Reverse proxy server for implementing application layer and transport layer security rules

Abstract

Implementing application layer-based and transport layer-based security rules via a chain of reverse proxy servers is described. Each reverse proxy server in the chain is configured to perform specific functions for client messages intended for a target server and / or transmit context information related to the message to subsequent reverse proxy servers in the chain. For example, a first reverse proxy server in the chain is configured to include client-specific metadata in the transport layer of the message. A second reverse proxy server in the chain executes transport layer-based policy rules based on the metadata. This enables the second reverse proxy server to manage transport layer connections on a client-by-client basis, thereby enabling the second reverse proxy server to block unauthorized clients while maintaining transport layer connections for authorized clients. A third reverse proxy server in the chain executes application layer-based policy rules.

Description

Background Art

[0001] In a web environment, clients use the Hypertext Transfer Protocol (HTTP). Web servers provide users with access to files such as text, graphics, images, sounds, videos, and more. To increase security, a reverse proxy server can be used to represent a secure web server to external clients. External clients are not allowed to access the web server directly. Instead, their requests are sent to the reverse proxy server, which then forwards the client request to the web server. The reverse proxy server returns the completed request to the client while hiding the identity of the web server from the client. This prevents external clients from gaining direct, unmonitored access to the web server.

[0002] Reverse proxy servers can also be used to enforce security rules to selectively provide clients with access to a web server. However, such proxy servers are limited to monitoring the HTTP layer of incoming requests and are therefore limited to monitoring and preventing unauthorized read / write operations to the web server while still allowing unauthorized clients to connect to the web server. Summary of the invention

[0003] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0004] Methods, systems, devices and computer-readable storage media for implementing application-layer and transport-layer-based security rules are described. For example, as described herein, reverse proxy servers are coupled in a chain. Each reverse proxy server in the chain is configured to perform a specific function for a request message intended for a target server received from a client. The reverse proxy servers in the chain also transmit context information related to the request message to subsequent reverse proxy servers in the chain that are generally unknown. For example, the application layer reverse proxy server in the chain is configured to include client-specific metadata (usually located in the application layer of the request message) in the transport layer of the request message. Subsequent transport layer reverse proxy servers in the chain execute transport layer-based policy rules based on the metadata. This enables the transport layer reverse proxy server to manage transport layer connections on a user-by-user basis, thereby enabling the transport layer reverse proxy server to prevent unauthorized clients from accessing the target server while maintaining a transport layer connection for an authorized client. Another application layer reverse proxy in the chain executes an application layer-based policy rule based on the metadata. For example, the application layer reverse proxy determines whether a particular client is authorized to perform an operation (e.g., a read or write operation) on a resource provided by the target server.

[0005] Further features and advantages of the embodiments, as well as the structure and operation of various embodiments are described in detail below with reference to the accompanying drawings. Note that the methods and systems are not limited to the specific embodiments described herein. These embodiments are presented herein for illustrative purposes only. Based on the teachings contained herein, other embodiments will be apparent to those skilled in the relevant art. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The accompanying drawings illustrate embodiments of the present application and, together with the specification, constitute a part of the specification. These drawings are further used to explain the principles of the embodiments and enable technicians in the relevant field to make and use the embodiments.

[0007] Figure 1 A block diagram of a system for implementing security rules via a chain of reverse proxy servers is shown according to an example embodiment.

[0008] Figure 2 A block diagram of a system for implementing security rules via a chain of reverse proxy servers according to another example embodiment is shown.

[0009] Figure 3 A flow chart of a method for determining whether a client is authorized to access a target server based on security rules according to an example embodiment is shown.

[0010] Figure 4 A flow chart of a method for determining whether a client is authorized to perform an operation on a target server based on security rules according to an example embodiment is shown.

[0011] Figure 5 A flow chart of a method for notifying a client that a transport layer connection established for communicating with a target server has been terminated is shown according to an example embodiment.

[0012] Figure 6 A block diagram for notifying a client that a transport layer connection established for communicating with a target server has been terminated is shown according to an example embodiment.

[0013] Figure 7 is a block diagram of an example processor-based computer system that may be used to implement various embodiments.

[0014] Features and advantages of the embodiments described herein will become more apparent from the detailed description set forth below when taken in conjunction with the accompanying drawings, in which like reference numerals identify corresponding elements throughout. In the accompanying drawings, like reference numerals generally indicate identical, functionally similar, and / or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit in the corresponding reference number. DETAILED DESCRIPTION

[0015] 1. Introduction

[0016] The following detailed description discloses many example embodiments. The scope of this patent application is not limited to the disclosed embodiments, but also includes combinations of the disclosed embodiments, as well as modifications to the disclosed embodiments.

[0017] References in the specification to "one embodiment," "an embodiment," "an example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is considered to be within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0018] In the discussion, unless otherwise stated, adjectives such as "substantially" and "approximately" that modify conditions or relational characteristics of one or more features of the embodiments of the present disclosure are understood to mean that the conditions or characteristics are defined within a tolerance range that is acceptable for the operation of the embodiments for the intended application.

[0019] A number of exemplary embodiments are described below. Note that any section / subsection headings provided herein are not intended to be limiting. Embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. In addition, any disclosed embodiment section / subsection may be combined in any manner with any other embodiment described in the same section / subsection and / or different sections / subsections.

[0020] II. Example Embodiments

[0021] Embodiments described herein relate to a reverse proxy server configured to implement application-layer-based and transport-layer-based security rules. For example, as described herein, the reverse proxy servers are coupled in a chain-like manner. Each reverse proxy server in the chain is configured to perform a specific function on a request message received from a client and intended for a target server. The proxy server in the chain also communicates context information related to the request message to subsequent reverse proxy servers that are generally unknown in the chain. For example, the first application-layer reverse proxy server in the chain is configured to include client-specific metadata (which is generally located in the application layer of the request message) in the transport layer of the request message. Subsequent transport-layer reverse proxy servers in the chain execute transport-layer-based policy rules based on metadata. This advantageously enables the transport-layer reverse proxy server to manage transport-layer connections on a user-by-user basis, thereby enabling the transport-layer reverse proxy server to prevent unauthorized clients from accessing the target server when maintaining a transport-layer connection for an authorized client. Another application-layer reverse proxy server in the chain executes application-layer-based policy rules based on metadata. For example, the application-layer reverse proxy server determines whether a particular client is authorized to perform an operation (e.g., a read or write operation) on a resource provided by the target server.

[0022] The technology described herein provides robust client-specific security measures at both the application layer and the transport layer. Traditional transport layer reverse proxy servers cannot access client-specific metadata and effectively treat all clients as a single client. Similarly, such traditional proxy servers use a single connection between the reverse proxy and the target server for all clients that provide request messages to the target server. Therefore, if the connection is terminated in response to determining that a single client is not authorized to access the target server, all clients using the connection are also blocked from accessing the target server. This is harmful to valid clients that are authorized to access the target server. The technology described herein advantageously avoids this problem by establishing a separate connection with each client (rather than establishing a single connection for all clients), and each client can be terminated individually based on the client-specific metadata available to the transport layer reverse proxy.

[0023] In addition, distributing functions across different reverse proxy servers in a proxy server chain allows for selective deployment of reverse proxy servers, where only reverse proxy servers that perform required functions are deployed. This advantageously enables customization of functions that can be used for specific scenarios, and also distributes load between deployed proxy servers, thereby reducing the processing overhead of a given proxy server.

[0024] For example, Figure 1 1 is a block diagram of a system 100 for implementing security rules via a chain of reverse proxy servers according to one embodiment. Figure 1As shown, system 100 includes a plurality of clients 102A-102N, a reverse proxy server chain 104, and a target server 106. Each of clients 102A-102N is communicatively coupled to the reverse proxy server chain 104 via a first network 108. The reverse proxy server chain 104 is communicatively coupled to the target server 106 via a second network 110. Each of networks 108 and 110 may include one or more networks, such as a local area network (LAN), a wide area network (WAN), an enterprise network, the Internet, etc., and may include one or more wired and / or wireless portions.

[0025] Each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to implement a request-response protocol, wherein a request message is transmitted thereby and a message in response to the request message is received. According to an embodiment, each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to transmit a Hypertext Transfer Protocol (HTTP) request and receive an HTTP response. For example, each of the clients 102A-102N is configured to execute a browser application (i.e., a Web browser) that is configured to send and receive such requests and responses. The browser application enables network information resources to be retrieved, presented, and traversed. Information resources can be accessed by the browser application using a network address, such as a Uniform Resource Identifier (URI). Examples of information resources include web pages, images, videos, and other forms of content. Examples of browser applications include Microsoft WebView, published by Microsoft Corp. of Redmond, Washington. Mozilla, released by Mozilla Corp. of Mountain View, California Published by Apple Inc. of Cupertino, California and released by Google Inc. of Mountain View, California Chrome.

[0026] According to another embodiment, each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to send Remote Desktop Protocol (RDP) requests and receive RDP responses. For example, each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to execute an RDP client application configured to send and receive such requests and responses. Examples of RDP client applications include, but are not limited to, Remote Desktop Connection Server 106, which is published by Microsoft Corp. TM , VirtualBox Remote Display Protocol released by Oracle Corp. of Redwood City, California TM , open source software applications, FreeRDP, etc.

[0027] According to further embodiments, each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to send a server message block (SMB) request and receive an SMB response. For example, each of the clients 102A-102N is configured to execute an SMB client application configured to send and receive such requests and responses. Examples of SMB client applications include, but are not limited to, Samba, Netsmb, and the like.

[0028] According to yet another embodiment, each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to send secure shell (SSH) requests and receive SSH responses. For example, each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 is configured to execute an SSH client application configured to send and receive such requests and responses. Examples of SSH client applications include, but are not limited to, AbsoluteTelnet TM 、ConnectBot TM , SecureCRT, etc.

[0029] Note that the above-described request-response protocol is purely exemplary, and each of the clients 102A-102N, the reverse proxy server chain 104, and the target server 106 may be configured to implement and execute other request-response protocols.

[0030] Each of clients 102A-102N may be any type of fixed or mobile computing device, including a mobile computer or mobile computing device (e.g., devices, laptops, notebooks, tablets (such as the Apple iPad TM , netbooks, etc.), wearable computing devices (e.g., including smart glasses (such as Glass TM The computer may be mounted on a head-mounted device (such as a headset, etc.) or a fixed computing device (such as a desktop computer or PC (personal computer)).

[0031] The reverse proxy server chain 104 includes a plurality of reverse proxy servers that are communicatively coupled in a chain-like manner. The reverse proxy server chain 104 is located in front of the target server 106 so that the reverse proxy server chain 104 can serve requests from any client (e.g., client 102A-102N). In this way, the reverse proxy servers of the reverse proxy server chain 104 are different from the forward proxy servers, which are located in front of a specific group on one or more clients and act as intermediaries for these clients to contact any server. In other words, the forward proxy server operates on behalf of the client, while the reverse proxy server operates on behalf of the server (e.g., target server 106).

[0032] The reverse proxy server chain 104 is configured to implement security policies to protect the target server 106 (and the resources provided thereby) from unauthorized access and operation. For example, the reverse proxy server chain 104 is configured to manage transport layer (e.g., Transmission Control Protocol (TCP)) activities between the clients 102A-102N and the target server 106, and determine whether a particular client among the clients 102A-102N is authorized to communicate with the target server 106 based on a request made by the client. In response to determining that one of the clients 102A-102N is not authorized to communicate with the target server 106, the reverse proxy server chain 104 terminates the client's connection with the reverse proxy server chain 104 while maintaining the connection of the authorized client, thereby preventing access to the target server 106 only to unauthorized clients. The reverse proxy server chain 104 is also configured to manage application layer (e.g., HTTP) activity between the clients 102A-102N and the target server 106 and determine whether a particular one of the clients 102A-102N is authorized to perform operations with respect to resources provided by the target server 106 based on a request made by the client.

[0033] As will be referred to below Figure 2As described, each reverse proxy server of the reverse proxy server chain 104 is configured to perform a specific function to implement the aforementioned features. For example, the first reverse proxy server is configured to manage transport layer activities, and the second reverse proxy server is configured to manage application layer activities. Other reverse proxy servers in the reverse proxy server chain 104 can be configured to perform other types of functions. Allocating functions in this way (rather than merging all functions into a single reverse proxy server) allows for selective deployment of reverse proxy servers, wherein only reverse proxy servers that perform required functions are deployed. This advantageously enables customization of functions that can be used for specific scenarios, and also distributes loads between deployed proxy servers, thereby reducing the processing overhead of a given proxy server.

[0034] One or more reverse proxy servers in the reverse proxy server chain 104 can be implemented via a physical computing device configured to process data, a virtual machine executing on a physical computing device, and / or any type of device including one or more processors and / or memory. Examples of computing devices include, but are not limited to, desktop computers or PCs (personal computers), servers, computing nodes in a cloud-based environment, Internet of Things (IoT) devices, personal digital assistants (PDAs), laptops, notebooks, tablet computers, netbooks, smartphones, wearable computing devices (e.g., head-mounted devices including smart glasses, virtual headphones, smart watches, etc.), and / or the like. Optionally, one or more reverse proxies in the reverse proxy server chain 104 can be implemented as software applications executed on a physical computing device or a virtual machine, or can be implemented as a containerized application that is configured to be executed via a container engine executed on a physical computing device. Examples of container engines include, but are not limited to, a container engine that is executed by Published by the company

[0035] The target server 106 (also referred to as the source server) is configured to process and respond to incoming request messages (e.g., HTTP requests, SSH requests, RDP requests, SMB requests, etc.) originating from the clients 102A-102N. The target server 106 provides resources and / or web applications that can be accessed by the clients 102A-102N via the reverse proxy server chain 104. Examples of web applications include, but are not limited to, web email applications (e.g., those published by Google Inc. ), Outlook.com published by Microsoft Corp TM etc.), file sharing applications (e.g., released by Dropbox, Inc. of San Francisco, California etc.), productivity applications (e.g., Google Apps published by Google, Inc. TM etc. Although Figure 1 The target server 106 is shown as a single server, but the target server 106 may include any number of servers.

[0036] Figure 2 2 is a block diagram of a system 200 for implementing security rules via a chain of reverse proxy servers according to another embodiment. Figure 2 As shown, the system 200 includes a first client 202A, a second client 202B, a reverse proxy server chain 204, and a target server 206. Figure 1 As described respectively, the first client 202A and the second client 202B are examples of the clients 102A-102N, the reverse proxy server chain 204 is an example of the reverse proxy server chain 104, and the target server 206 is an example of the target server 106. The reverse proxy server chain 204 includes a plurality of reverse proxy servers. Figure 2 As shown, the reverse proxy server chain 204 includes a first reverse proxy server 208 , a second reverse proxy server 210 , a third reverse proxy server 212 , and a fourth reverse proxy server 214 .

[0037] Each of clients 202A and 202B is configured to transmit a request message intended for target server 206. For example, Figure 2 As shown, the first client 202A sends a request message 216, and the second client 202B sends a request message 218. In order to send the request message 216, the client software (e.g., a browser application) executed on the client 202A first establishes a transport layer connection 220 with the first reverse proxy server 208, and transmits the request message 216 to the first reverse proxy server 208 via the connection 220. In order to transmit the request message 218, the client software (e.g., a browser application) executed on the client 202B first establishes a transport layer connection 222 with the first reverse proxy server 208, and transmits the request message 218 to the first reverse proxy server 208 via the connection 220. According to an embodiment, the transport layer is based on the transmission control protocol (TCP), although the embodiments described herein are not limited thereto. According to such an embodiment, each of the clients 202A and 202B exchanges SYN and ACK control messages with the first reverse proxy server 208 to establish the connections 220 and 222, respectively.

[0038] According to an embodiment, request messages 216 and 218 are hypertext transfer protocol (HTTP) messages that include application layer (e.g., HTTP) information. Such information is specific to request message 216 in Figure 2 As shown in Figure 2 As shown, request message 216 includes a GET method that specifies an operation to be performed (i.e., a read operation) on a resource ("example.txt") and a path (" / test / ") at which the resource is stored by target server 206. The version of the application layer protocol used to transmit request message 216 is also specified (i.e., "HTTP / ll"). Request message 216 also specifies a host name (e.g., "destinationserver.com") that identifies the target server (e.g., target server 206) to which request message 216 is directed and a port number (e.g., 80) used for connection 220. Request message 216 may also include a cookie (e.g., "cookie=") that contains metadata (e.g., authentication information) associated with client 202A.<auth_key> ”). For example, the metadata may include a username associated with a user of client 202A, a password associated with the username, a personal identification number (PIN), etc. The request message 216 may also include an identifier of the application sending the request message 216 (e.g., User Agent: Chrome). In this example, the application is Browser application.

[0039] The first reverse proxy server 208 is configured to receive the request messages 216 and 218 via connections 220 and 222, respectively. The first reverse proxy server 208 is an application layer reverse proxy that is configured to analyze and / or interpret the application layer information (i.e., Figure 2 ). For example, the first reverse proxy server 208 is an HTTP reverse proxy. According to an embodiment, the application layer is based on the HTTP protocol, although the embodiments described herein are not limited thereto.

[0040] The first reverse proxy server 208 is configured to provide context about the clients 202A and 202B to subsequent reverse proxy servers in the reverse proxy server chain 204, which are transport layer reverse proxy servers. For example, the first reverse proxy server 208 is configured to provide context to the third reverse proxy server 212, which is a transport layer reverse proxy. As will be described below, the third reverse proxy server 212 uses the context information to determine whether the client (e.g., the clients 202A and 202B) is authorized to communicate with the target server 206. According to an embodiment, the first reverse proxy server 208 includes the context information in the HTTP CONNECT method header of the request message 216, and provides the modified request message (shown as request message 216') to the next reverse proxy in the chain (e.g., the second reverse proxy server 210).

[0041] For example, Figure 2 As shown (with reference to the modified request message 216'), the first reverse proxy server 208 modifies the request message 216 to include an HTTP CONNECT method, which is stored in the transport layer of the request message 216'. The HTTP CONNECT method specifies the host name of the next reverse proxy server (e.g., 2ndreverseproxy.com) in the reverse proxy server chain 204 (i.e., the second reverse proxy server 210). The first reverse proxy server 208 also includes an identifier of the client (i.e., client 202A) that sent the request message 216 in the HTTP CONNECT header. According to an embodiment, the first reverse proxy server 208 includes the Internet Protocol (IP) address (e.g., 127.0.0.1) of the client 202A and / or an identifier of the target server 206, which can be obtained from the IP layer of the request message 216. The first reverse proxy server 208 also maintains the original application layer information of the request message 216. In order to transmit the request message 216' to the second reverse proxy server 210, the first reverse proxy server 208 establishes a transport layer connection 224 with the second reverse proxy server 210, and transmits the modified request message 216' to the second reverse proxy server 210 via the connection 224. Figure 2 As shown, the first reverse proxy server 208 also establishes a transport layer connection 226 with the second reverse proxy server 210 to provide a request message 218' to the second reverse proxy server 210. The first reverse proxy server 208 modifies the request message 218 to generate a request message 218' in a manner similar to the request message 216 as described above. For the sake of brevity, the content of the request message 218' is not shown.

[0042] The second reverse proxy server 210 is configured to receive the request messages 216' and 218' from the first reverse proxy server 208 via connections 224 and 226, respectively. The second reverse proxy server 210 is an application layer reverse proxy that is configured to analyze and / or interpret both application layer information and transport layer information included in the request messages 216' and 218'. For example, the second reverse proxy server 210 can analyze cookies included in the application layer of the request messages 216' and 218' to determine metadata included therein (e.g., a user name of a user of the client 202A, a name of an organization (the user is part of the organization), etc.). The second reverse proxy server 210 stores the determined metadata in the HTTP CONNECT header of the request message 216' to generate a modified request message 216". The second reverse proxy server 210 may also delete cookies from the application layer of the request message 216' because the target server 206 does not require cookies. The second reverse proxy server 210 may further modify the request message 216' to update the HTTP CONNECT method to the host name of the next reverse proxy server (e.g., 3rdreverseproxy.com) in the specified reverse proxy server chain 204 (i.e., the third reverse proxy server 212). The modified request message 216" is provided to the third reverse proxy server 212 via the transport layer connection 228 established by the second reverse proxy server 210. Figure 2 As shown, the second reverse proxy server 210 modifies the request message 218' to generate a request message 218" in a manner similar to the request message 216' as described above, and provides the request message 218" via the transport layer connection 230 established by the second reverse proxy server 210. For simplicity, the content of the request message 218" is not shown.

[0043] In the event that the request message 216' does not include metadata (e.g., via a cookie), the second reverse proxy server 210 does not establish a connection 228 with the third reverse proxy server 212. Instead, the second reverse proxy server 210 provides a response message (e.g., (HTTP response message)) to the first client 202A via the first reverse proxy server 208 and connections 220 and 224, which redirects the client 202A to a login screen that enables the user of the client 202A to log in using his user credentials. For example, in an embodiment where a browser application executing on the client 202A issues the request message 216, the response message issued by the second reverse proxy server 210 will cause the browser application to redirect to a web page that allows the user to provide his user credentials. Upon providing valid user credentials, the user is authenticated and a new request message including the metadata is transmitted by the first client 202A and provided to the second reverse proxy server 210 (via the first reverse proxy server 208 and connections 220 and 224).

[0044] Third reverse proxy server 212 is configured to receive request messages 216" and 218" from second reverse proxy server 210 via connections 228 and 230, respectively. Third reverse proxy server 212 is a transport layer reverse proxy configured to analyze and / or interpret application layer information and transport layer information included in request messages 216" and 218".

[0045] The third reverse proxy server 212 is configured to act as a firewall and determine, based on one or more security rules, whether a client (e.g., client 202A and 202B) is authorized to access the target server 206. For example, the security rules may specify which users, organizations, client applications, ports, and / or source addresses are authorized to access the target server 206. The third reverse proxy server 212 is configured to analyze the transport layer of the request messages 216" and 218" to determine the user(s) associated with the client 202A and 202B, the organization(s) associated with the user(s), the client application(s) issuing the request messages 216" and 218", the port(s) to be used to communicate with the target server 206, and / or the source address(es) associated with the client 202A and 220B.

[0046] If the metadata associated with the particular client complies with the security rules, the third reverse proxy server 212 determines that the client is authorized to access the target server 206. The third reverse proxy server 212 can modify the request message (e.g., request message 216") to update the HTTP CONNECT method to specify the host name of the next reverse proxy server (e.g., 4threverseproxy.com) in the reverse proxy server chain 204 (i.e., the fourth reverse proxy server 214). The modified request message (shown as request message 216") is provided to the fourth reverse proxy server 214 via the transport layer connection 232 established by the third reverse proxy server 212.

[0047] If the metadata associated with a particular client does not comply with the security rule(s), the third reverse proxy server 212 terminates the connection associated with the client. For example, if the third reverse proxy server 212 determines that the client 202A is not authorized to access the target server 206, the third reverse proxy server 212 terminates the transport layer connection 228, thereby preventing the client 202A from accessing the target server 206. The third reverse proxy server 212 can terminate the transport layer connection 228 via sending a reset packet (e.g., a TCPRESET packet) back to the client 202A. The third reverse proxy server 212 maintains connections associated with other clients (e.g., client 202B) that have been determined to be authorized to access the target server 206. Conventional technology utilizes a single connection between a reverse proxy and a target server for all clients to provide request messages to the target server. Therefore, if the connection is terminated in response to determining that a single client is not authorized to access the target server, all clients using the connection are also prevented from accessing the target server. This is harmful to valid clients that are authorized to access the target server. The technology described herein advantageously avoids this problem by establishing a corresponding connection with each client (rather than establishing a single connection for all clients).

[0048] Further Figure 2 As shown, the third reverse proxy server 212 analyzes the request message 218" and / or modifies the request message 218" to generate a request message 218"' in a manner similar to the request message 216"' as described above, and provides the request message 218"' via the transport layer connection 234 established by the third reverse proxy server 212. For the sake of brevity, the content of the request message 218"' is not shown.

[0049] According to an embodiment, before terminating the connection, the third reverse proxy server 212 provides a notification to the second reverse proxy server 210, which causes the second reverse proxy server 210 to provide a response message to the unauthorized client. The response message includes a status code that causes the client to present an error message via a display device coupled thereto. For example, the response message can be an HTTP response message including a status code (e.g., HTTP status code 400, 401, 403, etc.). The HTTP response message can be received by a browser application executed on the client, which presents a hypertext markup language (HTML) web page that displays an error message corresponding to the status code.

[0050] The fourth reverse proxy server 214 is configured to receive the request messages 216'' and 218'' and determine whether the client (e.g., the clients 202A and 202B) is authorized to perform operations on the resources provided by the target server 206 based on one or more security rules. For example, the security rules may specify a particular user, organization, client application (e.g., browser application, e.g., ) and / or source addresses are authorized to perform operations on specific resources provided by the target server 206. For example, a security rule may specify that a first user of an organization can only read specific resources provided by the target server 206. Another security rule may specify that a second user of an organization can read and write different resources provided by the target server 206. The fourth reverse proxy server 214 is configured to analyze the HTTP CONNECT header information of the request messages 216'" and 218'" to determine the (multiple) users associated with the clients 202A and 202B, the (multiple) organizations associated with the (multiple) users, the (multiple) client applications that issued the request messages 216'" and 218'" and / or the (multiple) source addresses associated with the clients 202A and 202B. The fourth reverse proxy server 214 is also configured to analyze the application layer information of the request messages 216'" and 218'" to determine the resources that the clients 202A and 202B are attempting to access and the operations to be performed on the resources (e.g., get (or read)). In particular, fourth reservation proxy server 214 analyzes the path (eg, " / test / ") and the resource name (eg, "example.txt") to determine the resource that is attempting to be accessed.

[0051] If the authentication associated with the particular client complies with the security rules, the fourth reverse proxy server 214 determines that the client is authorized to perform operations on the determined resources provided by the target server 206. The fourth reverse proxy server 214 can modify the request message (e.g., request message 216'") to remove the transport layer information contained therein (i.e., the HTTP CONNECT method and its header information) before providing the request message (shown as request message 216"") to the target server 206. The fourth reverse proxy server 214 provides the request message 216"" via the transport layer connection 236 established by the fourth reverse proxy server 214. The fourth reverse proxy server 214 provides the request message 216"" to the target server 206 based on the target server identifier (e.g., "destinationserver.com") and the port (e.g., 80) included in the application layer information of the request message 216".

[0052] If the metadata associated with the particular client does not comply with the security rules, the fourth reverse proxy server 214 does not provide the request message to the target server 206. Instead, the fourth reverse proxy server 214 provides a response message to the client (e.g., via the reverse proxy servers 208, 210, and 212) including a status code that causes the client to present an error message via a display device coupled thereto.

[0053] Further Figure 2 As shown, the fourth reverse proxy server 214 analyzes the request message 218"' and / or modifies the request message 218"' to generate a request message 218"" in a manner similar to the request message 216"" as described above, and provides the request message 218"" via the transport layer connection 238 established by the fourth reverse proxy server 214. For simplicity, the content of the request message 218"" is not shown.

[0054] According to an embodiment, the fourth reverse proxy server 214 provides request messages 216"" and 218"" to a router (not shown), and the router provides request messages 216"" and 218"" to the target server 206. For example, the fourth reverse proxy server 214 may include an HTTP CONNECT header to include the address of the router and forward the request messages 216"" and 218"" to the router. The router can be configured to remove the HTTP CONNET method and its header, and forward the request messages 216"" and 218"" to the target server 206 based on the target server identifier (e.g., "destinationserver.com") and the port (e.g., 80) contained in the application layer information of the request messages 216"" and 218"".

[0055] Note that in certain embodiments, the reverse proxy chain 204 may include additional reverse proxy servers or fewer reverse proxy servers, depending on the functionality required. It should also be noted that the functionality described above for a particular reverse proxy may be merged or combined with another reverse proxy.

[0056] Therefore, security rules can be implemented in a variety of ways via a chain of reverse proxy servers. For example, Figure 3 300 is a flowchart of a method for determining whether a client is authorized to access a target server based on security rules according to an example embodiment. In an embodiment, the flowchart 300 may be as follows: Figure 2 In particular, the flowchart 300 may be implemented by communicating with a first client (e.g., Figure 2 The first connection (e.g., connection 220, 224, and 228) associated with the client 202A shown in FIG. 1 is coupled to the application layer reverse proxy server (e.g., the second reverse proxy server 210) and is connected to the second client (e.g., Figure 2 The second connection (eg, connection 222, 226, and 230) associated with the client 202B shown in FIG. 1 is coupled to a transport layer reverse proxy (eg, as shown in FIG. 10 ) of the application layer reverse proxy server. Figure 2 Therefore, we will continue to refer to Figure 2 Flowchart 300 is described. Based on the following discussion of flowchart 300 and system 200, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0057] Figure 3 Flowchart 300 begins at step 302. At step 302, a request message on behalf of a first client intended for a target server is received from an application layer reverse proxy server. The request message is received via a first connection and includes application layer metadata associated with the first client. For example, referring to Figure 2 , the third reverse proxy server 212 receives a request message 216 on behalf of the client 202A from the second reverse proxy server 210. The request message 216" is intended for the target server 206. The request message 216" includes application layer metadata associated with the first client 212A. For example, Figure 2 As shown, the request message 216" includes a user name associated with the first client 202A (e.g., "user1"), and an organization name associated with the user name ("microsoft"), and the request message is based on a cookie stored in the application layer of the request message received by the third reverse proxy server 212.

[0058] According to one or more embodiments, the transport layer reverse proxy server is a TCP reverse proxy server. Figure 2 , the third reverse proxy server 212 is a TCP reverse proxy server.

[0059] According to one or more embodiments, the application layer metadata is included in the HTTP CONNECT header of the request message. Figure 2 , the second reverse proxy server 210 stores the application layer metadata in the HTTP CONNECT header of the request message 216 ″ provided to the third reverse proxy server 212. The second reverse proxy server 210 determines the metadata based on analyzing the cookie stored in the application layer of the request message 216 ′ received by the second reverse proxy server 210.

[0060] According to one or more embodiments, the application layer metadata includes at least one of a user name, a password, an organization name, a browser identification (ID), or an Internet Protocol (IP) address. Figure 2 , request message 216 "user name ("user1"), organization name ("microsoft"), and IP address (127.0.0.1).

[0061] In step 304, it is determined whether the first client is authorized to communicate with the target server by applying the first security rule to the application layer metadata. If it is determined that the first client is not authorized to communicate with the target server, the process continues to step 306. Otherwise, the process continues to step 308. For example, referring to Figure 2 , the third reverse proxy server 212 determines whether the first client 202A is authorized to communicate with the target server 206 by applying the first security rule to the application layer metadata stored in the request message 216 .

[0062] In step 306, the first connection is terminated while maintaining the second connection. Figure 2 , the third reverse proxy server 212 terminates the transport layer connection 228 while maintaining the transport layer connection 230. That is, if the first client 202A is not authorized to communicate with the target server 206 and the second client 202B is authorized to communicate with the target server 206, the third reverse proxy server 212 only terminates the transport layer connection 228 and does not terminate the transport layer connection 230.

[0063] At step 308, a third connection is created to an application layer reverse proxy server coupled between the transport layer reverse proxy server and the target server. Figure 2, the third reverse proxy server 212 creates a connection 232 to a fourth reverse proxy server 214 , which is coupled between the third reverse proxy server 212 and the target server 206 .

[0064] In step 310, the request message is provided to an application layer reverse proxy server coupled between the transport layer reverse proxy server and the target server via a third connection. Figure 2 , the third reverse proxy server 212 provides a request message 216'' to the fourth reverse proxy server 214 via the transport layer connection 232.

[0065] According to one or more embodiments, the application layer reverse proxy server is an HTTP reverse proxy server. Figure 2 , the fourth reverse proxy server 214 is an HTTP reverse proxy server.

[0066] Figure 4 400 is a flowchart of a method for determining whether a client is authorized to perform an operation on a target server based on security rules according to an example embodiment. In an embodiment, flowchart 400 may be performed by Figure 2 In particular, the flowchart 400 may be implemented by an application layer reverse proxy (eg, as shown in FIG. 1 ) coupled between a transport layer reverse proxy server (eg, the third reverse proxy server 212) and a target server (eg, the target server 206). Figure 2 Therefore, we will continue to refer to Figure 2 4 to describe flowchart 400. Based on the following discussion of flowchart 400 and system 200, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0067] Figure 4 The flowchart 400 starts from step 402. In step 402, a request message is received. For example, referring to Figure 2 , the fourth reverse proxy server 214 receives the request message 216'' from the third reverse proxy server 212.

[0068] At step 404, a determination is made as to whether the first client is authorized to perform an operation on the target server by applying the second security rule to the application layer metadata. The operation is specified by the request message. If it is determined that the first client is authorized to perform the operation, the process continues to step 406. Otherwise, the process continues to step 408. For example, referring to Figure 2The fourth reverse proxy server 214 determines whether the first client 202A is authorized to perform operations on the target server 206 by applying the second security rule to the application layer metadata included in the HTTP CONNECT method header in the request message 216''. Figure 2 As shown, the operation and the resource on which the operation will be performed are specified in the application layer of the request message 216'" (i.e., "GET / test / example.txt"). The GET operation is configured to read the resource provided via the target server 206. Note that the GET operation is just an example operation, and other operations can be performed and analyzed. Such operations include, but are not limited to, POST (create a resource), PUT (update or replace a resource), DELETE (delete a resource), etc.

[0069] In step 406, the request message is provided to the target server. Figure 2 The fourth reverse proxy server 214 removes the HTTP CONNECT method and its header information from the request message 216'' and provides the modified request message (ie, the request message 216'') to the target server via the transport layer connection 236.

[0070] At step 408, the request message is prevented from being transmitted to the target server. Figure 2 , the fourth reverse proxy server 214 does not transmit the request message 'request message 216'' to the target server 206. Instead, the fourth reverse proxy server 214 may provide (e.g., via reverse proxy servers 208, 210, and 212) a response message including a status code (e.g., HTTP status code 400, 401, 403, etc.) to the first client 202A, which causes the client to present an error message via a display device coupled thereto.

[0071] Figure 5 500 is a flowchart of a method for notifying a client that a transport layer connection established for communicating with a target server has been terminated according to an example embodiment. In an embodiment, flowchart 500 may be performed by Figure 6 The system 600 described in is implemented. Figure 6 6 is a system 600 for notifying a client that a transport layer connection established for communicating with a target server has been terminated according to an example embodiment. Figure 6As shown, system 600 includes client 202A, first reverse proxy server 208, second reverse proxy server 210, third reverse proxy server 212, and display device 606. Display device 606 is coupled to client 202A. Display device 606 can be integrated with client 202A, or can be an external component coupled to client 202A via a wired or wireless connection. Examples of display device 606 include, but are not limited to, display screens (e.g., LED display screens, OLED display screens, LCD display screens, etc.), monitors, televisions, projectors, etc. For the sake of brevity, reference devices are not shown. Figure 2 The flowchart 500 will refer to the other components shown and described. Figure 6 Based on the following discussion of flowchart 500 and system 600, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0072] Figure 5 Flowchart 500 begins at step 502. In step 502, in response to determining that the first client is not authorized to communicate with the target server, a notification is provided to the application layer reverse proxy server. Figure 6 , the third reverse proxy server 212 provides a notification 602 to the second reverse proxy server 210 coupled between the third reverse proxy server 212 and the first client 202A (via the transport layer connection 228). The third reverse proxy server 212 responds by determining that the first client 202A is not authorized to communicate with the target server (e.g., Figure 2 Notification 602 is provided by communicating with a target server 206) as shown.

[0073] In step 504, in response to receiving the notification, a response message is provided to the first client, the response message including a status code that causes the first client to present an error message via a display device coupled thereto. Figure 6 , the second reverse proxy server 210 provides a response message 604 to the first reverse proxy server 208 via the transport layer connection 224, and the first reverse proxy server 208 provides the response message 604 to the first client 202A via the transport layer connection 220. The response message 604 includes a status code (e.g., HTTP status code 400, 401, 403, etc.) that causes the first client 202A to present an error message via a display device 606 coupled to the first client 202A. For example, in an embodiment where a browser application executed on the first client 202A receives the response message 604, the browser application may cause an error message corresponding to the status code to be displayed in a browser window presented on the display device 606. The foregoing techniques advantageously provide a user with a high-level notification that a transport layer connection (e.g., the transport layer connection 228) is being terminated.

[0074] 3. Example Computer System Implementation

[0075] The clients 102A-102N, the reverse proxy server chain 104, the target server 106, the clients 202A and 202B, the reverse proxy server chain 204, the first reverse proxy server 208, the second reverse proxy server 210, the third reverse proxy server 212, the fourth reverse proxy server 214, and / or the target server 206 (and / or any components described therein), and / or the flowcharts 300, 400 and / or 500 can be implemented in hardware or in hardware in combination with one or both of software and / or firmware. For example, the clients 102A-102N, the reverse proxy server chain 104, the target server 106, the clients 202A and 202B, the reverse proxy server chain 204, the first reverse proxy server 208, the second reverse proxy server 210, the third reverse proxy server 212, the fourth reverse proxy server 214 and / or the target server 206 (and / or any components described therein), and / or the flowcharts 300, 400 and / or 500 can be implemented as computer program code / instructions configured to be executed in one or more processors and stored in a computer-readable storage medium.

[0076] Optionally, the clients 102A-102N, the reverse proxy server chain 104, the target server 106, the clients 202A and 202B, the reverse proxy server chain 204, the first reverse proxy server 208, the second reverse proxy server 210, the third reverse proxy server 212, the fourth reverse proxy server 214 and / or the target server 206 (and / or any components described therein), and / or the flowcharts 300, 400 and / or 500 can be implemented as hardware logic / circuitry.

[0077] For example, in an embodiment, one or more of any combination of clients 102A-102N, reverse proxy chain 104, target server 106, clients 202A and 202B, reverse proxy chain 204, first reverse proxy 208, second reverse proxy 210, third reverse proxy 212, fourth reverse proxy 214, and / or target server 206 (and / or any components described therein), and / or flowcharts 300, 400, and / or 500 may be implemented together in a SoC. A SoC may include an integrated circuit chip that includes one or more of a processor (e.g., a central processing unit (CPU), a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), a memory, one or more communication interfaces, and / or other circuits, and may optionally execute received program code and / or include embedded firmware to perform functions.

[0078] Figure 7 Depicted is an exemplary implementation of a computing device 700 that can implement an embodiment. For example, clients 102A-102N, reverse proxy server chain 104, target server 106, clients 202A and 202B, reverse proxy server chain 204, first reverse proxy server 208, second reverse proxy server 210, third reverse proxy server 212, fourth reverse proxy server 214 and / or target server 206 (and / or any components described therein) and / or flow charts 300, 400 and / or 500 can be implemented in one or more computing devices similar to the computing device 700 in a fixed or mobile computer embodiment, which includes one or more features and / or alternative features of the computing device 700. The description of the computing device 700 provided herein is provided for the purpose of illustration and is not intended to be limiting. As known to those skilled in the relevant art, the embodiments can be implemented in other types of computer systems.

[0079] like Figure 7 As shown, computing device 700 includes one or more processors, referred to as processor circuit 702, system memory 704, and bus 706, which couples various system components including system memory 704 to processor circuit 702. Processor circuit 702 is implemented as a central processing unit (CPU), microcontroller, microprocessor and / or other physical hardware processor circuit electronic and / or optical circuit in one or more physical hardware circuit device elements and / or integrated circuit devices (semiconductor material chips or tube dies). Processor circuit 702 can execute program codes stored in computer readable media, such as program codes of operating system 730, application program 732, other program 734, etc. Bus 706 represents one or more of several types of bus structures, including memory bus or memory controller using any of various bus architectures, peripheral bus, accelerated graphics port, and processor or local bus. System memory 704 includes read-only memory (ROM) 708 and random access memory (RAM) 710. Basic input / output system 712 (BIOS) is stored in ROM 708.

[0080] The computing device 700 also has one or more of the following drives: a hard disk drive 714 for reading and writing to a hard disk, a disk drive 716 for reading or writing to a removable disk 718, and an optical drive 720 for reading or writing to a removable optical disk 722 (such as a CD ROM, DVD ROM or other optical media). The hard disk drive 714, the disk drive 716, and the optical drive 720 are connected to the bus 706 by a hard disk drive interface 724, a disk drive interface 726, and an optical drive interface 728, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer. Although a hard disk, a removable disk, and a removable optical disk are described, other types of hardware-based computer-readable storage media (such as flash memory cards, digital video disks, RAM, ROM, and other hardware storage media) may also be used to store data.

[0081] A plurality of program modules may be stored on a hard disk, a disk, an optical disk, a ROM or a RAM. These programs include an operating system 730, one or more application programs 732, other programs 734 and program data 736. Application programs 732 or other programs 734 may include, for example, computer program logic (e.g., computer program code or instructions) for implementing any of the following features: client 102A-102N, reverse proxy server chain 104, target server 106, client 202A and 202B, reverse proxy server chain 204, first reverse proxy server 208, second reverse proxy server 210, third reverse proxy server 212, fourth reverse proxy server 214 and / or target server 206 (and / or any components described therein), and / or flow chart 300, 400 and / or 500, and / or other embodiments described herein.

[0082] A user may enter commands and information into the computing device 700 through input devices such as a keyboard 738 and a pointing device 740. Other input devices (not shown) may include a microphone, a joystick, a game controller, a satellite dish, a scanner, a touch screen and / or touch pad, a voice recognition system for receiving voice input, a gesture recognition system for receiving gesture input, etc. These and other input devices are typically connected to the processor circuit 702 through a serial port interface 742 coupled to the bus 706, but may be connected through other interfaces such as a parallel port, a game port, or a universal serial bus (USB).

[0083] Display screen 744 is also connected to bus 706 via an interface, such as video adapter 746. Display screen 744 may be external to computing device 700 or incorporated in computing device 700. Display screen 744 may display information as well as serve as a user interface for receiving user commands and / or other information (e.g., by touch, gestures, virtual keyboard, etc.). In addition to display screen 744, computing device 700 may include other peripheral output devices (not shown), such as speakers and printers.

[0084] The computing device 700 is connected to a network 748 (e.g., the Internet) through an adapter or network interface 750, a modem 752, or other means for establishing communications over the network. Figure 7 As shown, modem 752, which may be internal or external, may be connected to bus 706 via serial port interface 742, or may be connected to bus 706 using another type of interface including a parallel interface.

[0085] As used herein, the terms "computer program medium", "computer readable medium" and "computer readable storage medium" are used to refer to physical hardware media, such as a hard disk associated with hard disk drive 714, removable disk 718, removable optical disk 722, other physical hardware media (such as RAM, ROM, flash memory cards, digital video disks, compact disks, MEMs, nanotechnology-based storage devices, and other types of physical / tangible hardware storage media). Such computer readable storage media are different from and do not overlap with communication media (excluding communication media). Communication media contain computer readable instructions, data structures, program modules or other data in a modulated data signal (such as a carrier wave). The term "modulated data signal" refers to a signal having one or more of its characteristics that are set or changed in such a way as to encode information in the signal. By way of example and not limitation, communication media include wireless media (such as acoustic, RF, infrared and other wireless media) and wired media. Embodiments are also directed to such communication media that are separate and non-overlapping from embodiments directed to computer readable storage media.

[0086] As described above, computer programs and modules (including application programs 732 and other programs 734) can be stored on a hard disk, disk, optical disk, ROM, RAM or other hardware storage medium. Such computer programs can also be received via network interface 750, serial port interface 742 or any other interface type. When executed or loaded by an application, such computer programs enable computing device 700 to implement the features of the embodiments discussed herein. Therefore, such computer programs represent controllers of computing device 700.

[0087] Embodiments are also directed to computer program products including computer codes or instructions stored on any computer readable medium. Such computer program products include hard drives, optical drives, storage device packages, portable memory sticks, memory cards, and other types of physical storage hardware.

[0088] IV. Further Example Embodiments

[0089] A method is described herein. The method includes: being performed by a transport layer reverse proxy server (the transport layer reverse proxy server is coupled to an application layer reverse proxy server via a first connection associated with a first client, and is coupled to the application layer reverse proxy server via a second connection associated with a second client): receiving from the application layer reverse proxy server a request message on behalf of a first client intended for a target server, the request message being received via the first connection and including application layer metadata associated with the first client; determining whether the first client is authorized to communicate with the target server by applying a first security rule to the application layer metadata; and terminating the first connection while maintaining the second connection in response to determining that the first client is not authorized to communicate with the target server.

[0090] In one embodiment of the above method, the method also includes: the transport layer reverse proxy server also executes: in response to determining that the first client is authorized to communicate with the target server: creating a third connection to the application layer reverse proxy server, which is coupled between the transport layer reverse proxy server and the target server; providing the request message to the application layer reverse proxy server via the third connection, which is coupled between the transport layer reverse proxy server and the target server.

[0091] In one embodiment of the above method, the method also includes: an application layer reverse proxy server is coupled between the transport layer reverse proxy server and the target server, and the application layer reverse proxy server performs: receiving a request message; determining whether the first client is authorized to perform an operation on the target server by applying a second security rule to the application layer metadata, the operation being specified by the request message; in response to determining that the first client is authorized to perform an operation on the target server, providing the request message to the target server; and in response to determining that the first client is not authorized to perform an operation on the target server, preventing the request message from being transmitted to the target server.

[0092] In one embodiment of the above method, the method also includes: the transport layer reverse proxy server also executes: in response to determining that the first client is not authorized to communicate with the target server, providing a notification to the application layer reverse proxy server; and the application layer reverse proxy server executes: in response to receiving the notification, providing a response message to the first client, the response message including a status code, which causes the first client to present an error message via a display device coupled thereto.

[0093] In one embodiment of the above method, the application layer metadata is included in a Hypertext Transfer Protocol (HTTP) connection header of the request message.

[0094] In one embodiment of the above method, the application layer metadata includes at least one of the following: a user name; a password; an organization name; a browser identification (ID); or an Internet Protocol (IP) address.

[0095] In one embodiment of the above method, the transport layer reverse proxy server is a Transmission Control Protocol (TCP) reverse proxy server.

[0096] In one embodiment of the above method, the application layer reverse proxy server is an HTTP reverse proxy server.

[0097] The present invention also describes a system. The system includes: an application layer reverse proxy server, coupled to a first client and a second client; and a transport layer reverse proxy server, coupled to the application layer reverse proxy server via a first connection associated with the first client, and coupled to the application layer reverse proxy server via a second connection associated with the second client, the transport layer reverse proxy server including: a first processor circuit; and a first memory, storing a first program code configured to be executed by the first processor circuit, the first program code when executed by the first processor circuit is configured to: receive a request message on behalf of the first client intended for a target server from the application layer reverse proxy server, the request message being received via the first connection and including application layer metadata associated with the first client; determine whether the first client is authorized to communicate with the target server by applying a first security rule to the application layer metadata; and in response to determining that the first client is not authorized to communicate with the target server, terminate the first connection while maintaining the second connection.

[0098] In one embodiment of the above system, the first program code is also configured to, when executed by the first processor circuit: in response to determining that the first client is authorized to communicate with the target server: create a third connection to an application layer reverse proxy server, which is coupled between the transport layer reverse proxy server and the target server; and provide a request message to the application layer reverse proxy server coupled between the transport layer reverse proxy server and the target server via the third connection.

[0099] In one embodiment of the above system, an application layer reverse proxy server coupled between a transport layer reverse proxy server and a target server includes: a second processor circuit; and a second memory storing a second program code configured to be executed by the second processor circuit, the second program code being configured to: receive a request message; determine whether a first client is authorized to perform an operation on the target server by applying a second security rule to application layer metadata, the operation being specified by the request message; in response to determining that the first client is authorized to perform the operation on the target server, provide the request message to the target server; and in response to determining that the first client is not authorized to perform the operation on the target server, prevent the request message from being transmitted to the target server.

[0100] In one embodiment of the above-mentioned system, the first program code, when executed by the first processor circuit, is also configured to: in response to determining that the first client is not authorized to communicate with the target server, provide a notification to the application layer reverse proxy server, the application layer reverse proxy server comprising: a second processor circuit; a second memory, which stores a second program code configured to be executed by the second processor circuit, the second program code, when executed by the second processor circuit, is configured to: in response to receiving the notification, provide a response message to the first client, the response message comprising a status code, which causes the first client to present an error message via a display device coupled thereto.

[0101] In one embodiment of the above system, the application layer metadata is included in a Hypertext Transfer Protocol (HTTP) connection header of the request message.

[0102] In one embodiment of the above system, the application layer metadata includes at least one of the following: a user name; a password; an organization name; a browser identification (ID); or an Internet Protocol (IP) address.

[0103] In one embodiment of the above system, the transport layer reverse proxy server is a Transmission Control Protocol (TCP) reverse proxy server.

[0104] In one embodiment of the above system, the application layer reverse proxy server is an HTTP reverse proxy server.

[0105] A computer-readable storage medium having program instructions recorded thereon, when executed by at least one processor of a computing device (the device is coupled to an application layer reverse proxy server via a first connection associated with a first client and coupled to the application layer reverse proxy server via a second connection associated with a second client) performs a method, the method comprising: receiving a request message on behalf of a first client intended for a target server from an application layer reverse proxy server, the request message being received via the first connection and including application layer metadata associated with the first client; determining whether the first client is authorized to communicate with the target server by applying a first security rule to the application layer metadata; and in response to determining that the first client is not authorized to communicate with the target server, terminating the first connection while maintaining the second connection.

[0106] In one embodiment of the aforementioned computer-readable storage medium, the method also includes: in response to determining that the first client is authorized to communicate with the target server: creating a third connection to an application layer reverse proxy server, the application layer reverse proxy server coupled between the computing device and the target server; and providing the request message to the application layer reverse proxy server coupled between the computing device and the target server via the third connection.

[0107] In one embodiment of the above-mentioned computer-readable storage medium, the application layer metadata includes at least one of the following: a user name; a password; an organization name; a browser identification (ID); or an Internet Protocol (IP) address.

[0108] In one embodiment of the above computer-readable storage medium, the computing device is configured as a Transmission Control Protocol (TCP) reverse proxy server.

[0109] V. Conclusion

[0110] Although various embodiments have been described above, it should be understood that they are presented only as examples and not by way of limitation. Those skilled in the relevant art will appreciate that various changes in form and details may be made therein without departing from the spirit and scope of the described embodiments as defined in the appended claims. The present embodiments should not be limited by any of the above exemplary embodiments, but should only be defined in accordance with the appended claims and their equivalents.

Claims

1. A method comprising: Performed by a transport layer reverse proxy server coupled to a first application layer reverse proxy server via a first connection associated with a first client and coupled to the first application layer reverse proxy server via a second connection associated with a second client: receiving, from the first application layer reverse proxy server, a request message on behalf of the first client and intended for a target server, the request message being received via the first connection and including, in a transport layer of the request message, application layer metadata associated with the first client; determining whether the first client is authorized to communicate with the target server by applying a first security rule to the application layer metadata; as well as In response to determining that the first client is not authorized to communicate with the target server, the first connection is terminated while maintaining the second connection.

2. The method according to claim 1, further comprising: The transport layer reverse proxy server further executes: In response to determining that the first client is authorized to communicate with the target server: creating a third connection to a second application layer reverse proxy server coupled between the transport layer reverse proxy server and the target server; and The request message is provided to the second application layer reverse proxy server via the third connection.

3. The method according to claim 2, further comprising: The second application layer reverse proxy server executes: receiving the request message; determining whether the first client is authorized to perform an operation with respect to the target server by applying a second security rule to the application layer metadata, the operation being specified by the request message; In response to determining that the first client is authorized to perform the operation with respect to the target server, providing the request message to the target server; as well as In response to determining that the first client is not authorized to perform the operation with respect to the target server, the request message is prevented from being transmitted to the target server.

4. The method according to claim 1, further comprising: The transport layer reverse proxy server further executes: In response to determining that the first client is not authorized to communicate with the target server, providing a notification to the first application layer reverse proxy server; and Executed by the first application layer reverse proxy server: In response to receiving the notification, a response message is provided to the first client, the response message including a status code that causes the first client to present an error message via a display device coupled to the first client.

5. The method of claim 1, wherein the application layer metadata is included in a Hypertext Transfer Protocol (HTTP) connection header of the request message.

6. The method according to claim 1, wherein the application layer metadata comprises at least one of the following: username; password; Name of organization; a browser identifier (ID); or Internet Protocol (IP) address.

7. The method of claim 1, wherein the transport layer reverse proxy server is a Transmission Control Protocol (TCP) reverse proxy server.

8. The method of claim 1, wherein the first application layer reverse proxy server is a Hypertext Transfer Protocol (HTTP) reverse proxy server.

9. A system comprising: a first application layer reverse proxy server coupled to the first client and the second client; as well as a transport layer reverse proxy server coupled to the first application layer reverse proxy server via a first connection associated with the first client and coupled to the first application layer reverse proxy server via a second connection associated with the second client, the transport layer reverse proxy server comprising: a first processor circuit; and a first memory storing a first program code, wherein the first program code, when executed by the first processor circuit, receiving, from the first application layer reverse proxy server, a request message on behalf of the first client and intended for a target server, the request message being received via the first connection and including, in a transport layer of the request message, application layer metadata associated with the first client; determining whether the first client is authorized to communicate with the target server by applying a first security rule to the application layer metadata; and In response to determining that the first client is not authorized to communicate with the target server, the first connection is terminated while maintaining the second connection.

10. The system of claim 9, wherein the first program code, when executed by the first processor circuit, is further configured to: In response to determining that the first client is authorized to communicate with the target server: creating a third connection to a second application layer reverse proxy server coupled between the transport layer reverse proxy server and the target server; and The request message is provided to the second application layer reverse proxy server via the third connection.

11. The system according to claim 10, wherein the second application layer reverse proxy server comprises: a second processor circuit; as well as a second memory storing a second program code, wherein the second program code, when executed by the second processor circuit, Receiving the request message from the transport layer reverse proxy server; determining whether the first client is authorized to perform an operation with respect to the target server by applying a second security rule to the application layer metadata, the operation being specified by the request message; In response to determining that the first client is authorized to perform the operation with respect to the target server, providing the request message to the target server; as well as In response to determining that the first client is not authorized to perform the operation with respect to the target server, the request message is prevented from being transmitted to the target server.

12. The system of claim 9, wherein the first program code, when executed by the first processor circuit, further: In response to determining that the first client is not authorized to communicate with the target server, providing a notification to the first application layer reverse proxy server, The first application layer reverse proxy server comprises: a second processor circuit; as well as A second memory stores a second program code, wherein the second program code is executed by the second processor circuit. In response to receiving the notification, a response message is provided to the first client, the response message including a status code that causes the first client to present an error message via a display device coupled to the first client.

13. The system of claim 9, wherein the application layer metadata is included in a Hypertext Transfer Protocol (HTTP) connection header of the request message.

14. The system of claim 9, wherein the application layer metadata comprises at least one of the following: username; password; Name of organization; a browser identifier (ID); or Internet Protocol (IP) address.

15. The system of claim 9, wherein the transport layer reverse proxy server is a Transmission Control Protocol (TCP) reverse proxy server.

16. The system of claim 9, wherein the first application layer reverse proxy server is a Hypertext Transfer Protocol (HTTP) reverse proxy server.

17. A computer-readable storage medium having program instructions recorded thereon, the program instructions, when executed by at least one processor of a computing device, performing a method, the computing device being coupled to a first application layer reverse proxy server via a first connection associated with a first client, and being coupled to the first application layer reverse proxy server via a second connection associated with a second client, the method comprising: receiving, from the first application layer reverse proxy server, a request message on behalf of the first client and intended for a target server, the request message being received via the first connection and including, in a transport layer of the request message, application layer metadata associated with the first client; determining whether the first client is authorized to communicate with the target server by applying a first security rule to the application layer metadata; as well as In response to determining that the first client is not authorized to communicate with the target server, the first connection is terminated while maintaining the second connection.

18. The computer-readable storage medium of claim 17, the method further comprising: In response to determining that the first client is authorized to communicate with the target server: creating a third connection to a second application layer reverse proxy server coupled between the computing device and the target server; as well as The request message is provided to the second application layer reverse proxy server via the third connection.

19. The computer-readable storage medium of claim 17, wherein the application layer metadata comprises at least one of the following: username; password; Name of organization; a browser identifier (ID); or Internet Protocol (IP) address.

20. The computer-readable storage medium of claim 17, wherein the computing device is a Transmission Control Protocol (TCP) reverse proxy server.

Images