secure web page as a parameter to the user device.

11. The system of claim 10, further comprising means for assigning a user identity, from a database of user identities, to identify the connection between the proxy machine and the secure content server.

12. The system of claim 11, wherein the user identity is defined by an Internet Protocol address for the client device.

13. The system of claim 11, wherein the user identify is defined in a cookie in an HTTP header.

14. The system of claim 10, further comprising:

means for retrieving cookies for a specific user for a specific content provider from a cookie database;

means for deleting any expired cookies from the cookie database; and

means for placing the retrieved unexpired cookies into an HTTP request header from the proxy machine to the secure content server.

15. The system of claim 10, further comprising:

means for receiving at the proxy machine cookies for a specific user from a specific content provider; and

means for storing the received cookies in the proxy machine.

16. The system of claim 10, wherein said established connection between the user device and the proxy machine is secure.

17. The system of claim 10, wherein said means for accessing through the proxy machine the authorized web page further comprises:

means for sending a URI capturing web page from the proxy machine to the user device, said URI capturing web page having an address text field;

means for entering a desired URI address in the address text field in the URI capturing web page; and

means for directing the entered URI address to a browser application generator in the proxy machine.

18. The system of claim 10, further comprising means for transcoding the web page response from the secure content server into a protocol understood by the user device.

19. A computer program product for establishing a secure connection between a user device and a secure content server, said computer program product comprising:

computer program code for connecting a proxy machine between a user device and a plurality of content servers, wherein the plurality of content servers comprises a secure content server and a non-secure content server;

computer program code for accessing an authorized web page from the plurality of content servers by utilizing the proxy machine, in response to a request to the authorized web page by the user device;

computer program code for capturing a secure content uniform resource indicator from the authorized web page;

computer program code for rewriting the captured secure content uniform resource indicator in order to redirect a web page response for a subsequent request to a secure web page from the secure content server by the user device, such that a secure connection is established between the secure content server and the proxy machine; and

computer program code for passing the secure web page as a parameter to the user device.

20. The computer program product of claim 19, further comprising program code for assigning a user identity, from a database of user identities, to identify the connection between the proxy machine and the secure content server.

21. The computer program product of claim 20, wherein the user identity is defined by an Internet Protocol address for the client device.

22. The computer program product of claim 20, wherein the user identity is defined in a cookie in an HTTP header.

23. The computer program product of claim 19, further comprising:

computer program code for retrieving cookies for a specific user for a specific content provider from a cookie database;

computer program code for deleting any expired cookies from said cookie database; and

computer program code for placing the retrieved unexpired cookies into an HTTP request header from the proxy machine to the secure content server.

24. The computer program product of claim 19, further comprising:

computer program code for receiving at the proxy machine cookies for a specific user from a specific content provider; and

computer program code for storing the received cookies in the proxy machine.

25. The computer program product of claim 19, wherein the connection between the user device and the proxy machine is secure.

26. The computer program product of claim 19, wherein the computer program code for accessing through the proxy machine the authorized web page further comprises:

computer program code for sending a URI capturing web page from the proxy machine to the user device, said URI capturing web page having an address text field;

computer program code for entering a desired URI address in the address text field in the URI capturing web page; and

computer program code for directing the entered URI address to a browser application generator in the proxy machine.

27. The computer program product of claim 19, further comprising computer program code for transcoding the web page response from the secure content server into a protocol understood by the user device.