Method and apparatus for determining whether to encrypt outbound traffic

• US 20080240436A1
• Filed: 06/12/2008
• Published: 10/02/2008
• Est. Priority Date: 04/19/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Polozoff, Alexandre, Bhogal, Kulvir Singh
• Granted Patent: US 8,478,985 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

An improved method, apparatus, and computer instructions for processing outbound traffic passing through a port. This port is for a server and receives a request from a client. The request includes a universal resource identifier to a destination. A determination is made as to whether the request requires encryption using the universal resource identifier in the request. The request is sent through the port to the destination in an encrypted form, in response to a determination that the request requires encryption.

Claims

1. A method in a data processing system for processing outbound traffic passing through a port, the method comprising:

receiving a request from a client for a server at the port, wherein the request includes a universal resource identifier to a destination;

determining whether the request requires encryption using the universal resource identifier in the request; and

responsive to a determination that the request requires encryption, sending the request through the port to the destination in an encrypted form.

2. The method of claim 1 further comprising:

receiving a response from the source for routing to a requesting client;

determining whether the original request for the response was in the encrypted form; and

responsive to a determination that the original request for the response was in the encrypted form, sending the response the requesting client in the encrypted form.

3. The method of claim 1, wherein the determining step comprises:

comparing the universal resource identifier in the request to a set of universal resource identifiers; and

responsive to a match between the universal resource identifier in the request to a particular universal resource identifier in the set of universal resource identifiers, identifying the response as requiring encryption.

4. The method of claim 2 further comprising:

responsive to sending the request to the destination in the encrypted form, recording a connection for the request in a set of connections.

5. The method of claim 4, wherein the determining step comprises:

identifying the connection for the response; and

identifying original response as being in the encrypted form if the connection is in the set of connections.

6. The method of claim 1, wherein the universal resource identifier is a universal resource locator.

7. The method of claim 3, wherein the set of universal resource identifiers is located in a table.

8. The method of claim 1, wherein the method is located in a network appliance.

9. A data processing system for processing outbound traffic passing through a port, the data processing system comprising:

receiving means for receiving a request from a client for a server at the port, wherein the request includes a universal resource identifier to a destination;

determining means for determining whether the request requires encryption using the universal resource identifier in the request; and

sending means, responsive to a determination that the request requires encryption, for sending the request through the port to the destination in an encrypted form.

10. The data processing system of claim 9, wherein the receiving means is a first receiving means, the determining means is a first determining means, and the sending means is a first sending means and further comprising:

second receiving means for receiving a response from the source for routing to a requesting client;

second determining means for determining whether the original request for the response was in the encrypted form; and

second sending means, responsive to a determination that the original request for the response was in the encrypted form, for sending the response the requesting client in the encrypted form.

11. The data processing system of claim 9, wherein the determining means comprises:

comparing means for comparing the universal resource identifier in the request to a set of universal resource identifiers; and

identifying means, responsive to a match between the universal resource identifier in the request to a particular universal resource identifier in the set of universal resource identifiers, for identifying the response as requiring encryption.

12. The data processing system of claim 10 further comprising:

recording means, responsive to sending the request to the destination in the encrypted form, for recording a connection for the request in a set of connections.

13. The data processing system of claim 12, wherein the second determining means comprises:

first means for identifying the connection for the response; and

second means for identifying original response as being in the encrypted form if the connection is in the set of connections.

14. A computer program product in a computer readable medium for processing outbound traffic passing through a port, the computer program product comprising:

first instructions for receiving a request from a client for a server at the port, wherein the request includes a universal resource identifier to a destination;

second instructions for determining whether the request requires encryption using the universal resource identifier in the request; and

third instructions, responsive to a determination that the request requires encryption, for sending the request through the port to the destination in an encrypted form.

15. The computer program product of claim 14 further comprising:

fourth instructions for receiving a response from the source for routing to a requesting client;

fifth instructions for determining whether the original request for the response was in the encrypted form; and

sixth instructions, responsive to a determination that the original request for the response was in the encrypted form, for sending the response the requesting client in the encrypted form.

16. The computer program product of claim 14, wherein the second instructions comprises:

first sub instructions for comparing the universal resource identifier in the request to a set of universal resource identifiers; and

second sub instructions, responsive to a match between the universal resource identifier in the request to a particular universal resource identifier in the set of universal resource identifiers, for identifying the response as requiring encryption.

17. The computer program product of claim 15 further comprising:

seventh instructions, responsive to sending the request to the destination in the encrypted form, for recording a connection for the request in a set of connections.

18. The computer program product of claim 17, wherein the fifth instructions comprises:

first sub instructions for identifying the connection for the response; and

second sub instructions for identifying original response as being in the encrypted form if the connection is in the set of connections.

19. The computer program product of claim 14 wherein the universal resource identifier is a universal resource locator.