Systems and methods for HTTP callouts for policies

• US 8,955,033 B2
• Filed: 11/25/2008
• Issued: 02/10/2015
• Est. Priority Date: 11/25/2008
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Khemani, Prakash, Kumar, Anil
• Primary Examiner(s): BROWN, ANTHONY D
• Application Number:
  US12/277,759
• Publication Number:
  US 20100132009A1
• Time in Patent Office: 2,268 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A method of identifying an action of a policy in association with communications between a client and one or more servers includes determining, by an intermediary, a policy action based on using a callout based policy. In one aspect, an intermediary receives communications between a client and one or more servers. The intermediary identifies a policy for the communications, the policy specifying a request and a server to communicate the request. Responsive to the policy, the intermediary transmits the request to the server. Based on the server response to the request, the intermediary determines an action of the policy. In another aspect, a system for the present method includes an intermediary and a policy engine for identifying a policy to specify a request and a destination server. Responsive to a server response to the request, the intermediary determines an action of the policy.

Claims

1. A method for using by an intermediary a request and a response specified by a policy to determine an action of the policy, the intermediary receiving communications between a client and one or more servers, the method comprising:

a) identifying, by an intermediary between a client and one or more servers, a policy for a communication transmitted between a client and a first server of the one or more servers received by the intermediary, the policy specifying content of a request to be generated and identifying a second server to communicate the request, the intermediary generating, responsive to the policy, the request with content specified by the policy;

b) transmitting, by the intermediary responsive to the policy, the request specified by the policy to the second server specified by the policy; and

c) determining, by the intermediary, an action of the policy to take on the communication between the client and the first server based on the second server'"'"'s response, received by the intermediary, to the request specified by the policy.

2. The method of claim 1, wherein step (a) further comprises specifying, by the policy, a type of HyperText Transfer Protocol (HTTP) request.

3. The method of claim 1, wherein step (a) further comprises specifying, by the policy, an expression for generating one of a host header or a portion of a uniform resource locator (URL) for the request.

4. The method of claim 1, wherein step (a) further comprises specifying, by the policy, one of an internet protocol address, domain name or port for the second server.

5. The method of claim 1, wherein step (a) further comprises specifying, by the policy, one of a header name or header value for the request.

6. The method of claim 1, wherein step (a) further comprises specifying, by the policy, a type of value to be received by the response.

7. The method of claim 1, wherein step (a) further comprises specifying, by the policy, one of a parameter name or parameter value for the request.

8. The method of claim 1, wherein step (b) further comprises generating, by the intermediary, the request as specified by one or more expressions of the policy.

9. The method of claim 8, wherein step (b) further comprises validating, by the intermediary, the generated request.

10. The method of claim 1, wherein step (c) further comprises determining, by the intermediary, the action of the policy from evaluating an expression based on content of the second server'"'"'s response.

11. A system for using a request and a response specified by a policy to determine an action of the policy, the system comprising:

a policy engine identifying a policy, the policy specifying content of a request to be generated and identifying a second server to communicate the request; and

an intermediary receiving a communication transmitted between a client and a first server of one or more servers, generating, responsive to the policy, the request with content specified by the policy and responsive to the policy transmitting the request specified by the policy to the second server specified by the policy, the intermediary determining an action of the policy to take on the communication based on the second server'"'"'s response, received by the intermediary to the request specified by the policy.

12. The system of claim 11, wherein the policy specifies a type of HyperText Transfer Protocol (HTTP) request.

13. The system of claim 11, wherein the policy specifies an expression for generating one of a host header or a portion of a uniform resource locator (URL) stem for the request.

14. The system of claim 11, wherein the policy specifies one of an internet protocol address, domain name or port for the second server.

15. The system of claim 11, wherein the policy specifies one of a header name or header value for the request.

16. The system of claim 11, wherein the policy specifies a type of value to be received by the response.

17. The system of claim 11, wherein the policy specifies one of a parameter name or parameter value for the request.

18. The system of claim 11, wherein the intermediary generates the request as specified by one or more expressions of the policy.

19. The system of claim 18, wherein the intermediary validates the generated request.

20. The system of claim 11, wherein the intermediary determines the action of the policy from evaluating an expression based on content of the second server'"'"'s response.