SYSTEMS AND METHODS FOR USING A CLIENT AGENT TO MANAGE HTTP AUTHENTICATION COOKIES

• US 20080034198A1
• Filed: 08/03/2006
• Published: 02/07/2008
• Est. Priority Date: 08/03/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Soni, Ajay, Venkatraman, Charu, He, Junxiao
• Granted Patent: US 8,561,155 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

Systems and methods are described for using a client agent to manage HTTP authentication cookies. One method includes intercepting, by a client agent executing on a client, a connection request from the client; establishing, by the client agent, a transport layer virtual private network connection with a network appliance; transmitting, by the client agent via the established connection, an HTTP request comprising an authentication cookie; and transmitting, by the client agent via the connection, the connection request. A second method includes intercepting, by a client agent executing on a client, an HTTP communication comprising a cookie from an appliance on a virtual private network to the client; removing, by the client agent, the cookie from the HTTP communication; storing, by the client agent, the received cookie; transmitting, by the client agent, the modified HTTP communication to an application executing on the client; intercepting, by the client agent, an HTTP request from the client; inserting, by the client agent in the HTTP request, the received cookie; and transmitting the modified HTTP request to the appliance. Corresponding systems are also described.

Claims

1. A method for using a client agent to enable http cookie authentication in non-HTTP communications from a client, the method comprising:

(a) intercepting, by a client agent executing on a client, a connection request from the client;

(b) establishing, by the client agent, a transport layer virtual private network connection with a network appliance;

(c) transmitting, by the client agent via the established connection, an HTTP request comprising an authentication cookie; and

(d) transmitting, by the client agent via the connection, the connection request.

2. The method of claim 1, wherein the client agent executes transparently with respect to one of the following network layers:

the application layer, the presentation layer, the session layer, or the transport layer.

3. The method of claim 1, wherein step (a) comprises intercepting, by a client agent executing on a client, a transport layer connection request from the client, wherein the interception occurs at one of the following network layers:

the transport layer, the network layer, or the data layer.

4. The method of claim 1, wherein step (a) comprises intercepting, by a client agent executing on a client, a TCP SYN packet.

5. The method of claim 1, wherein step (c) comprises transmitting, by the client agent via the established connection, an HTTP request comprising an authentication cookie prior to any data being transmitted via the connection.

6. The method of claim 1, wherein step (c) comprises transmitting by the client agent, in response to the determination that the connection has been established, an HTTP request comprising an authentication cookie, the cookie comprising user authentication credentials.

7. The method of claim 1, wherein step (c) comprises transmitting, by the client agent via the established connection, an HTTP request comprising an authentication cookie, the cookie comprising application-specific authentication credentials.

8. The method of claim 1, wherein step (c) further comprises receiving, by the client agent, an HTTP response, the HTTP response comprising an acceptance of the authentication cookie.

9. A computer implemented system for using a client agent to enable HTTP cookie authentication in non-HTTP communications from a client, the system comprising:

a client computing device; and

a client agent executing on the client, which intercepts a connection request from the client;

establishes a transport layer virtual private network connection with a network appliance;

transmits, by the client agent via the established connection, an HTTP request comprising an authentication cookie; and

transmits, by the client agent via the connection, the connection request.

10. The system of claim 0, wherein the client agent executes transparently with respect to one of the following network layers:

the application layer, the presentation layer, the session layer, or the transport layer.

11. The system of claim 0, wherein the client agent intercepts a transport-layer connection request from the client, wherein the interception occurs at one of the following network layers:

the transport layer, the network layer, or the data layer.

12. The system of claim 0, wherein the client agent intercepts a TCP SYN packet.

13. The system of claim 0, wherein the client agent transmits, via the established connection, an HTTP request comprising an authentication cookie prior to any data being transmitted via the connection.

14. The system of claim 0, wherein the client agent transmits, via the established connection, an HTTP request comprising an authentication cookie, the cookie comprising user authentication credentials.

15. The system of claim 0, wherein the client agent transmits, via the established connection, an HTTP request comprising an authentication cookie, the cookie comprising application-specific authentication credentials.

16. The system of claim 0, wherein the client agent receives an HTTP response, the HTTP response comprising an acceptance of the authentication cookie.