Systems and methods for policy based triggering of client-authentication at directory level granularity

• US 8,566,925 B2
• Filed: 08/03/2006
• Issued: 10/22/2013
• Est. Priority Date: 08/03/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Udupa, Sivaprasad, Kanekar, Tushar, Ag, Tejus
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US11/462,350
• Publication Number:
  US 20080034410A1
• Time in Patent Office: 2,637 Days
• Field of Search: 370/256, 709/224, 713/194, 725/4, 725/5
• US Class Current: 726/21
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods are disclosed for an appliance to authenticate access of a client to a protected directory on a server via a connection, such as a secure SSL connection, established by the appliance. A method comprises the steps of: receiving, by an appliance, a first request from a client on a first network to access a server on a second network, the appliance providing the client a virtual private network connection from the first network to the second network; determining, by the appliance, the first request comprises access to a protected directory of the server; associating, by the appliance, an authentication policy with the protected directory, the authentication policy specifying an action to authenticate the client'"'"'s access to the protected directory; and transmitting, by the appliance in response to the authentication policy, a second request to the client for an authentication certificate. Corresponding systems are also disclosed.

Claims

1. A method for an appliance to authenticate access of a client to a protected resource on a server via the appliance, the method comprising the steps of:

(a) receiving, by an appliance, a client request to access a protected directory of a server, the appliance providing access to the server via a transport layer connection;

(b) determining, by the appliance, that the protected directory matches a predetermined directory specified in a client authentication policy of the appliance, the client authentication policy applied on a per-directory and per-request basis and identifying an action for the appliance to request a client authentication certificate from the client responsive to matching the predetermined directory;

(c) queuing, by the appliance in response to matching the predetermined directory, the client request to prevent access to the protected resource at the server via the transport layer connection until an authentication certificate of the client is validated in accordance with the client authentication policy; and

(d) transmitting, by the appliance in response to the action identified by the client authentication policy, a request to the client for the authentication certificate.

2. The method of claim 1, comprising determining, by the appliance one or more of the following portions of the client request matches a corresponding specification of the client authentication policy:

a Uniform Resource Locator (URL) pattern, an identifier of one of a method or function, a directory, a client network identifier, a server network identifier, a network port, and a Secure Socket Layer (SSL) parameter.

3. The method of claim 1, comprising determining, by the appliance, the client has been previously authenticated to access the protected resource, and allowing access, by the appliance, to the protected resource.

4. The method of claim 1, specifying, by the client authentication policy, that the authentication certificate is mandatory.

5. The method of claim 4, comprising not transmitting, by the appliance, the client request to the server upon one of receiving an invalid authentication certificate or not receiving an authentication certificate.

6. The method of claim 1, specifying, by the authentication policy, that the authentication certificate is optional.

7. The method of claim 6, comprising transmitting, by the appliance, the client request to the server upon one of not receiving an authentication certificate from the client or receiving an invalid authentication certificate from the client.

8. The method of claim 6, comprising inserting, by the appliance, into the client request a portion of the client'"'"'s response to the request for the authentication certificate, and transmitting the client request to the server.

9. The method of claim 1, comprising inserting, by the appliance in response to the client authentication policy, data related to the authentication certificate into a Hypertext Transfer Protocol (HTTP) header of the client request, and transmitting the client request to the server.

10. The method of claim 1, comprising inserting, by the appliance in response to the client authentication policy, Secure Socket Layer (SSL) information into a Hypertext Transfer Protocol (HTTP) header of the client request, and transmitting the client request to the server.

11. The method of claim 1, comprising identifying, by the client authentication policy, a pattern for associating a portion of the client request with the client authentication policy.

12. The method of claim 1, wherein step (c) comprises preventing, by the appliance, establishment of a transport layer connection with the server.

13. An appliance for providing finer control for authenticating access of a client to a protected resource on a server, the appliance comprising:

means for receiving a client request to access a protected directory of a server, the appliance providing access to the server via a transport layer connection;

means for determining that the protected directory matches a predetermined directory specified in of a client authentication policy of the appliance, the client authentication policy applied on a per-directory and per-request basis and identifying an action for the appliance to request a client authentication certificate from the client responsive to matching the predetermined directory;

means for queuing in response to matching the predetermined director, the client request to prevent access to the protected resource at the server via the transport layer connection until an authentication certificate of the client is validated in accordance with the client authentication policy; and

means for transmitting, in response to the action identified by the client authentication policy, a request to the client for the authentication certificate.

14. The appliance of claim 13, comprising means for determining one or more of the following portions of the client request matches a corresponding specification of the client authentication policy:

a Uniform Resource Locator (URL) pattern, an identifier of one of a method or function, a directory, a client network identifier, a server network identifier, a network port, and a Secure Socket Layer (SSL) parameter.

15. The appliance of claim 13, comprising means for determining the client has been previously authenticated to access the protected resource, and allowing access, by the appliance, to the protected resource.

16. The appliance of claim 13, comprising means for specifying, by the client authentication policy, that the authentication certificate is mandatory.

17. The appliance of claim 16, comprising means for not transmitting, by the appliance, the client request to the server upon one of receiving an invalid authentication certificate or not receiving an authentication certificate.

18. The appliance of claim 13, comprising means for specifying, by the authentication policy, that the authentication certificate is optional.

19. The appliance of claim 18, comprising means for transmitting the client request to the server upon one of not receiving an authentication certificate or receiving an invalid authentication certificate from the client.

20. The appliance of claim 18, comprising means for inserting, into the client request a portion of the client'"'"'s response to the request for the authentication certificate, and transmitting the client request to the server.

21. The appliance of claim 13, comprising means for inserting, in response to the client authentication policy, data related to the authentication certificate into a Hypertext Transfer Protocol (HTTP) header of the client request, and transmitting the client request to the server.

22. The appliance of claim 13, comprising means for inserting, by the appliance in response to the client authentication policy, Secure Socket Layer (SSL) information into a Hypertext Transfer Protocol (HTTP) header of the client request, and transmitting the client request to the server.

23. The appliance of claim 13, comprising means for identifying, by the client authentication policy, a pattern for associating a portion of the client request with the client authentication policy.

24. The appliance of claim 13, comprising means for preventing establishment of a transport layer connection with the server.

25. A method for an appliance to control access of a client to a protected directory on a server via the appliance, the method comprising:

(a) receiving, by an appliance, a request from a client to access a first protected directory of a server via the appliance;

(b) determining, by the appliance, that the first protected directory matches a predetermined directory specified in a client authentication policy of the appliance;

(c) determining, by the appliance, based on the first protected directory matching the predetermined directory specified in the client authentication policy, that the client authentication policy identifies an action for the appliance to request the authentication certificate from the client;

(d) transmitting, by the appliance in response to the action identified by the client authentication policy, a request to the client for the authentication certificate;

(e) receiving, by an appliance, a request from a client to access a second protected directory of the server via the appliance; and

(f) determining, by the appliance, that the second protected directory is not specified in the client authentication policy of the appliance, and that a request for the authentication certificate is not required by the client authentication policy.