Clientless VPN Browser Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional clientless VPN solutions expose security vulnerabilities due to URI rewriting, allowing attackers to bypass browser security checks by sharing a common domain, which compromises the same-origin policy and enables malicious code execution across supported web sites.
Innovation Solution
An advanced clientless VPN system translates requests to generate distinct domains for each web site, using hashing and wildcard DNS mapping, and processes HTTP requests and responses to prevent shared domain exposure, thereby enhancing security and reducing storage requirements by forwarding cookies to client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If URI rewriting is used to enable clientless VPN access to multiple web sites, then accessibility to multiple applications is improved, but security is worsened due to shared domain exposure
Solution Approach 1:
The patent segments the shared domain space by creating distinct storage areas (localStorage and sessionStorage) for each rewritten URI. Instead of allowing all applications to share a common domain namespace, the system divides the storage space into isolated segments, each accessible only to its corresponding application. This is achieved by modifying the browser's storage functions to associate storage operations with specific rewritten URIs, thereby preventing cross-application access while maintaining the ability to access multiple web sites through the same VPN gateway.
2Ease of operation
If cookies are stored on the server to maintain session state, then session management is simplified, but storage requirements increase
Solution Approach 1:
The patent extracts the session state information from server-side storage and relocates it to client-side storage. Instead of maintaining all session data on the server, the system extracts essential session information and stores it in the client's browser using modified localStorage and sessionStorage functions. This extraction reduces server storage requirements while maintaining simplified session management, as the client now autonomously manages its own session state without requiring continuous server-side cookie storage.
3Adaptability or versatility
If traditional URI rewriting is used, then clientless VPN functionality is enabled, but browser security checks are bypassed
Solution Approach 1:
The patent introduces an intermediary layer between the browser's native storage functions and the actual storage operations. This intermediary consists of modified JavaScript functions (localStorage and sessionStorage) that act as a mediator, intercepting storage operations and redirecting them to application-specific storage areas based on the rewritten URI. This intermediary mechanism enables clientless VPN functionality by allowing transparent storage operations while simultaneously preventing security vulnerabilities by ensuring that each application can only access its designated storage space, thus maintaining browser security checks.
Data Source
AI summary
A native web storage function call is received at a client device. A modified browser storage function call is executed, to facilitate browser storage associated with a clientless VPN. The modified browser storage function call executes a call to the native browser storage function call to facilitate access to the browser storage.