Clientless VPN Domain Segmentation via SNI Rewriting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional clientless VPN solutions expose security vulnerabilities due to URI rewriting, allowing attackers to bypass browser security checks by sharing a common domain, which can lead to unauthorized code execution across supported websites.
Innovation Solution
An advanced clientless VPN system translates requests to generate distinct domains for each application, using hashing techniques and wildcard DNS mapping to prevent shared domain exposure, thereby enhancing security and reducing storage requirements by forwarding cookies to client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional URI rewriting is used to enable clientless VPN access, then application accessibility is improved, but security vulnerabilities increase due to shared domain exposure
Solution Approach 1:
The patent segments the domain identification by using distinct SNI values for each application instead of sharing a common domain. Each application receives traffic on its own unique SNI, eliminating the security vulnerability of shared domain exposure while maintaining accessibility. The firewall appliance acts as an intermediary that segments and routes traffic based on SNI rather than domain name.
Solution Approach 2:
The patent introduces an intermediary mechanism (the firewall appliance with SNI rewriting capability) that mediates between the client and applications. The appliance rewrites SNI values in TLS handshake messages, allowing clients to connect using application-specific SNI values while the appliance translates these to appropriate internal routing, thus eliminating the need for shared domain exposure.
2Object-affected harmful factors
If distinct domains are generated for each application using hashing techniques, then security is improved by preventing domain sharing, but device complexity increases
Solution Approach 1:
The patent changes the parameter used for domain distinction from full domain names to SNI values in TLS handshake messages. This parameter change simplifies the system because SNI values are already standardized in the TLS protocol, requiring minimal additional complexity compared to implementing full domain generation and management systems.
3Quantity of substance
If cookies are forwarded to client devices for local storage, then storage requirements at the firewall are reduced, but cookie management complexity increases
Solution Approach 1:
The patent extracts cookie storage from the firewall appliance and places it locally on client devices. By taking out the storage function from the central appliance and distributing it to clients, the overall system storage requirements at the firewall are reduced, and cookie management becomes a standard client-side function rather than a complex server-side management task.
Data Source
AI summary
Content obtained from a remote server by a clientless VPN is received in response to a request made by a client browser executing on a client device. The content includes a script and is received at the client device. A determination is made by the client device that the obtained content includes a script that invokes a native accessor function call. Functionality provided by the script is preserved, at least in part, by the client device executing a modified accessor function call.