Clientless VPN Domain Segmentation and Cookie Offloading

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional clientless VPN solutions expose security vulnerabilities due to URI rewriting, allowing attackers to bypass browser security checks by sharing a common domain, which can lead to unauthorized code execution across supported websites.

Innovation Solution

An advanced clientless VPN system translates requests to generate distinct domains for each application, using hashing techniques and wildcard DNS mapping to prevent shared domain exposure, thereby enhancing security and reducing storage requirements by forwarding cookies to client devices rather than storing them on the VPN server.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If traditional URI rewriting is used to enable clientless VPN access, then access to multiple websites is enabled, but security vulnerabilities arise allowing attackers to bypass browser security checks

Engineering Contradiction:

Improveaccess to multiple websitesVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the shared domain space by assigning unique identifiers to each application, creating distinct logical domains (e.g., app1.example.com, app2.example.com) while maintaining a single physical server. This segmentation prevents cross-application security breaches while preserving access to multiple websites.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism (unique identifier system with wildcard DNS) that mediates between the need for shared server resources and security requirements. The intermediary layer translates between external application domains and internal server routing without exposing the underlying shared infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If cookies are stored on the VPN server to maintain session state, then session management is simplified, but storage and computational overhead increase

Engineering Contradiction:

Improvesession managementVSAvoidstorage overhead

Core Design Contradiction:

Ease of operationVSQuantity of substance

Solution Approach 1:

The patent extracts the session state management function from the server-side storage and relocates it to client-side cookies. By storing session identifiers in client cookies and using them for authentication, the system eliminates the need for server-side session storage while maintaining simplified session management through cookie-based state.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent implements self-service session management where client devices autonomously store and manage their own session identifiers in cookies. The server only needs to validate these cookies without maintaining session state, allowing clients to self-manage their session information while reducing server storage requirements.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11836213B2Encoding-free JavaScript stringify for clientless VPN

Publication Date: 2023.12.05 PALO ALTO NETWORKS INC

AI summary

A client device requests a web page via a clientless VPN. In response to the request, web page content comprising at least one script element is received at the clientless VPN. The clientless VPN inserts a wrapper function around at least a portion of the script element, forming modified web content. The client device is provided with the modified web content.