SYSTEMS AND METHODS FOR STATE SIGNING OF INTERNET RESOURCES

• US 20070271599A1
• Filed: 08/01/2007
• Published: 11/22/2007
• Est. Priority Date: 05/28/2003
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Silicon Valley
• Inventors: Rosenstein, Adam
• Granted Patent: US 7,861,087 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A method, system, and software for state signing of Internet resources is presented in which web pages and other Internet resources are signed after the insertion of metadata indicating intended and authorized uses. In one embodiment, the signing is accomplished through use of a cryptographic signature added to any data item passed to a client that is likely to be passed back to the server later, such as a cookie, URL, or data integrity item. Enabling and disabling of state signing for various data items can be controlled through policies tied to URL prefixes.

Claims

1. A method for an intermediary device to provide security between a client and server via state signing of resources controlled by policy, the method comprising the steps of:

(a) intercepting, by a device between a client and a server, a response from the server to a request of the client, the response comprising a plurality of application data items;

(b) determining, via a policy, one or more application data items of the plurality of application data items to sign;

(c) generating, by a state signer responsive to the policy, a signature for each of the determined one or more application data items; and

(d) transmitting, by the device, to the client in response to the request, a modified response having the signed one or more application data items.

2. The method of claim 1, wherein step (b) comprises determining, via the policy, the one or more application data items to sign based on Uniform Resource Locator (URL) prefixes associated with each of the plurality of application data items.

3. The method of claim 1, wherein step (b) comprises determining, via the policy, the one or more application data items to sign based on a user identifier associated with one of the request or the response.

4. The method of claim 1, wherein step (b) comprises determining, via the policy, application data items of the plurality of application data items to leave unsigned.

5. The method of claim 1, comprising incorporating, by the state signer, a control word in each of the one or more signed application data items, the control word having metadata indicating one or more of the following:

intent of the request, information regarding signature of the signed application data items, how the signature was obtained and a marker to determined signed application data items from unsigned application data items.

6. The method of claim 1, comprising receiving, by the device, a second request from the client for at least a first application data item of the one or more signed application data items, and verifying the second request has a valid signature for the first application data item.

7. The method of claim 1, wherein step (c) comprises generating, by the state signer, the signature using a user identifier, text of the application data item, and a key.

8. The method of claim 1, wherein step (c) comprises generating, by the state signer, the signature of text of the application data item and a control word corresponding to the signature.

9. The method of claim 1, wherein the device comprises one of a firewall or a proxy.

10. A method for an intermediary device to provide security between a client and server via state signing of resources using a control word to verify signed resources, the method comprising the steps of:

(a) intercepting, by a device between a client and a server, a response from the server to a request of the client, the response comprising a plurality of application data items;

(b) incorporating, by a state signer, a control word into one or more application data items of the plurality of application data items, the control word comprising metadata to control verification of a signed application data item;

(c) generating, by the state signer, a signature for the each of the one or more application data items; and

(d) transmitting, by the device, to the client in response to the request, a modified response having the signed one or more application data items and corresponding control words.

11. The method of claim 10, wherein step (c) comprises generating, by the state signer, the signature for an application data item including the control word.

12. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, the control word to indicate a marker to use to distinguish between signed content and unsigned content.

13. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, the control word to indicate a date beyond which the signature is considered invalid.

14. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, the control word to indicate a first system key of a plurality system keys to use for one of generating or verifying the signature.

15. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, the control word to indicate whether a query is one of signed or unsigned.

16. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, the control word to indicate whether a backend connection uses a secure HyperText Transfer Protocol.

17. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, the control word to comprise a form verification block to impose constraints on one of data that appears in a query or data that appears in a second request.

18. The method of claim 17, wherein the constraints include one or more of the following:

a length of the data, a type of the data, conformance to type of variables, and conformance to expected values.

19. The method of claim 10, wherein step (b) comprising incorporating, by the state signer, one or more extended control words with the control word.

20. The method of claim 10, comprising receiving, by the device, a second request from the client and verifying the signature of one or more signed application data items in accordance with the control word.

21. The method of claim 10, wherein the device comprises one of a firewall or a proxy.