Determining whether to encrypt outbound traffic

• US 8,478,985 B2
• Filed: 06/12/2008
• Issued: 07/02/2013
• Est. Priority Date: 04/19/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Polozoff, Alexandre, Bhogal, Kulvir Singh
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US12/137,946
• Publication Number:
  US 20080240436A1
• Time in Patent Office: 1,846 Days
• Field of Search: 380/255
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

An improved method, apparatus, and computer instructions for processing outbound traffic passing through a port. This port is for a server and receives a request from a client. The request includes a universal resource identifier to a destination. A determination is made as to whether the request requires encryption using the universal resource identifier in the request. The request is sent through the port to the destination in an encrypted form, in response to a determination that the request requires encryption.

Claims

1. A method in a data processing system for processing outbound traffic passing through a port, the method comprising:

receiving a request from a client for a server at the port, wherein the request includes a universal resource identifier to a destination;

identifying whether the universal resource identifier to the destination identifies a location on a local area network;

responsive to identifying that the universal resource identifier to the destination identifies a location on a local area network, sending the request through the port to the destination in an unencrypted form;

identifying whether the port utilizes a secure sockets layer connection;

responsive to identifying that the port utilizes the secure sockets layer connection, sending the request through the port to the destination in an encrypted form;

responsive to identifying that the port does not utilize the secure sockets layer connection, determining whether the request requires encryption using the universal resource identifier in the request; and

responsive to a determination that the request requires the encryption, sending the request through the port to the destination in the encrypted form.

2. The method of claim 1 further comprising:

receiving a response from a source for routing to a requesting client;

determining whether an original request for the response was in the encrypted form; and

responsive to a determination that the original request for the response was in the encrypted form, sending the response to the requesting client in the encrypted form.

3. The method of claim 1, wherein the determining step comprises:

comparing the universal resource identifier in the request to a set of universal resource identifiers; and

responsive to a match between the universal resource identifier in the request to a particular universal resource identifier in the set of universal resource identifiers, identifying the response as requiring an encryption.

4. The method of claim 2 further comprising:

responsive to sending the request to the destination in the encrypted form, recording a connection for the request in a set of connections.

5. The method of claim 4, wherein the determining step comprises:

identifying the connection for the response; and

identifying an original response as being in the encrypted form if the connection is in the set of connections.

6. The method of claim 1, wherein the universal resource identifier is a universal resource locator.

7. The method of claim 3, wherein the set of universal resource identifiers is located in a table.

8. The method of claim 1, wherein the method is located in a network appliance.

9. A data processing system for processing outbound traffic passing through a port, the data processing system comprising:

receiving means for receiving a request from a client for a server at the port, wherein the request includes a universal resource identifier to a destination;

first identifying means for identifying whether the universal resource identifier to the destination identifies a location on a local area network;

first sending means, responsive to identifying that the universal resource identifier to the destination identifies a location on a local area network, for sending the request through the port to the destination in an unencrypted form;

second identifying means for identifying whether the port utilizes a secure sockets layer connection;

second sending means, responsive to identifying that the port utilizes the secure sockets layer connection, for sending the request through the port to the destination in an encrypted form;

determining means, responsive to identifying that the port does not utilize the secure sockets layer connection, for determining whether the request requires encryption using the universal resource identifier in the request; and

third sending means, responsive to a determination that the request requires the encryption, for sending the request through the port to the destination in the encrypted form.

10. The data processing system of claim 9, wherein the determining means is a first determining means, and further comprising:

second receiving means for receiving a response from a source for routing to a requesting client;

second determining means for determining whether an original request for the response was in the encrypted form; and

fourth sending means, responsive to a determination that the original request for the response was in the encrypted form, for sending the response to the requesting client in the encrypted form.

11. The data processing system of claim 9, wherein the determining means comprises:

comparing means for comparing the universal resource identifier in the request to a set of universal resource identifiers; and

identifying means, responsive to a match between the universal resource identifier in the request to a particular universal resource identifier in the set of universal resource identifiers, for identifying the response as requiring the encryption.

12. The data processing system of claim 10 further comprising:

recording means, responsive to sending the request to the destination in the encrypted form, for recording a connection for the request in a set of connections.

13. The data processing system of claim 12, wherein the second determining means comprises:

first means for identifying the connection for the response; and

second means for identifying the original response as being in the encrypted form if the connection is in the set of connections.

14. A non-transitory computer readable medium having a computer program product encoded thereon for processing outbound traffic passing through a port, the computer program product comprising:

instructions for receiving a request from a client for a server at the port, wherein the request includes a universal resource identifier to a destination;

instructions for identifying whether the universal resource identifier to the destination identifies a location on a local area network;

instructions, responsive to identifying that the universal resource identifier to the destination identifies a location on a local area network, for sending the request through the port to the destination in an unencrypted form;

instructions for identifying whether the port utilizes a secure sockets layer connection;

instructions, responsive to identifying that the port utilizes the secure sockets layer connection, for sending the request through the port to the destination in an encrypted form;

instructions, responsive to identifying that the port does not utilize the secure sockets layer connection, for determining whether the request requires encryption using the universal resource identifier in the request; and

instructions, responsive to a determination that the request requires the encryption, for sending the request through the port to the destination in the encrypted form.

15. The non-transitory computer readable medium of claim 14 further comprising:

instructions for receiving a response from a source for routing to a requesting client;

instructions for determining whether an original request for the response was in the encrypted form; and

instructions, responsive to a determination that the original request for the response was in the encrypted form, for sending the response to the requesting client in the encrypted form.

16. The non-transitory computer readable medium of claim 14, wherein the instructions for determining whether the request requires encryption using the universal resource identifier in the request comprises:

first sub instructions for comparing the universal resource identifier in the request to a set of universal resource identifiers; and

second sub instructions, responsive to a match between the universal resource identifier in the request to a particular universal resource identifier in the set of universal resource identifiers, for identifying the response as requiring the encryption.

17. The non-transitory computer readable medium of claim 15 further comprising:

instructions, responsive to sending the request to the destination in the encrypted form, for recording a connection for the request in a set of connections.

18. The non-transitory computer readable medium of claim 17, wherein the instructions for determining whether the original request for the response was in the encrypted form comprises:

first sub instructions for identifying the connection for the response; and

second sub instructions for identifying the original response as being in the encrypted form if the connection is in the set of connections.

19. The non-transitory computer readable medium of claim 14 wherein the universal resource identifier is a universal resource locator.