SSL VPN Host Header Rewriting for Cross-Domain Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL VPN architectures map all domains into one domain when a web page is loaded, potentially bypassing client-side cross-domain access control policies at the web browser.
Innovation Solution
A method and device that generate a request with a default host domain, capture the request, rewrite the host domain based on the request URI, and transmit the rewritten request to enforce cross-domain access control policies by determining the appropriate host domain associated with the request URI.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If all domains are mapped into one domain in SSL VPN architecture, then domain consolidation is achieved, but client-side cross-domain access control policies are bypassed
Solution Approach 1:
The patent applies preliminary action by pre-configuring multiple virtual host domains in the SSL VPN gateway before actual access requests occur. When a user requests access to a specific domain, the system has already prepared the corresponding virtual host domain configuration, enabling it to quickly rewrite the Host header without delay. This resolves the contradiction by maintaining both domain consolidation capability and access control policy enforcement through pre-established domain mappings.
Solution Approach 2:
The patent introduces an intermediary mechanism - the SSL VPN gateway acting as a mediator between the client and multiple backend domains. The gateway receives requests with default host domain, rewrites the Host header to the appropriate target domain, and forwards the request. This intermediary role allows the system to maintain a single entry point (improving versatility) while enforcing domain-specific access control policies (maintaining reliability) through the rewriting operation.
2Reliability
If cross-domain access control policies are enforced at web browser, then security is improved, but policies are bypassed when domains are mapped to SSL gateway domain
Solution Approach 1:
The patent applies self-service by enabling the SSL VPN gateway to automatically perform Host header rewriting based on pre-configured domain mappings. The system monitors incoming requests, identifies the target domain, and autonomously rewrites the Host header without requiring manual administrator intervention for each request. This automation maintains access control policy enforcement while reducing operational complexity compared to manually managed access lists.
Solution Approach 2:
The patent changes the Host header parameter dynamically based on the requested domain. Instead of requiring complex access list configurations, the system modifies the Host header parameter from the default value to the appropriate target domain value. This parameter change approach simplifies the architecture by replacing complex access control lists with straightforward header rewriting operations that inherently enforce domain-specific policies.
3Reliability
If administrator-managed access lists are used for access control, then security management is achieved, but administrative overhead increases
Solution Approach 1:
The patent replaces the mechanical system of administrator-managed access lists with an automated domain mapping and header rewriting mechanism. Instead of administrators manually creating and maintaining access control lists, the system automatically maps domains to virtual host configurations and performs real-time Host header rewriting. This substitution eliminates the need for ongoing administrative maintenance while maintaining security, as the rewriting rules are derived from pre-configured domain mappings rather than manual access list entries.
Data Source
AI summary
A method may include generating a request that includes a host domain associated with a multiple-domain-to-one domain mapping, capturing the request before transmission of the request, rewriting the host domain, and transmitting the request.