IP Library › Granted Patent US 11,792,232
Granted Patent B2
US 11,792,232 · App. 17/713,678 · Granted Oct 17, 2023

Applying application layer policy to transport layer security requests systems and methods

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,792,232
App. No.
17/713,678
Filed
Apr 5, 2022
Granted
Oct 17, 2023
Kind
B2
Art Unit
2437
USPC
726/1
Abstract

Systems and methods for applying an application layer policy to a transport layer security request are provided. A device, intermediary to one or more clients and one or more servers, can receive a transport layer security (TLS) request to establish a TLS connection between a client of the one or more clients and a server of the one or more servers. The TLS request can include an application layer request to a resource of the server. The device can apply an application layer policy to the application layer request of the TLS request. The device can determine, responsive to applying the application layer policy, whether to one of accept or reject at least the application layer request of the TLS request.

Claims (31)

1. A method comprising

receiving, by a device, a request to establish a transport layer security (TLS) connection between a client and a server, the request identifying an application layer request to access a resource of the server identified by a uniform resource identifier (URI);

determining, by the device prior to establishing the TLS connection to forward the application layer request to the server, that the URI of the application layer request fails to match a pattern of a plurality of patterns identified as replay-safe based on a policy of an application layer; and

rejecting, by the device responsive to the determination, at least the application layer request.

2. The method of claim 1 , wherein the device is intermediary to the client and the server.

3. The method of claim 1 , further comprising rejecting, by the device, the request.

4. The method of claim 1 , further comprising accepting, by the device the request and establishing the TLS connection.

5. The method of claim 1 , further comprising decrypting, by the device, the request using a key included with the request to identify the URI.

6. The method of claim 1 , further comprising identifying, by the device, the pattern based at least on the request.

7. The method of claim 1 , further comprising determining, by the device, that the URI of the application layer request fails to match the pattern during a handshake to establish the TLS connection.

8. A method comprising:

receiving, by a device, request to establish a transport layer security (TLS) connection between a client and a server, the request identifying an application layer request to access a resource of the server identified by a uniform resource identifier (URI);

determining, by the device prior to establishing the TLS connection to forward the application layer request to the server, that a portion of a URI of the application layer request matches a pattern of a plurality of patterns identified that are replay-safe based on a policy of an application layer; and

accepting, by the device responsive to the determination, the application layer request.

9. The method of claim 8 , wherein the device is intermediary to the client and the server.

10. The method of claim 8 , further comprising accepting, by the device the request and establishing the TLS connection.

11. The method of claim 8 , further comprising decrypting, by the device, the request using a key included with the request to identify the URI.

12. The method of claim 8 , further comprising identifying, by the device, the pattern based at least on the request.

13. The method of claim 8 , further comprising determining, by the device, that the URI of the application layer request matches the pattern during a handshake to establish the TLS connection.

14. A system comprising:

a device intermediary to a client and a server, the device configured to:

receive a request to establish a transport layer security (TLS) connection between the client and the server, the request identifying an application layer request to access a resource of the server identified by a uniform resource identifier (URI);

determine, prior to establishing the TLS connection to forward the application layer request to the server, whether a portion of a URI of the application layer request matches a pattern for one or more URIs that are replay-safe based on a policy of an application layer; and

one of accepting or rejecting the application layer request responsive to the determination.

15. The system of claim 14 , wherein the device is further configured to: determine that the portion of the URI of the application layer request matches the pattern for one or more URIs that are replay-safe; and

accept, responsive to the determination that the portion of the URI matches the pattern, the request.

16. The system of claim 15 , wherein the device is further configured to establish the TLS connection.

17. The system of claim 14 , wherein the device is further configured to determine that the portion of the URI of the application layer request fails to match the pattern for one or more URIs that are replay-safe.

18. The system of claim 17 , wherein the device is further configured to reject the request and establish the TLS connection.

19. The system of claim 14 , wherein the device is further configured to decrypt the request using a key included with the request to identify the URI.

20. The system of claim 14 , wherein the device is further configured to determine whether the URI of the application layer request matches the pattern during a handshake to establish the TLS connection.