Policy-based cross-domain access control for SSL VPN
View Patent ↗A method may include generating a request that includes a host domain associated with a multiple-domain-to-one domain mapping, capturing the request before transmission of the request, rewriting the host domain, and transmitting the request.
1. A method comprising:
establishing, by a client device, a secure sockets layer virtual private network (SSL VPN) connection to a device;
generating, by the client device, a hypertext transfer protocol (HTTP) request to connect to the device through the SSL VPN connection, where the HTTP request is associated with a multiple-domain-to-one domain mapping, and where the HTTP request includes a reference to a default host domain and a Uniform Resource Identifier (URI) related to the device for the SSL VPN connection;
capturing, by the client device and before transmission of the HTTP request, the HTTP request; identifying, by the client device, the reference to the default host domain; determining, by the client device, a host domain related to the URI;
rewriting, by the client device, the host domain, in the captured HTTP request, to form a rewritten HTTP request, where rewriting the captured HTTP request includes replacing, in captured HTTP request, the reference to the default host domain with a reference to the determined host domain related to the URI; and
transmitting, by the client device, the rewritten HTTP request to the device,
where the transmitted HTTP request is also received by a gateway device, and where the gateway device:
determines that the received HTTP request includes a cross-domain request based on the rewritten host domain and a reference domain, and
enforces cross-domain access control policies in response to determining that the received HTTP request includes the cross-domain request.
2. The method of claim 1 , where the gateway device, when enforcing the cross-domain access control policies, further:
evaluates the rewritten host domain based on the cross-domain access control policies; and
regulates access to the rewritten host domain based on evaluating the rewritten host domain.
3. The method of claim 1 , where transmitting the rewritten request includes: transmitting the rewritten HTTP request via a virtual private network gateway.
4. A device comprising:
a memory device to store instructions; and
a processor that executes the instructions to:
establish a secure sockets layer virtual private network (SSL VPN) connection to another device, where the device comprises a client device,
generate a hypertext transfer protocol (HTTP) request, to the other device, where the HTTP request is associated with a multiple-domain-to-one domain mapping, and where the HTTP request includes a reference to a default host domain, and a request Uniform Resource Identifier (URI), for the SSL VPN connection,
capture the HTTP request before transmitting the request to the other device,
identify, in the captured HTTP request, the reference to the host domain,
determine a host domain related to the request URI, where the default host domain differs from the determined host domain related to the request URI,
rewrite the captured HTTP request, where the processor, when rewriting the request, is further to replace the identified reference to the default host domain, in the captured request, with a reference to the determined host domain related to the request URI, and
transmit the rewritten request to the other device and to a gateway device, where the gateway device:
determines that the received HTTP request includes a cross-domain request based on the rewritten host domain and a reference domain, and
enforces cross-domain access control policies in response to determining that the received HTTP request includes the cross-domain request.
5. The device of claim 4 , where the processor further executes instructions to: provide a web browser to generate the request based on a user input.
6. The device of claim 4 , where the determined host domain corresponds to a domain associated with a particular device that provides a secure communication link to the request URI.
7. The device of claim 4 , where the request includes a reference domain related to an existing connection.
8. The device of claim 4 , where the other device includes an access control policy enforcement device.
9. A non-transient computer-readable memory device having stored thereon instructions, executable by a processor of a client device, the non-transient computer-readable memory device comprising:
an instruction to establish a secure sockets layer virtual private network (SSL VPN) connection to another device;
an instruction to generate a hypertext transfer protocol (HTTP) request to connect, via the SSL VPN, to the other device, where the HTTP request is associated with a multiple-domain-to-one domain mapping, and where the HTTP request includes a reference a default host domain, and a request Uniform Resource Identifier (URI) for the SSL VPN connection;
an instruction to identify, in the HTTP request, the reference to the default host domain;
an instruction to determine a host domain related to the request URI;
an instruction to rewrite the HTTP request, including replacing the reference to the default host domain with a reference to the determined host domain associated with the request URI; and
an instruction to transmit the rewritten HTTP request,
where the other device includes a gateway device, and
where the rewritten HTTP request enables the gateway device to:
determine that the rewritten HTTP request includes a cross-domain request based on the rewritten host domain and a reference domain, and
enforce cross-domain access control policies in response to determining that the rewritten HTTP request includes the cross-domain request.
10. The non-transient computer-readable memory device of claim 9 , where the default host domain corresponds to a domain associated with a network device to provide a secure communication link to a network device associated with the request URI.
11. A device comprising:
a secure connection unit, executing on a processor of the device, to establish a secure sockets layer virtual private network (SSL VPN) connection to another device, where the device includes a client device;
a generating unit, executing on a processor of the device, to generate a hypertext transfer protocol (HTTP) request, to the other device, where the HTTP request is associated with a multiple-domain-to-one domain mapping, and where the HTTP request includes a request Uniform Resource Identifier (URI), a reference to a reference domain associated with the SSL VPN connection, and a reference to a default host domain;
an identifying unit, executing on a processor of the device, to identify, in the HTTP request, the reference to the default host domain;
a determining unit, executing on a processor of the device, to determine a host domain based on the request URI;
a rewriting unit, executing on a processor of the device, rewrite the captured HTTP request, where the processor when rewriting the request, is further to replace the identified reference to the default host domain, in the captured request, with a reference to the determined host domain related to the request URI and
a transmitting unit, executing on a processor of the device, to
transmit, to the other device, the rewritten request, and
transmit the rewritten HTTP request to a gateway device, where the gateway device:
determines that the rewritten HTTP request includes a cross-domain request based on the rewritten host domain and a reference domain, and
enforces cross-domain access control policies in response to determining that the rewritten HTTP request includes the cross-domain request.
12. A system comprising:
a user terminal, where the user terminal includes:
a user interface to:
receive a user input for connecting to a device, and
a processor to:
establish a secure sockets layer virtual private network (SSL VPN) connection to the device,
generate, based on the user input, a hypertext transfer protocol (HTTP) request to the device, where the request is associated with a multiple-domain-to-one domain mapping associated with the SSL VPN connection, the request including a reference to a default host domain, and a Uniform Resource Identifier (URI) for the SSL VPN connection,
identify the reference to the default host domain in the request,
determine a host domain related to the URI,
rewrite the HTTP request, where the processor, when rewriting the HTTP request, is further to replace the reference to the default host domain with a reference to the determined host domain, and
transmit the rewritten request; and
a gateway device, where the gateway device includes a gateway processor to:
receive the transmitted HTTP request from the user terminal,
determine that the HTTP request includes a cross-domain request based on the reference domain and the determined host domain,
compare the determined host domain with a cross-domain access control policy in response to determining that the HTTP request includes the cross-domain request, and
regulate access to the device.
13. The system of claim 12 , where the gateway device includes a secure sockets layer virtual private network (SSL VPN) gateway.