Securing Network Activity Managed by Operating Systems

• US 20160197909A1
• Filed: 01/04/2016
• Published: 07/07/2016
• Est. Priority Date: 01/05/2015
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Innes, Andrew Carnegie
• Granted Patent: US 10,277,578 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Methods and systems are disclosed for providing approaches to receiving, by an enterprise framework device from an application executing on a computing device, a first request associated with accessing an enterprise resource and generating, by the data proxy device, a ticketed URL that is associated with resource device communications related to the first request. The methods and systems may include receiving, by the data proxy device from the operating system, a second request addressed to the ticketed URL, transmitting, by the data proxy device to the operating system, based on the second request addressed to the ticketed URL, a resource device response, and transmitting, by the enterprise framework device to the application, the resource device response.

Claims

1. A method comprising:

receiving, by an enterprise framework device from an application executing on a computing device, a first request associated with accessing an enterprise resource;

transmitting, by the enterprise framework device, the first request to a data proxy device via a foreground application programming interface of an operating system executing on the computing device;

transmitting, by the data proxy device, the first request to an enterprise resource device;

generating, by the data proxy device, a ticketed URL, the ticketed URL being associated with resource device communications related to the first request for the enterprise resource;

transmitting, by the data proxy device, the ticketed URL to the enterprise framework device;

transmitting, by the enterprise framework device, the ticketed URL to the operating system;

receiving, by the data proxy device from the operating system, a second request addressed to the ticketed URL;

transmitting, by the data proxy device to the operating system, based on the second request addressed to the ticketed URL, a resource device response related to the first request for the enterprise resource device;

retrieving, by the enterprise framework device from the operating system, the resource device response related to the first request for the enterprise resource; and

transmitting, by the enterprise framework device to the application, the resource device response related to the first request for the enterprise resource.

2. The method of claim 1, further comprising:

generating, by the enterprise framework device, an encryption key associated with the data proxy device;

encrypting, by the data proxy device, based on the encryption key, the resource device response related to the first request for the enterprise resource; and

decrypting, by the enterprise framework device based on the encryption key, the encrypted resource device response related to the first request for the enterprise resource.

3. The method of claim 1, further comprising in response to receiving, by the data proxy device from the enterprise framework device, the first request associated with accessing the enterprise resource, initiating, by the data proxy device, an authentication session with the enterprise resource device using one or more credentials that are unfamiliar to the operating system.

4. The method of claim 1, further comprising:

caching, by the data proxy device in a storage device, information associated with the first request;

generating, by the data proxy device, the ticketed URL referencing a location of the cached information;

in response to receiving, by the data proxy device from the operating system, the second request comprising the location of the cached information, transmitting, by the data proxy device to the enterprise resource device, the cached information associated with the first request; and

receiving, by the data proxy device from the enterprise resource device, the resource device response.

5. The method of claim 1, further comprising in response to receiving, by the data proxy device from the enterprise resource device, the second request addressed to the ticketed URL, transmitting, by the data proxy device to the enterprise resource device, authentication credentials via an authentication session.

6. The method of claim 1, further comprising:

buffering, by the data proxy device, a portion of the resource device response; and

in response to receiving, by the data proxy device, a call from the operating system, transmitting, by the data proxy device to the operating system, the buffered portion of the resource device response.

7. The method of claim 1, wherein the first request comprises a request to download a file or upload a file.

8. A system, comprising:

at least one processor; and

at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause the system to perform;

receiving, by an enterprise framework device from an application executing on a computing device, a first request associated with accessing an enterprise resource;

transmitting, by the enterprise framework device, the first request to a data proxy device via a foreground application programming interface of an operating system executing on the computing device;

transmitting, by the data proxy device, the first request to an enterprise resource device;

generating, by the data proxy device, a ticketed URL, the ticketed URL being associated with resource device communications related to the first request for the enterprise resource;

transmitting, by the data proxy device, the ticketed URL to the enterprise framework device;

transmitting, by the enterprise framework device, the ticketed URL to the operating system;

receiving, by the data proxy device from the operating system, a second request addressed to the ticketed URL;

transmitting, by the data proxy device to the operating system, based on the second request addressed to the ticketed URL, a resource device response related to the first request for the enterprise resource device;

retrieving, by the enterprise framework device from the operating system, the resource device response related to the first request for the enterprise resource; and

transmitting, by the enterprise framework device to the application, the resource device response related to the first request for the enterprise resource.

9. The system of claim 8, wherein the computer-readable instructions further cause the system to perform:

generating, by the enterprise framework device, an encryption key associated with the data proxy device;

encrypting, by the data proxy device, based on the encryption key, the resource device response related to the first request for the enterprise resource; and

decrypting, by the enterprise framework device based on the encryption key, the encrypted resource device response related to the first request for the enterprise resource.

10. The system of claim 8, wherein the computer-readable instructions further cause the system to perform in response to receiving, by the data proxy device from the enterprise framework device, the first request associated with accessing the enterprise resource, initiating, by the data proxy device, an authentication session with the enterprise resource device using one or more credentials that are unfamiliar to the operating system.

11. The system of claim 8, wherein the computer-readable instructions further cause the system to perform:

caching, by the data proxy device in a storage device, information associated with the first request;

generating, by the data proxy device, the ticketed URL referencing a location of the cached information;

in response to receiving, by the data proxy device from the operating system, the second request comprising the location of the cached information, transmitting, by the data proxy device to the enterprise resource device, the cached information associated with the first request; and

receiving, by the data proxy device from the enterprise resource device, the resource device response.

12. The system of claim 8, wherein the computer-readable instructions further cause the system to perform in response to receiving, by the data proxy device from the enterprise resource device, the second request addressed to the ticketed URL, transmitting, by the data proxy device to the enterprise resource device, authentication credentials via an authentication session.

13. The system of claim 8, wherein the computer-readable instructions further cause the system to perform:

buffering, by the data proxy device, a portion of the resource device response; and

in response to receiving, by the data proxy device, a call from the operating system, transmitting, by the data proxy device to the operating system, the buffered portion of the resource device response.

14. The system of claim 8, wherein the first request comprises a request to download a file or upload a file.

15. One or more non-transitory computer-readable storage media having computer-readable instructions stored thereon, that when executed by one or more processors, cause the one or more processors to perform:

receiving, by an enterprise framework device from an application executing on a computing device, a first request associated with accessing an enterprise resource;

transmitting, by the enterprise framework device, the first request to a data proxy device via a foreground application programming interface of an operating system executing on the computing device;

transmitting, by the data proxy device, the first request to an enterprise resource device;

generating, by the data proxy device, a ticketed URL, the ticketed URL being associated with resource device communications related to the first request for the enterprise resource;

transmitting, by the data proxy device, the ticketed URL to the enterprise framework device;

transmitting, by the enterprise framework device, the ticketed URL to the operating system;

receiving, by the data proxy device from the operating system, a second request addressed to the ticketed URL;

transmitting, by the data proxy device to the operating system, based on the second request addressed to the ticketed URL, a resource device response related to the first request for the enterprise resource device;

retrieving, by the enterprise framework device from the operating system, the resource device response related to the first request for the enterprise resource; and

transmitting, by the enterprise framework device to the application, the resource device response related to the first request for the enterprise resource.

16. The computer-readable storage media of claim 15, wherein the computer-readable instructions further cause the one or more processors to perform:

generating, by the enterprise framework device, an encryption key associated with the data proxy device;

encrypting, by the data proxy device, based on the encryption key, the resource device response related to the first request for the enterprise resource; and

decrypting, by the enterprise framework device based on the encryption key, the encrypted resource device response related to the first request for the enterprise resource.

17. The computer-readable storage media of claim 15, wherein the computer-readable instructions further cause the one or more processors to perform in response to receiving, by the data proxy device from the enterprise framework device, the first request associated with accessing the enterprise resource, initiating, by the data proxy device, an authentication session with the enterprise resource device using one or more credentials that are unfamiliar to the operating system.

18. The computer-readable storage media of claim 15, wherein the computer-readable instructions further cause the one or more processors to perform:

caching, by the data proxy device in a storage device, information associated with the first request;

generating, by the data proxy device, the ticketed URL referencing a location of the cached information;

in response to receiving, by the data proxy device from the operating system, the second request comprising the location of the cached information, transmitting, by the data proxy device to the enterprise resource device, the cached information associated with the first request; and

receiving, by the data proxy device from the enterprise resource device, the resource device response.

19. The computer-readable storage media of claim 15, wherein the computer-readable instructions further cause the one or more processors to perform in response to receiving, by the data proxy device from the enterprise resource device, the second request addressed to the ticketed URL, transmitting, by the data proxy device to the enterprise resource device, authentication credentials via an authentication session.

20. The computer-readable storage media of claim 15, wherein the computer-readable instructions further cause the one or more processors to perform:

buffering, by the data proxy device, a portion of the resource device response; and

in response to receiving, by the data proxy device, a call from the operating system, transmitting, by the data proxy device to the operating system, the buffered portion of the resource device response.