Clientless SSL VPN Gateway URL Rewriting for Dynamic Resource Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional approaches to clientless SSL VPN systems face challenges in accessing resources referenced by relative URLs, as they are dynamically generated and pose difficulties in identification and rewriting, unlike absolute URLs which are preset and fixed.

Innovation Solution

The system identifies absolute URLs in HTTP responses, rewrites them using unique string identifiers, and encodes hostnames, allowing relative URLs to be resolved through the intermediary device by appending the original relative URLs to the unique string identifier, ensuring proper server identification and resource access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If relative URLs are used to reference resources on web-based applications, then the resources can be accessed dynamically, but the intermediary device cannot identify and rewrite these URLs to direct requests to the proper server

Engineering Contradiction:

Improvedynamic resource accessVSAvoidURL identification difficulty

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces an intermediary device (SSL VPN gateway) that acts as a mediator between clients and servers. The gateway intercepts HTTP responses, identifies relative URLs, rewrites them into absolute URLs with the gateway's hostname, and forwards requests. This intermediary mechanism enables the gateway to control and redirect resource access while maintaining dynamic URL functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary action by preemptively rewriting relative URLs into absolute URLs with the gateway's hostname before the client makes requests. This advance transformation ensures that all subsequent requests pass through the gateway, which can then identify and redirect them to the proper backend servers using the stored URL mapping information.

Inventive Principle:

Principle #10Preliminary action

2Difficulty of detecting and measuring

If absolute URLs are used to reference resources, then the URLs are preset and fixed making them easier to identify, but they lack the dynamic generation capability of relative URLs

Engineering Contradiction:

ImproveURL identification easeVSAvoiddynamic URL generation

Core Design Contradiction:

Difficulty of detecting and measuringVSAdaptability or versatility

Solution Approach 1:

The patent creates a copy of the original relative URL and transforms it into an absolute URL format. The gateway maintains a mapping between the original relative URL and the rewritten absolute URL, allowing it to preserve the dynamic resource reference functionality while enabling identification and rewriting through the absolute URL structure.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system changes the parameters of the URL by transforming relative URLs into absolute URLs with the gateway's hostname. This parameter transformation (from relative to absolute) enables the gateway to identify and control requests while the stored mapping preserves the original dynamic resource reference intent.

Inventive Principle:

Principle #35Parameter changes

3Ease of operation

If the intermediary device rewrites all URLs to include its hostname, then it can control and redirect requests, but it may interfere with direct client-server communication and SSL certificate validation

Engineering Contradiction:

Improverequest control capabilityVSAvoidSSL certificate security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The gateway acts as a transparent intermediary that rewrites URLs to include its hostname, enabling request control. For SSL certificate validation, the system uses the gateway's hostname in the rewritten URLs and configures the gateway to present appropriate SSL certificates, maintaining security while enabling intermediary control.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary URL rewriting to include the gateway's hostname before SSL validation occurs. The gateway is pre-configured with SSL certificates corresponding to its hostname, ensuring that when clients connect through the gateway, the SSL validation succeeds with the rewritten URLs containing the gateway's hostname.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10484336B2Systems and methods for a unique mechanism of providing ‘clientless SSLVPN’ access to a variety of web-applications through a SSLVPN gateway

Publication Date: 2019.11.19 CITRIX SYSTEMS INC

AI summary

The present disclosure is directed towards systems and methods for rewriting a HTTP response transmitted via a clientless SSL VPN session. An intermediary device may identify, in a HTTP response transmitted via a clientless SSL VPN session, an absolute URL that includes a first hostname of the server. The device may provide a unique string corresponding to the first hostname of the server. The device may generate a URL segment by combining the unique string with a second hostname of the device. The device may rewrite the absolute URL by replacing the first hostname in the absolute URL with the generated URL segment. A domain name system (DNS) server for the client may be configured with a DNS entry comprising a wildcard combined with the second hostname, to cause the DNS server to resolve the rewritten absolute URL to an IP address of the device.