Policy-Driven URL Encoding for Clientless SSL VPN Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack a robust mechanism for fine-grain configuration and policy-driven URL encoding in clientless SSL VPN scenarios, which hinders secure access to private network resources by obscuring or encrypting URLs based on client credibility and security concerns.
Innovation Solution
An intermediary device determines an encoding scheme from a plurality of options and rewrites URLs for transmission to clients, using transparent, opaque, or encrypted methods based on established policies, ensuring secure access without exposing resource locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the provider provides the URL of the resource on the private network directly to the client, then the client can access the resource, but the client may try to gain access to that resource via unsecured means or directly outside of the virtual private network connection
Solution Approach 1:
The patent introduces an intermediary device (SSL VPN gateway) that sits between the client and the private network resource. This gateway translates and encrypts traffic, performing dynamic URL rewrite through resource cloaking. The intermediary rewrites the original private network URL into a transformed URL that the client receives, preventing direct access to the resource while maintaining secure access through the VPN tunnel.
Solution Approach 2:
The patent applies parameter changes by transforming the URL structure itself. The SSL VPN gateway modifies URL parameters (such as path, query strings, or domain components) to create an obfuscated version that the client receives. This parameter transformation ensures that even if the client sees the URL, it cannot be used to directly access the resource outside the secured VPN connection.
2Object-affected harmful factors
If the provider obscures or changes the URL of the resources to disable the clients from viewing the resource locations, then the security is improved, but the client needs mechanism to access the resources
Solution Approach 1:
The SSL VPN gateway acts as a mediator that handles the complexity of URL transformation. The gateway receives the original URL from the server, transforms it according to configured policies, and presents the transformed URL to the client. This intermediary approach shields both the client and the server from the complexity of direct URL management while enabling secure access.
Solution Approach 2:
The patent implements dynamic URL rewriting where the transformation of URLs is not static but adapts based on various factors such as user credentials, time of access, resource type, and security policies. The SSL VPN gateway dynamically determines the appropriate URL transformation for each request, providing flexibility in balancing security and accessibility based on real-time conditions.
3Object-affected harmful factors
If the provider wants to alter the URLs in ways which depend on the credibility of the client, the security concerns relating the client, or the type of the client, then the security is improved, but the system complexity increases
Solution Approach 1:
The patent uses parameter changes in the URL transformation process where different URL encoding schemes are applied based on client parameters such as credibility level, security clearance, or client type. The SSL VPN gateway evaluates client parameters and selects appropriate URL transformation rules, enabling fine-grained security control without requiring a completely separate system for each security level.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The present disclosure presents methods, systems and intermediaries which determine an encoding scheme of a uniform resource location (URL) from a plurality of encoding schemes for a clientless secure socket layer virtual private network (SSL VPN) via a proxy. An intermediary may receive a response from a server comprising a URL. The response from the server may be directed to a client via a SSL VPN session and via the intermediary. The intermediary may determine, responsive to an encoding policy, one of a transparent, opaque or encrypted encoding scheme for encoding the URL. The intermediary may rewrite the URL for transmission to the client in accordance with the determined encoding scheme.