Secure Socket Policy Files For Establishing Secure Socket Connections

• US 20140304763A1
• Filed: 08/08/2011
• Published: 10/09/2014
• Est. Priority Date: 08/08/2011
• Status: Active Grant

• Current Assignee: Adobe Inc.
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Ma, Magnus H., Gwalani, Rajesh K.
• Granted Patent: US 8,973,089 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Exemplary embodiments involve a computing system requesting and receiving a socket policy file from a policy file server via a secure socket connection, identifying that the security policy requires communicating with a content server via a secure socket connection, and communicating with the content server via a second secure socket connection. The socket policy file specifies a security policy governing socket connections to a content server over a transport protocol layer. Additional embodiments involve requesting a socket policy file via a non-secure socket connection, receiving (via the non-secure socket connection) a placeholder socket policy file requiring requests for socket policy files to be communicated via a secure socket connection, establishing a secure socket connection with the policy file server, and submitting a request for the socket policy file to the policy file server via the secure socket connection.

Claims

1. A method comprising:

requesting, by a computing system configured by media content, a socket policy file from a policy file server via a first secure socket connection, wherein the socket policy file specifies a security policy governing socket connections for accessing additional media content on a content server over a transport protocol layer;

receiving, by the computing system, the socket policy file via the first secure socket connection;

identifying, by the computing system, that the security policy requires communication with the content server via a second secure socket connection; and

communicating, by the computing system, with the content server via the second secure socket connection to access the additional media content.

2. The method of claim 1, wherein the security policy identifies domains with which the computing system is required to communicate using the second secure socket connection and wherein the security policy identifies domains with which the computing system is permitted to communicate using a non-secure socket connection.

3. The method of claim 1, wherein said requesting the socket policy file comprises:

establishing, by the computing system, a non-secure socket connection with the policy file server;

requesting, by the computing system, the socket policy file via the non-secure socket connection;

receiving, by the computing system, a placeholder socket policy file via the non-secure socket connection, wherein the placeholder socket policy file specifies requesting the socket policy file via the first secure socket connection;

establishing, by the computing system, the first secure socket connection with the policy file server; and

submitting, by the computing system, a request for the socket policy file to the policy file server via the first secure socket connection.

4. The method of claim 1, wherein the socket policy file is requested based on receiving, by an application executed at the computing system, input representing a command to execute media content hosted on the content server.

5. The method of claim 1, wherein the policy file server and the content server are comprised in a single server system.

6. The method of claim 1, wherein the policy file server is comprised in a first server system, the content server is comprised in a second server system, and the first server system and the second server system are hosted on a common network domain.

7. The method of claim 1, further comprising:

establishing, by the computing system, the first secure socket connection using a port, wherein the port comprises a socket connection end point for communicating with a server;

terminating, by the computing system, the first secure socket connection upon receiving the socket policy file; and

establishing, by the computing system, the second secure socket connection using the port.

8. The method of claim 1, further comprising:

establishing, by the computing system, the first secure socket connection using a first port;

terminating, by the computing system, the first secure socket connection after receiving the socket policy file; and

establishing, by the computing system, the second secure socket connection using a second port.

9. The method of claim 1, wherein the socket policy file is an Extensible Markup Language (XML) file.

10. The method of claim 1, wherein the policy file server and the content server are comprised in a single server system.

11. The method of claim 1, wherein the policy file server is comprised in a first server system, the content server is comprised in a second server system, and the first server system and the second server system are hosted on a common network domain.

12. A computing system comprising:

a processor for executing instructions stored in a computer-readable medium on one or more devices providing an application;

wherein the application comprises one or more modules configured to perform operations when the computing system is configured by media content, the operations comprising;

requesting a socket policy file from a policy file server via a first secure socket connection, wherein the socket policy file specifies a security policy governing socket connections for accessing additional media content on a content server over a transport protocol layer;

receiving the socket policy file via the first secure socket connection;

identifying that the security policy requires communication with the content server via a second secure socket connection; and

communicating with the content server via the second secure socket connection to access the additional media content.

13. The computing system of claim 12, wherein the security policy identifies domains with which the application is required to communicate using the second secure socket connection and wherein the security policy identifies domains with which the application is permitted to communicate using a non-secure socket connection.

14. The computing system of claim 12, wherein said requesting the socket policy file comprises:

establishing a non-secure socket connection with the policy file server;

requesting the socket policy file via the non-secure socket connection;

receiving a placeholder socket policy file via the non-secure socket connection, wherein the placeholder socket policy file specifies requesting the socket policy file via the first secure socket connection;

establishing the first secure socket connection with the policy file server; and

submitting a request for the socket policy file to the policy file server via the first secure socket connection.

15. The computing system of claim 12, wherein the one or more modules are configured to perform additional operations comprising:

establishing the first secure socket connection using a port, wherein the port comprises a socket connection end point for communicating with a server;

terminating the first secure socket connection upon receiving the socket policy file; and

establishing the second secure socket connection using the port.

16. The computing system of claim 12, wherein the one or more modules are configured to perform additional operations comprising:

establishing the first secure socket connection using a first port;

terminating the first secure socket connection upon receiving the socket policy file; and

establishing the second secure socket connection using a second port.

17. A computer-readable medium stored on a storage device, the computer-readable medium embodying program code executable by a computer system configured by media content, the computer-readable medium comprising:

program code for requesting a socket policy file from a policy file server via a first secure socket connection, wherein the socket policy file specifies a security policy governing socket connections for accessing additional media content on a content server over a transport protocol layer;

program code for receiving the socket policy file via the first secure socket connection;

program code for identifying that the security policy requires communication with the content server via a second secure socket connection; and

program code for communicating with the content server via the second secure socket connection to access the additional media content.

18. The computer-readable medium of claim 17, wherein the program code for requesting the socket policy file comprises:

program code for establishing a non-secure socket connection with the policy file server;

program code for requesting the socket policy file via the non-secure socket connection;

program code for receiving a placeholder socket policy file via the non-secure socket connection, wherein the placeholder socket policy file specifies requesting the socket policy file via the first secure socket connection;

program code for establishing the first secure socket connection with the policy file server; and

program code for submitting a request for the socket policy file to the policy file server via the first secure socket connection.

19. The computer-readable medium of claim 17, further comprising:

program code for establishing the first secure socket connection using a port, wherein the port comprises a socket connection end point for communicating with a server;

program code for terminating the first secure socket connection upon receiving the socket policy file; and

program code for establishing the second secure socket connection using the port.

20. The computer-readable medium of claim 17, further comprising:

program code for establishing the first secure socket connection using a first port;

program code for terminating the first secure socket connection upon receiving the socket policy file; and

program code for establishing the second secure socket connection using a second port.