Rule-based networking device

• US 7,610,400 B2
• Filed: 11/23/2004
• Issued: 10/27/2009
• Est. Priority Date: 11/23/2004
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: L'Heureux, Israel, Malmskog, Steve
• Primary Examiner(s): Hu; Jinsong
• Application Number:
  US10/996,871
• Publication Number:
  US 20060112174A1
• Time in Patent Office: 1,799 Days
• Field of Search: 709/217, 709/219, 709/236, 709/237, 710/105, 710/106
• US Class Current: 709/237
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

A networking system, device, and method are provided. The networking device typically includes a user-defined ruleset including HTTP request rules and HTTP response rules. The networking device may further include a request processor configured to receive an incoming HTTP request from the client, apply HTTP request rules to the incoming HTTP request, to thereby produce a modified HTTP request, and send the modified HTTP request to the server. The networking device may further include a response processor configured to receive an HTTP response to the modified HTTP request from the server, apply the HTTP response rules to the HTTP response, to thereby produce a modified HTTP response, and send the modified HTTP response to the client.

Claims

1. A networking method for use with a networking device having hardware for executing program modules, the network device positioned intermediate a client and a server on a computer network, the method comprising:

receiving, with the networking device, a user-defined ruleset comprising a set of user-defined request rules and a set of user-defined response rules;

at the networking device, receiving an unsecure response from the server;

converting, with the networking device, the unsecure response to a secure response according to the set of user-defined request rules;

forwarding the secure response to the client;

receiving a secure request from the client, the secure request originating from a link contained in the secure response;

converting, with the networking device, the secure request to an unsecure request according to the set of user-defined response rules; and

forwarding the unsecure request to the server.

2. The networking method of claim 1, wherein converting the unsecure response to a secure response comprises rewriting a portion of the unsecure response from Hypertext Transfer Protocol (HTTP) to Hypertext Transfer Protocol Secure (HTTPS) according to the set of user-defined response rules.

3. The networking method of claim 1, wherein converting the unsecure response to a secure response comprises rewriting the response headers in the unsecure response from HTTP to HTTPS according to the set of user-defined response rules.

4. The networking method of claim 1, wherein converting the unsecure response to a secure response comprises rewriting links contained in the content of the unsecure response from HTTP to HTTPS according to the set of user-defined response rules.

5. The networking method of claim 1, wherein converting the secure request to an unsecure request comprises rewriting a portion of the secure request from HTTPS to HTTP according to the set of user-defined request rules.

6. The networking method of claim 1, wherein converting the secure request to an unsecure request comprises rewriting a portion of a query string in the secure request from HTTPS to HTTP according to the set of user-defined request rules.

7. The networking method of claim 1, wherein converting the secure request to an unsecure request comprises rewriting a portion of a referrer URL in the secure request from HTTPS to HTTP according to the set of user-defined request rules.

8. The method of claim 1, wherein each of the rules of the set of user-defined request rules comprises a test condition and an action statement, wherein converting the secure request to the unsecure request comprises:

applying the test condition of each of the set of user-defined request rules to the secure request to determine whether the test condition is true for the secure request; and

performing an action defined by the action statement of each of the user-defined request rules for which the applied test condition is determined to be true for the secure request.

9. The method of claim 1, wherein each of the rules of the set of user-defined response rules comprises a test condition and an action statement, wherein converting the unsecure response to the secure response comprises:

applying the test condition of each of the set of user-defined response rules to the unsecure response to determine whether the test condition is true for the unsecure response; and

performing an action defined by the action statement of each of the user-defined response rules for which the applied test condition is determined to be true for the unsecure response.

10. A networking device positioned intermediate a client and server on a computer network, the networking device having hardware for executing program modules, the network device comprising:

a configuration tool configured to receive a user-defined ruleset comprising a set of user-defined request rules and a set of user-defined response rules;

a response processor configured to receive an unsecure Hypertext Transfer Protocol (HTTP) response from the server, rewrite a portion of the HTTP response from HTTP to Hypertext Transfer Protocol Secure (HTTPS) according to the set of user-defined response rules to form a secure response, and send the secure response to the client;

a request processor configured to receive a secure HTTPS request from the client, rewrite a portion of the secure HTTPS request from HTTPS to HTTP according to the set of user-defined request rules to form a unsecure request, and send the unsecure request to the server.

11. The networking device of claim 10, wherein the response processor is configured to rewrite a portion of a response header of the HTTP response from HTTP to HTTPS according to the set of user-defined response rules.

12. The networking device of claim 10, wherein the response processor is configured to rewrite a portion of a link within the HTTP response from HTTPS to HTTPS according to the set of user-defined response rules.

13. The networking device of claim 10, wherein the request processor is configured to rewrite a portion of a query string of the HTTP request from HTTPS to HTTP according to the set of user-defined request rules.

14. The networking device of claim 10, wherein the request processor is configured to rewrite a portion of a referrer URL in a request header of the HTTP request from HTTPS to HTTP according to the set of user-defined request rules.

15. A networking method for use with a networking device positioned intermediate a client and a server on a computer network, the method comprising:

receiving a set of user-defined response rules;

receiving an original HTTP request from the client, at the networking device;

at least temporarily storing a copy of the original HTTP request, at the networking device;

forwarding a version of the HTTP request to the server;

receiving an HTTP response to the version of the HTTP request at the networking device;

applying the set of user-defined response rules to the HTTP response, wherein the user-defined response rules reference the original HTTP request;

recalling the original HTTP request according to the set of user-defined response rules;

modifying the HTTP response according to the set of user-defined response rules, at least in part based on the original HTTP request stored at the networking device; and

forwarding the modified HTTP response to the client.

16. The networking method of claim 15, further comprising,

prior to forwarding the HTTP request to the server, modifying the HTTP request to form a modified version of the HTTP request;

wherein the modified version of the HTTP request comprises the version of the HTTP request that is forwarded to the server.