SSL VPN Gateway Script Rewriting for Later Binding Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SSL VPN gateways block direct access to back-end servers, preventing the resolution of later binding URL-based link entities in XSLT scripts, which requires client-side software installation for link rewriting, inconvenient for users.
Innovation Solution
A network device processes XSLT scripts and XML data to rewrite later binding URL-based link entities with substitute links that refer to the network device, allowing the gateway to forward requests to the back-end server, eliminating the need for client-side software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SSL VPN gateway blocks direct access to back-end servers to ensure security, then security is improved, but the resolution of later binding URL-based link entities in XSLT scripts fails, requiring client-side software installation
Solution Approach 1:
The gateway performs preliminary rewriting of XSLT scripts before transmission to the client. It identifies and modifies later binding URL-based link entities in advance, replacing them with gateway-resolvable links. This preliminary action eliminates the need for client-side software while maintaining security through the gateway's mediation of all backend server access.
Solution Approach 2:
The gateway acts as an intermediary between the client and back-end servers. It receives XSLT scripts from the backend, rewrites the URL-based link entities to point through the gateway, and transmits the modified scripts to the client. This intermediary role allows the gateway to maintain security control while enabling script functionality without requiring client-side software modifications.
2Reliability
If client-side software is installed to rewrite URL-based links, then link resolution is improved, but device complexity increases
Solution Approach 1:
The patent extracts the link rewriting functionality from the client side and relocates it to the gateway server side. The gateway performs the identification and rewriting of later binding URL-based link entities in the XSLT scripts before transmission. This extraction eliminates the need for complex client-side software while maintaining reliable link resolution through server-side processing.
3Adaptability or versatility
If the gateway transmits original XSLT scripts with later binding links, then script functionality is preserved, but direct server access is required which compromises security
Solution Approach 1:
The gateway performs preliminary modification of XSLT scripts by identifying later binding URL-based link entities and rewriting them with gateway-resolvable links before transmission to the client. This preliminary action preserves script functionality while ensuring all server access routes through the secure gateway, maintaining security without sacrificing adaptability.
Data Source
AI summary
A network device implements an SSL VPN gateway for client devices. The network device may receive a script destined for a client device. The script may include at least one later binding uniform resource locator (URL)-based link entity. The network device may rewrite the script to include additional script associated with the later binding URL-based link entity. The additional script is configured to execute at the client device to rewrite the later binding URL-based link entity with substitute links that refer to the network device. In this manner, the network device allows the external client devices to access back-end servers in a proprietary network without requiring the installation of custom software on the client devices.