Methods, apparatuses and systems for transparently intermediating network traffic over connection-based authentication protocols
View Patent ↗Methods, apparatuses and systems allowing for the transparent intermediation of network traffic over connection-based authentication protocols. In one embodiment, the present invention allows a proxy to be placed into an NTLM or HTLMv2 environment and have it transparently ensure that NTLM transactions are handled appropriately, such that the proxy can interact (optimize/accelerate) with the authenticated content without breaking the authentication scheme. Embodiments of the present invention provide a proxy solution that is easily deployed and transparently fits into an existing NTLM environment.
1. A method allowing for transparent intermediation of data flows over connection-based authentication schemes, comprising
maintaining, at a proxy server, at least one non-exclusive persistent connection to at least one origin server;
establishing, at the proxy server, client connections with respective client devices responsive to receipt of corresponding client requests, wherein the client requests designate respective origin servers;
if the client request includes an element associated with a connection-based authentication handshake for a transaction between the client and the origin server;
for each received client request that includes an element associated with a connection-based authentication handshake for a transaction between the client and the origin server, establishing an exclusive server connection between the proxy server and the origin server, wherein the exclusive server connection is exclusively for the transaction, associated with the connection-based authentication handshake, between the client and the origin server, and is not used for any other transactions, and forwarding the client requests request to the origin server over the respective exclusive server connections;
else, multiplexing received client requests to the origin server over a selected one of the at least one non-exclusive persistent connection to the origin server, if the client requests do not include an authentication element.
2. The method of claim 1 wherein the at least one non-exclusive connection is a persistent HTTP connection.
3. The method of claim 1 wherein the exclusive server connection is a persistent connection.
4. The method of claim 1 wherein the exclusive server connection is a persistent HTTP connection.
5. The method of claim 1 further comprising closing the exclusive server connection when the client connection is closed.
6. The method of claim 1 wherein the connection-based authentication scheme is NTLM.
7. The method of claim 6 wherein the element comprises an element associated with an NTLM authentication handshake.
8. The method of claim 7 wherein the element comprises an NTLM header.
9. The method of claim 8 wherein the NTLM header comprises a NLTM authorization message.
10. The method of claim 1 further comprising
forwarding subsequent client requests received over the client connection to the origin server over the exclusive server connection.
11. The method of claim 5 further comprising
forwarding subsequent client requests received over the client connection to the origin server over the exclusive server connection.
12. The method of claim 1 further comprising
receiving a response to the client request from the origin server over the exclusive server connection; and
forwarding the response to the client over the client connection.
13. The method of claim 12 further comprising
detecting at least one attribute associated with the client device;
optimizing the response receive from the origin server based on the at least one attribute.