Systems and Methods for HTTP Callouts for Policies

• US 20100132009A1
• Filed: 11/25/2008
• Published: 05/27/2010
• Est. Priority Date: 11/25/2008
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Kumar, Anil, Khemani, Prakash
• Granted Patent: US 8,955,033 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A method of identifying an action of a policy in association with communications between a client and one or more servers includes determining, by an intermediary, a policy action based on using a callout based policy. In one aspect, an intermediary receives communications between a client and one or more servers. The intermediary identifies a policy for the communications, the policy specifying a request and a server to communicate the request. Responsive to the policy, the intermediary transmits the request to the server. Based on the server response to the request, the intermediary determines an action of the policy. In another aspect, a system for the present method includes an intermediary and a policy engine for identifying a policy to specify a request and a destination server. Responsive to a server response to the request, the intermediary determines an action of the policy.

Claims

1. A method for using by an intermediary a request and a response specified by a policy to determine an action of the policy, the intermediary receiving communications between a client and one or more servers, the method comprising:

a) identifying, by an intermediary, a policy for a communication between a client and one or more servers, the policy specifying a request and a server to communicate the request;

b) transmitting, by the intermediary responsive to the policy, the request specified by the policy to the server specified by the policy; and

c) determining, by the intermediary, an action of the policy based on a server response corresponding to the request specified by the policy.

2. The method of claim 1, wherein step (a) further comprises specifying, by the policy, a type of HyperText Transfer Protocol (HTTP) request.

3. The method of claim 1, wherein step (a) further comprises specifying, by the policy, an expression for generating one of a host header or a portion of a uniform resource locator (URL) for the request.

4. The method of claim 1, wherein step (a) further comprises specifying, by the policy, one of an internet protocol address, domain name or port for the server.

5. The method of claim 1, wherein step (a) further comprises specifying, by the policy, one of a header name or header value for the request.

6. The method of claim 1, wherein step (a) further comprises specifying, by the policy, a type of value to be received by the response.

7. The method of claim 1, wherein step (a) further comprises specifying, by the policy, one of a parameter name or parameter value for the request.

8. The method of claim 1, wherein step (b) further comprises generating, by the intermediary, the request as specified by one or more expressions of the policy.

9. The method of claim 8, wherein step (b) further comprises validating, by the intermediary, the generated request.

10. The method of claim 1, wherein step (c) further comprises determining, by the intermediary, the action of the policy from evaluating an expression based on content of the response.

11. A system for using a request and a response specified by a policy to determine an action of the policy, the system comprising:

a policy engine identifying a policy, the policy specifying a request and a server to communicate the request; and

an intermediary receiving a communication between a client and one or more servers and responsive to the policy transmitting the request specified by the policy to the server specified by the policy, the intermediary determining an action of the policy based on a server response corresponding to the request specified by the policy.

12. The system of claim 11, wherein the policy specifies a type of HyperText Transfer Protocol (HTTP) request.

13. The system of claim 11, wherein the policy specifies an expression for generating one of a host header or a portion of a uniform resource locator (URL) stem for the request.

14. The system of claim 11, wherein the policy specifies one of an internet protocol address, domain name or port for the server.

15. The system of claim 11, wherein the policy specifies one of a header name or header value for the request.

16. The system of claim 11, wherein the policy specifies a type of value to be received by the response.

17. The system of claim 11, wherein the policy specifies one of a parameter name or parameter value for the request.

18. The system of claim 11, wherein the intermediary generates the request as specified by one or more expressions of the policy.

19. The method of claim 18, wherein the intermediary validates the generated request.

20. The system of claim 11, wherein the intermediary determines the action of the policy from evaluating an expression based on content of the response.