Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination

• US 8,862,870 B2
• Filed: 12/27/2011
• Issued: 10/14/2014
• Est. Priority Date: 12/29/2010
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Reddy, Anoop, Anderson, Craig
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US13/337,735
• Publication Number:
  US 20120173870A1
• Time in Patent Office: 1,022 Days
• Field of Search: 713152-154, 713/168, 713/170, 709/223, 709/224, 709/225
• US Class Current: 713/153
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

The present disclosure is directed towards systems and methods for performing multi-level tagging of encrypted items for additional security and efficient encrypted item determination. A device intercepts a message from a server to a client, parses the message and identifies a cookie. The device processes and encrypts the cookie. The device adds a flag to the cookie indicating the device encrypted the cookie. The device re-inserts the modified cookie into the message and transmits the message. The device intercepts a message from a client and determines whether the cookie in the message was encrypted by the device. If the message was not encrypted by the device, the device transmits the message to its destination. If the message was encrypted by the device, the device removes the flag, decrypts the cookie, removes the tag from the cookie, re-inserts the cookie into the message and transmits the message to its final destination.

Claims

1. A method for more efficiently providing security for an encrypted item via multi-level tagging, the method comprising:

(a) identifying, by a device that a first encrypted item of a first message has attached a first tag as one of a first prefix or a first postfix to the first encrypted item that identifies the first encrypted item is encrypted;

(b) removing, by the device responsive to the identification, the first tag from the first encrypted item;

(c) decrypting, by the device responsive to the identification of the first tag, the first encrypted item with the first tag removed;

(d) determining, by the device, that the decrypted item has attached a second tag as one of a second prefix or a second postfix to the decrypted item that identifies that the device had encrypted the item into the first encrypted item; and

(e) processing, by the device responsive to the determination that the decrypted item has attached the second tag, the item with the second tag removed from the first encrypted item.

2. The method of claim 1, further comprising identifying, by the device that a second encrypted item of the first message or a second message, does not have attached the first tag and responsive to the identification, identifying that the second encrypted item as not encrypted by the device and not processing a second item from the second encrypted item.

3. The method of claim 1, further comprising determining, by the device that a decryption of a second encrypted item of the first message or a second message, does not have attached the second tag and responsive to the determination, identifying the second encrypted item as not encrypted by the device and not processing a second item from the second encrypted item.

4. The method of claim 1, wherein step (b) further comprises removing, by the device, the first tag from the beginning of the first encrypted item.

5. The method of claim 1, wherein step (b) further comprises removing, by the device, the first tag from the end of the first encrypted item.

6. The method of claim 1, wherein step (c) further comprises determining, by the device, that the second tag is attached as a prefix to the decrypted item.

7. The method of claim 1, wherein step (f) further comprises removing, by the device, the second tag from the decrypted item.

8. A method for multi-level tagging of an encrypted item to provide improved security, the method comprising

(a) receiving, by a device from a sender, a message to a receiver, the message comprising an item to be encrypted;

(b) attaching, by the device, a first predetermined tag as one of a first prefix or a first postfix to at least one end of the item;

(c) encrypting, by the device, the item with the attached first predetermined tag to identify that the device is the device that encrypted the item;

(d) attaching, by the device, a second predetermined tag as one of a second prefix or a second postfix to at least one end of the encrypted item, the encrypted item comprising the first predetermined tag, the second predetermined tag identifying that the encrypted item is encrypted; and

(e) communicating, by the device, to the receiver the message comprising the encrypted item having attached the second predetermined tag and the encrypted item comprising the first predetermined tag attached to the item.

9. The method of claim 8, wherein step (a) further comprising receiving, by the device, the message comprising a cookie as the item to be encrypted.

10. The method of claim 8, wherein step (b) further comprises attaching, by the device, the first predetermined tag to the item to identify that the device encrypted the item.

11. The method of claim 8, wherein step (d) further comprises attaching, by the device, the second predetermined tag to the encrypted item to identify that the device encrypted the item.

12. The method of claim 8, wherein step (e) further comprises modifying, by the device, the message to replace the item with the encrypted item having attached the second predetermined tag.

13. The method of claim 8, further comprising attaching, by the device, the first predetermined tag and the second predetermined tag responsive to a policy applied to the message.