Client-side extensions for use in connection with HTTP proxy policy enforcement

• US 8,826,411 B2
• Filed: 03/15/2006
• Issued: 09/02/2014
• Est. Priority Date: 03/15/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Moen, Doug, Campbell, Alex
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US11/376,917
• Publication Number:
  US 20070220599A1
• Time in Patent Office: 3,093 Days
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A Web browser is configured to participate with a proxy server in enforcing traffic policies within a computer network. This may include modifying the Web browser to report contextual information regarding requests for Web documents to the proxy server and/or causing the Web browser to report information concerning Web documents requested through the proxy server to the proxy server.

Claims

1. A method, comprising:

receiving at a proxy server a request for a Web document, said request originating from a client application executing on a client device communicably coupled to the proxy server;

retrieving, by the proxy server, a copy of the requested Web document, the proxy server modifying the requested Web document by inserting a set of computer-readable instructions which when executed by a processor of the client device on which the client application runs cause the client application to perform one or more activities associated with network traffic policy enforcement, including reporting, to the proxy server, information concerning the Web document;

downloading, from the proxy server to the client application, a modified version of the requested Web document that includes the set of computer-readable instructions;

receiving, at the proxy server and from the client application responsive to execution of the set of computer-readable instructions by the processor of the client device on which the client application runs, the information concerning the Web document, the proxy server using said information to determine whether the Web document is subject to an existing network traffic policy; and

if the Web document is subject to the existing network traffic policy, enforcing the existing network traffic policy in connection with subsequent requests for the Web document;

otherwise, not enforcing the existing network traffic policy in connection with subsequent requests for the Web document.

2. The method of claim 1, wherein the client application comprises a Web browser.

3. The method of claim 1, wherein the computer-readable instructions are embodied as a plug-in application for the client application.

4. The method of claim 1, wherein the computer-readable instructions are embodied as executable JavaScript.

5. The method of claim 1, wherein the computer-readable instructions are embodied as executable Active-X controls.

6. The method of claim 1, wherein the computer-readable instructions are embodied as executable Java instructions.

7. The method of claim 2, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, contextual information regarding requests for Web documents made by the Web browser.

8. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information regarding requests made by the client application.

9. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information about a current state of the client application.

10. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, an indication of a source of a uniform resource locator (URL) to which one or more requests made by the client application are directed.

11. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information identifying an object referenced by a uniform resource locator (URL) to which one or more requests by the client application are directed.

12. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information about (i) a current state of the client application, and (ii) a context in which a request by the client application is being made.

13. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to take one or more actions to enforce the network traffic policy locally.

14. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information identifying an object referenced by a uniform resource locator (URL) to which one or more requests by the client application are directed, the URL indicating an embedded image in the Web document.

15. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information identifying an object referenced by a uniform resource locator (URL) to which one or more requests by the client application are directed, the URL indicating an embedded object in the Web document.

16. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information identifying an object referenced by a uniform resource locator (URL) to which one or more requests by the client application are directed, the URL naming a script.

17. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information identifying an object referenced by a uniform resource locator (URL) to which one or more requests by the client application are directed, the URL identifying a style sheet.

18. A method as in any one of claims 1-6, wherein when the computer-readable instructions are executed by said processor, said instructions cause the client application to report, to the proxy server, information identifying an object referenced by a uniform resource locator (URL) to which one or more requests by the client application are directed, the URL referenced by a <

frame>

or <

iframe>

tag.

19. A proxy server, comprising:

a processor;

a storage device connected to the processor; and

a first set of computer-readable instructions on the storage device, said first set of instructions being executable by the processor and including;

a first module configured to

receiving a request for a Web document, said request originating from a client application executing on a client device communicably coupled to the proxy server;

retrieve a copy of the requested Web document;

modify the requested Web document by inserting a second set of computer-readable instructions which when executed by a processor of the client device on which the client application runs cause the client application to perform one or more activities associated with network traffic policy enforcement, including reporting, to the proxy server, information concerning the Web document; and

send to the client application a modified version of the Web document that includes the second set of computer-readable instructions;

a second module configured to receive from the client application, responsive to execution of the second set of computer-readable instructions by the processor of the client device on which the client application runs, said information concerning the Web document;

a third module configured to use said information to determine whether the Web document is subject to an existing network traffic policy; and

a fourth module configured to (i) enforce, if the Web document is subject to the existing network traffic policy, the existing network traffic policy in connection with subsequent requests for the Web document, otherwise, (ii) not enforce the existing network traffic policy in connection with subsequent requests for the Web document.

20. The proxy server of claim 19, wherein the proxy server receives said information concerning the Web document at an address specified by the second set of computer-readable instructions.