Brokering state information and identity among user agents, origin servers, and proxies

• US 8,850,017 B2
• Filed: 05/27/2011
• Issued: 09/30/2014
• Est. Priority Date: 01/18/2000
• Status: Expired due to Fees

• Current Assignee: RPX Corporation
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Major, Robert Drew, Ebrahimi, Hashem Mohammad
• Primary Examiner(s): Hussain, Imad
• Application Number:
  US13/118,185
• Publication Number:
  US 20110231555A1
• Time in Patent Office: 1,222 Days
• Field of Search: 709/226
• US Class Current: 709/226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

Methods, signals, devices, and systems are provided for using proxy servers to transparently forward messages between clients and origin servers if, and only if, doing so does not violate network policies. In some systems, a transparent proxy uses a combination of standard-format HTTP commands, embedding auxiliary information in URLs and other tools and techniques to redirect an initial client request to one or more policy modules, such as a login server or an identity broker or an access control server. The policy module authenticates the request, and uses HTTP redirection to have the client transmit authorization data to the proxy. The proxy extracts the authorization data, directs the client to use a corresponding cookie, and subsequently provides the implicitly requested proxy services to the client in response to the client'"'"'s subsequently providing the authorization data in a cookie. This is accomplished without requiring installation of any invention-specific software or hardware on either the client or the origin server, and also works with proxy servers that are known to the client. Unless the client request violates network policy, a person using the client will generally perceive no reduction of services, and will instead benefit from the proxy'"'"'s caching and/or other performance enhancements.

Claims

1. A method implemented and residing within a non-transitory computer-readable storage medium, comprising:

intercepting, at a transparent proxy, a request from a client, the request for a resource of an origin server and directed initially by the client to the origin server;

obtaining, by the transparent proxy, policy enforcement data that grams the client access to use the transparent proxy based on the policy enforcement data and the policy enforcement data is digitally signed;

producing, by the transparent proxy a policy state token based on the policy enforcement data;

sending, by the transparent proxy, the policy state token to the client for authentication of the client at the transparent proxy during subsequent interactions, the policy state token maintains a relationship among the client, the transparent proxy, and the origin server and serves as authorization for the client to use the transparent proxy to access the resource of the origin server;

managing, by the transparent proxy, communications associated with the policy state token, the transparent proxy acting as an intermediary between the client and the origin server; and

managing all interactions between the client and the transparent proxy via existing network protocols and without changes to the client or the transparent proxy and using a second transparent proxy to provide failover for the transparent proxy when the transparent proxy becomes unavailable to continue to manage the interactions.

2. The method of claim 1, wherein obtaining further includes extracting the policy enforcement data from a redirection address field.

3. The method of claim 1 further comprising, receiving at the transparent proxy a renewed request for the origin server resource, the renewed request containing the policy state token.

4. The method of claim 1, wherein sending further includes representing the policy state token as a cookie.

5. The method of claim 1, wherein sending further includes including a key in the cookie whose checksum is verified by the transparent proxy.

6. The method of claim 1, wherein managing communications further include presenting, by the transparent proxy, the policy state token that appears to have originated from the client from the perspective of the origin server.

7. The method of claim 1, wherein managing all communications further includes using Hyper Text Transfer Protocol (HTTP) and HTTP over Secure Sockets Layer (HTTPS) as the existing network protocols.

8. The method of claim 1, wherein managing all communications further includes using Lightweight Directory Access Protocol (LDAP) as the existing network protocols.

9. The method of claim 1, wherein managing all communications further includes using Secure Sockets Layer (SSL) protocol as the existing network protocols.

10. The method of claim 1 further comprising, utilizing Lightweight Directory Access Protocol software to provide authentication information for the client, and the policy enforcement data obtained by the transparent proxy depends on the authentication information as provided.

17. The method of claim 6 further comprising, submitting by the transparent proxy a key on behalf of the client to the origin server to authenticate the client for access to a resource of the origin server where the origin server believes the key is originating from the client.

11. A transparent proxy server comprising:

a memory configured at least in part by a transparent proxy process;

a processor for running the transparent proxy process;

at least one link for networked communication between the transparent proxy process, on the one hand, and a client computer and an origin server, on the other hand; and

a policy module identifier which identifies a policy module that grants or denies authorization of proxy services to the client computer by acquiring policy enforcement data and attempting to authenticate the client computer to the transparent proxy process in response to the policy enforcement data, the policy enforcement data provides an indication that the client can use the transparent proxy process and based on the policy enforcement data the client is granted access to the transparent proxy process, and the policy enforcement data is digitally signed, and the client computer directs a request for a resource to an origin server and the request is intercepted by the transparent proxy process, which is unknown to the client computer, and used to determine the policy module identifier which identifies the policy module, and the policy module authenticates the client computer to the transparent proxy process for subsequent interactions between the client computer and the transparent proxy process, and the transparent proxy creates a transparent proxy cookie for the relationship among the client, the origin server, and the transparent proxy, and the transparent proxy manages the transparent proxy cookie on the client, and the transparent proxy acting and an intermediary between the client and the origin server for managing cookie communications, and all interactions between the client and the transparent proxy are done via existing network protocols and without changes to the client of the transparent proxy and using a second transparent proxy to provide failover for the transparent proxy when the transparent proxy becomes unavailable to continue to manage the interactions.

12. The transparent proxy server of claim 11, wherein the transparent proxy process presents origin cookies to the client as if the transparent proxy process were the origin server.

13. The transparent proxy server of claim 12, wherein the transparent proxy process presents client cookies to the origin server as if the transparent proxy process were the client.

14. The transparent proxy server of claim 11, wherein the policy module and the transparent proxy process are running on the same computer.

15. The transparent proxy server of claim 11, wherein the transparent proxy process sends the client computer the authorization by sending the client computer the transparent proxy cookie for use in subsequent communications from the client computer.

16. A method implemented and residing within a non-transitory computer-readable storage medium, comprising:

managing, at a transparent proxy, communications occurring between a client and an origin server;

maintaining, by the transparent proxy, key information used to authenticate the client to the origin server, the origin server to the client, the client to the transparent proxy, and the origin server to the transparent proxy; and

managing, by the transparent proxy, all interactions between the client and the transparent proxy via existing network protocols and without changes to the client or the transparent proxy, the client granted access to the transparent proxy based on policy enforcement data that is digitally signed and using a second transparent proxy to provide failover for the transparent proxy when the transparent proxy becomes unavailable to continue to manage the interactions.

18. The method of claim 16 further comprising, submitting by the transparent proxy a key on behalf of the origin server to the client to authenticate the origin server for access to the client where the client believes the key is originating from the origin server.

19. The method of claim 16, wherein maintaining further includes managing, by the transparent proxy, portions of the key information associated with the client from the client machine.

20. The method of claim 16, wherein maintaining further includes managing, by the transparent proxy, portions of the key information associated with the origin server from the origin server machine.