Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination

• US 9,819,647 B2
• Filed: 09/15/2014
• Issued: 11/14/2017
• Est. Priority Date: 12/29/2010
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Reddy, Anoop, Anderson, Craig
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US14/486,676
• Publication Number:
  US 20150067322A1
• Time in Patent Office: 1,156 Days
• Field of Search: 713153, 713155, 713156, 713176, 380277, 380278
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

The present disclosure is directed towards systems and methods for performing multi-level tagging of encrypted items for additional security and efficient encrypted item determination. A device intercepts a message from a server to a client, parses the message and identifies a cookie. The device processes and encrypts the cookie. The device adds a flag to the cookie indicating the device encrypted the cookie. The device re-inserts the modified cookie into the message and transmits the message. The device intercepts a message from a client and determines whether the cookie in the message was encrypted by the device. If the message was not encrypted by the device, the device transmits the message to its destination. If the message was encrypted by the device, the device removes the flag, decrypts the cookie, removes the tag from the cookie, re-inserts the cookie into the message and transmits the message to its final destination.

Claims

1. A system comprising:

a device configured to perform multi-level tagging, the device including one or more processors and memory and configured to

identify a first encrypted item having a first affix that identifies that the first encrypted item is encrypted,

determine, by identifying that the first encrypted item has the first affix, that the first encrypted item is encrypted,

remove the first affix from the first encrypted item, and

decrypt, responsive to identification of the first affix, the first encrypted item; and

wherein the device is configured to

identify an unencrypted item that is decrypted from the first encrypted item,

determine that the unencrypted item has a second affix attached to the unencrypted item, the second affix identifying the device as the device that encrypted the unencrypted item into the first encrypted item,

remove the second affix from the unencrypted item, and

process the unencrypted item with the second affix removed.

2. The system of claim 1, wherein the first affix comprises at least one of a first predetermined prefix or a first predetermined postfix.

3. The system of claim 1, wherein the second affix comprises at least one of a second predetermined prefix or a second predetermined postfix.

4. The system of claim 1, wherein the device is further configured to receive a message comprising the first encrypted item.

5. The system of claim 1, wherein the unencrypted item is a first unencrypted item and wherein the device is further configured to:

receive a second encrypted item comprising a second unencrypted item;

determine that the second affix is not attached to the second unencrypted item; and

determine that the device did not encrypt the second encrypted item responsive to determining that the second affix is not attached to the second unencrypted item.

6. The system of claim 5, wherein the device is further configured to skip processing the second unencrypted item from the second encrypted item.

7. The system of claim 5, wherein the device is further configured to determine that the second encrypted item is not encrypted by the device responsive to identifying that the second affix is not attached to the second unencrypted item decrypted from the second encrypted item.

8. The system of claim 1, wherein the device is further configured to remove the first affix from the first encrypted item.

9. The system of claim 1, wherein the device is further configured to remove the second affix from the unencrypted item decrypted from the first encrypted item.

10. The system of claim 1, wherein the device is further configured to attach the first affix to the unencrypted item that comprises a cookie, encrypt the unencrypted item into the first encrypted item and attached the second affix to the first encrypted item.

11. A system comprising:

a device configured to perform multi-level tagging, the device including one or more processors and memory and configured to receive from a sender a message to a receiver, the message comprising an unencrypted item to be encrypted;

wherein the device is configured to

attach a first affix to the unencrypted item; and

encrypt the unencrypted item with the attached first affix, the first affix identifying that the device is the device that encrypted the unencrypted item to generate an encrypted item;

attach a second affix to the encrypted item to identify that the encrypted item is encrypted; and

communicate to the receiver the message comprising the encrypted item having attached the second affix and the encrypted item comprising the first affix attached to the unencrypted item.

12. The system of claim 11, wherein the first affix comprises at least one of a first predetermined prefix or a first predetermined postfix.

13. The system of claim 11, wherein the second affix comprises at least one of a second predetermined prefix or a second predetermined postfix.

14. The system of claim 11, wherein the device is further configured receive via the message a cookie as the unencrypted item to be encrypted.

15. The system of claim 11, wherein the device is further configured to modify the message to include the encrypted item to which the second affix is attached.

16. The system of claim 15, wherein the device is further configured to replace the unencrypted item in the message with the encrypted item to which the second affix is attached.

17. The system of claim 15, wherein the device is further configured to identify a policy to apply to the message.

18. The system of claim 17, wherein the device is further configured to attach at least one of the first affix or the second affix responsive to the policy.

19. The system of claim 11, wherein the device is an intermediary between the sender and the receiver, the sender comprising a server and the receiver comprising a client.

20. The system of claim 11, wherein the device is the device of the sender.