Systems and methods for using an HTTP-aware client agent

• US 9,948,608 B2
• Filed: 01/12/2015
• Issued: 04/17/2018
• Est. Priority Date: 08/03/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: He, Junxiao, Venkatraman, Charu, Soni, Ajay
• Primary Examiner(s): Rahman, Mahfuzur
• Assistant Examiner(s): Victoria, Narciso
• Application Number:
  US14/594,963
• Publication Number:
  US 20150128227A1
• Time in Patent Office: 1,191 Days
• Field of Search: 726 4
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Systems and methods are described for using a client agent operating in a virtual private network environment to intercept HyperText Transfer Protocol (HTTP) communications. Methods include: intercepting at the network layer, by a client agent executing on a client, an HTTP request from an application executing on the client; modifying the HTTP request; and transmitting, via a transport layer connection, the modified HTTP request to a server. Additional methods may comprise adding, removing, or modifying at least one cookie in the HTTP request. Still other methods may comprise modifying at least one name-value pair contained in the HTTP request. Corresponding systems are also described.

Claims

1. A method comprising:

(a) intercepting, by an agent executing on a client device, a packet at a layer below an application layer of a network stack of the client device, the packet comprising a Hypertext Transfer Protocol (HTTP) request carried by the application layer of the packet, the agent operating at the layer below the application layer, the packet intercepted from an application executing on the client device and transmitted to a server;

(b) modifying, by the agent operating at the layer below the application layer, a portion of the HTTP request carried by the application layer of the intercepted packet to a different version of the portion of the HTTP request, the portion of the HTTP request including a cookie or a name-value pair, the agent modifying the portion of the HTTP request in association with one or more functions performed by the agent that relate to the modified HTTP request, the one or more functions relating to at least one of acceleration, pooling, caching or security;

(c) transmitting, by the agent via a transport layer connection, the intercepted packet comprising the modified portion of the packet to the server.

2. The method of claim 1, wherein (b) further comprises modifying the portion of the HTTP request comprising the cookie to a different version of the cookie.

3. The method of claim 2, wherein (b) further comprises modifying the portion of the HTTP request comprising the cookie having authentication credentials to a second version of authentication credentials.

4. The method of claim 1, wherein (b) further comprises modifying the portion of the HTTP request comprising the name-value pair to a different version of the name-value pair.

5. The method of claim 4, wherein the name-value pair comprises one of a Uniform Resource Locator, a connection HTTP message header, a referrer HTTP message header, an authorization HTTP message header or a cache-control HTTP message header.

6. The method of claim 1, wherein (b) further comprises adding the different version of the portion of the HTTP request to the HTTP request.

7. The method of claim 1, wherein (b) further comprises removing the portion of the HTTP request in the application layer of the packet.

8. The method of claim 1, wherein (b) further comprises:

(i) identifying, in the HTTP request, a Uniform Resource Locator (URL) identifying a resource currently stored on the client device; and

(ii) inserting, in the HTTP request, information identifying a version of the resource.

9. The method of claim 1, wherein (c) comprises:

(i) determining, in response to a Uniform Resource Locator (URL) specified in the HTTP request, an address corresponding to a server for servicing the request; and

(ii) transmitting, via a transport layer connection, the modified HTTP request to the determined address.

10. A system comprising:

a client device including one or more processors coupled to one or more memories; and

an agent configured to execute on the client device and configured to;

intercept a packet at a layer below an application layer of a network stack of the client device, the packet comprising a Hypertext Transfer Protocol (HTTP) carried by the application layer of the packet, the agent operating at the layer below the application layer, the packet intercepted from an application executing on the client device and transmitted to a server;

modify, at the layer below the application layer, a portion of the HTTP request carried by the application layer of the intercepted packet to a different version of the portion of the HTTP request, the portion of the HTTP request including a cookie or a name-value pair, the portion of the HTTP request modified in association with one or more functions performed by the agent that relate to the modified HTTP request, the one or more functions relating to at least one of acceleration, pooling, caching or security; and

transmit, via a transport layer connection, the intercepted packet comprising the modified portion of the packet to the server.

11. The system of claim 10, wherein the agent is further configured to modify the portion of the HTTP request comprising a cookie to a different version of the cookie.

12. The system of claim 11, wherein the agent is further configured to modify the portion of the HTTP request comprising a cookie having authentication credentials to a different version of the authentication credentials.

13. The system of claim 10, wherein the agent is further configured to modify the portion of the HTTP request comprising a name-value pair to a second version of the name-value pair.

14. The system of claim 13, wherein the name-value pair comprises one of a Uniform Resource Locator, a connection HTTP message header, a referrer HTTP message header, an authorization HTTP message header, or a cache-control HTTP message header.

15. The system of claim 10, wherein the agent is further configured to add the different version of the HTTP request to the HTTP request.

16. The system of claim 10, wherein the agent is further configured to remove the portion of the HTTP request from the HTTP request.

17. The system of claim 10, wherein the agent is further configured to:

(i) identify, in the HTTP request, a Uniform Resource Locator (URL) identifying a resource currently stored on the client device; and

(ii) insert, in the HTTP request, information identifying a version of the resource.

18. The system of claim 10, wherein the agent is further configured to:

(i) determine, in response to a Uniform Resource Locator (URL) specified in the HTTP request, an address corresponding to a server for servicing the request; and

(ii) transmit, via a transport layer connection, the modified HTTP request to the determined address.

19. A method comprising:

(a) intercepting, by an agent executing on a client device, a packet at a layer below an application layer of a network stack of the client device, the packet comprising a Hypertext Transfer Protocol (HTTP) request carried by the application layer of the packet, the agent operating at the layer below the application layer, the packet intercepted from an application executing on the client device and transmitted to a server;

(b) modifying, by the agent operating at the layer below the application layer, a portion of the HTTP request carried by the application layer of the packet to a different version of the portion of the HTTP request, the portion of the HTTP request modified by i) adding the different version of the portion of the HTTP request to the HTTP request, ii) removing the portion of the HTTP request in the application layer of the packet, or iii) inserting, in the HTTP request, information identifying a version of a resource currently stored on the client device, the agent modifying the portion of the HTTP request in association with one or more functions performed by the agent that relate to the modified HTTP request, the one or more functions relating to at least one of acceleration, pooling, caching or security;

(c) transmitting, by the agent via a transport layer connection, the intercepted packet comprising the modified portion of the packet to the server.

20. A system comprising:

a client device including one or more processors coupled to one or more memories; and

an agent configured to execute on the client device and configured to;

intercept a packet at a layer below an application layer of a network stack of the client device, the packet comprising a Hypertext Transfer Protocol (HTTP) carried by the application layer of the packet, the agent operating at the layer below the application layer, the packet intercepted from an application executing on the client device and transmitted to a server;

modify, at the layer below the application layer, a portion of the HTTP request carried by the application layer of the packet to a different version of the portion of the HTTP request, the portion of the HTTP request modified by i) adding the different version of the portion of the HTTP request to the HTTP request, ii) removing the portion of the HTTP request in the application layer of the packet, or iii) inserting, in the HTTP request, information identifying a version of a resource currently stored on the client device, the portion of the HTTP request modified in association with one or more functions performed by the agent that relate to the modified HTTP request, the one or more functions relating to at least one of acceleration, pooling, caching or security;

transmit, via a transport layer connection, the intercepted packet comprising the modified portion of the packet to the server.