Sharing and injecting cookies into virtual machines for retrieving requested web pages

• US 9,384,026 B1
• Filed: 01/30/2014
• Issued: 07/05/2016
• Est. Priority Date: 06/18/2012
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Bromium (HP Inc.)
• Inventors: Banga, Gaurav, Pratt, Ian, Kapoor, Vikram, Buddhiraja, Prakash, Bondalapati, Kiran
• Primary Examiner(s): Wu, Benjamin
• Application Number:
  US14/168,672
• Time in Patent Office: 887 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Approaches for selectively sharing cookies between virtual machines responsible for retrieving web content. A request to display a web page is received. The web page includes top-level content served by a top-level domain and secondary content served by one or more other domains. A determination that at least a portion of the web page should be retrieved from within a virtual machine is made. A policy is consulted to identify a set of cookies to inject into the virtual machine. The policy considers whether the virtual machine is responsible for retrieving one or more of top-level content and secondary content in identifying the set of cookies to inject into the virtual machine. After injecting the set of cookies into the virtual machine, the portion of the web page is retrieved from within the virtual machine.

Claims

1. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for selectively sharing cookies between virtual machines, which when executed by one or more processors, cause:

receiving a request to display a web page, wherein the web page includes top-level content served by a top-level domain and secondary content served by one or more other domains;

consulting a policy to identify a set of cookies to inject into a virtual machine responsible for retrieving the web page,

wherein the policy considers the top-level content and the secondary content in identifying the set of cookies to inject into the virtual machine; and

after injecting the identified set of cookies into the virtual machine, retrieving the web page from within the virtual machine using the identified set of cookies.

2. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the policy indicates that any permanent cookie associated with either the top-level domain or any of the one or more other domains associated with secondary content to be retrieved by the virtual machine are to be injected into the virtual machine.

3. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the policy indicates that any session cookies associated with the top-level domain are to be injected into the virtual machine, and wherein the policy indicates that any session cookies associated with any of the one or more other domains are not to be injected into the virtual machine.

4. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the policy indicates that any permanent cookies associated with the secondary content are to be injected into the virtual machine unless the secondary content contains an indication that the secondary content should not be embedded within another web page.

5. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the policy indicates that if a first domain redirects requests to itself to a second domain, then cookies associated with the first domain are provided to the virtual machine when the virtual machine is retrieving content from the second domain.

6. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the policy indicates that if a first domain post data to a second domain, then cookies associated with the first domain are provided to the virtual machine when the virtual machine is retrieving content from the second domain.

7. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the policy may be configured by a user to ensure cookies associated with a particular domain are injected into virtual machines responsible for retrieving content from that particular domain in a manner specified by the user.

8. The one or more non-transitory computer-readable storage mediums of claim 1, wherein execution of the one or more sequences of instructions further causes:

receiving, from a remote location over a network, updated policy data to replace or augment the policy.

9. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the web page is a first web page, wherein the virtual machine is a first virtual machine, and wherein execution of the one or more sequences of instructions further causes:

upon receiving a request to display a second web page in a different tab than the first web page, retrieving the second web page from within a different virtual machine than the first virtual machine,

wherein the policy instructs that session cookies cannot be shared between the first virtual machine and the different virtual machine.

10. An apparatus for selectively sharing cookies between virtual machines, comprising:

one or more processors; and

one or more computer-readable storage mediums storing one or more sequences of instructions, which when executed by the one or more processors, cause;

receiving a request to display a web page, wherein the web page includes top-level content served by a top-level domain and secondary content served by one or more other domains;

consulting a policy to identify a set of cookies to inject into a virtual machine responsible for retrieving the web page,

wherein the policy considers the top-level content and the secondary content in identifying the set of cookies to inject into the virtual machine; and

after injecting the identified set of cookies into the virtual machine, retrieving the web page from within the virtual machine using the identified set of cookies.

11. The apparatus of claim 10, wherein the policy indicates that any permanent cookie associated with either the top-level domain or any of the one or more other domains associated with secondary content to be retrieved by the virtual machine are to be injected into the virtual machine.

12. The apparatus of claim 10, wherein the policy indicates that any session cookies associated with the top-level domain are to be injected into the virtual machine, and wherein the policy indicates that any session cookies associated with any of the one or more other domains are not to be injected into the virtual machine.

13. The apparatus of claim 10, wherein the policy indicates that any permanent cookies associated with the secondary content are to be injected into the virtual machine unless the secondary content contains an indication that the secondary content should not be embedded within another web page.

14. The apparatus of claim 10, wherein the policy indicates that if a first domain redirects requests to itself to a second domain, then cookies associated with the first domain are provided to the virtual machine when the virtual machine is retrieving content from the second domain.

15. The apparatus of claim 10, wherein the policy indicates that if a first domain post data to a second domain, then cookies associated with the first domain are provided to the virtual machine when the virtual machine is retrieving content from the second domain.

16. The apparatus of claim 10, wherein the policy may be configured by a user to ensure cookies associated with a particular domain are injected into virtual machines responsible for retrieving content from that particular domain in a manner specified by the user.

17. The apparatus of claim 10, wherein execution of the one or more sequences of instructions further causes:

receiving, from a remote location over a network, updated policy data to replace or augment the policy.

18. The apparatus of claim 10, wherein the web page is a first web page, wherein the virtual machine is a first virtual machine, and wherein execution of the one or more sequences of instructions further causes:

upon receiving a request to display a second web page in a different tab than the first web page, retrieving the second web page from within a different virtual machine than the first virtual machine,

wherein the policy instructs that session cookies cannot be shared between the first virtual machine and the different virtual machine.

19. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for selectively sharing cookies between virtual machines, which when executed by one or more processors, cause:

receiving a request to display a web page, wherein the web page includes top-level content served by a top-level domain and secondary content served by one or more other domains;

determining that at least a portion of the web page should be retrieved from within a virtual machine;

consulting a policy to identify a set of cookies to inject into the virtual machine, wherein the policy considers whether the virtual machine is responsible for retrieving one or more of top-level content and secondary content in identifying the set of cookies to inject into the virtual machine; and

after injecting the identified set of cookies into the virtual machine, retrieving the portion of the web page from within the virtual machine.