Policy-based cross-domain access control for SSL VPN
View Patent ↗A method may include generating a request that includes a host domain associated with a multiple-domain-to-one domain mapping, capturing the request before transmission of the request, rewriting the host domain, and transmitting the request.
1. A system comprising: one or more devices, each of the one or more devices comprising a processor and memory, that:
receive, from a client device and via a sockets layer virtual private network (SSL VPN) connection associated with a firewall device, a rewritten hypertext transfer protocol (HTTP) request to access, via a device associated with a uniform resource identifier (URI) and a reference domain associated with the SSL VPN connection, information associated with a host domain, the rewritten HTTP request including an identifier associated with the client device,
determine, based on the reference domain and the host domain, whether the rewritten HTTP request is associated with a cross-domain request in which the reference domain and the host domain differ,
allow the rewritten HTTP request when the rewritten HTTP request is not associated with the cross-domain request, the request, and
determine, when the rewritten HTTP request is associated with the cross-domain request, whether to allow the rewritten HTTP request,
the one or more devices, when determining whether to allow the rewritten HTTP request associated with the cross-domain request, are further to:
identify, based on the identifier, an access control policy, of a plurality of access control policies, associated with the client device,
determine whether the host domain complies with the identified access control policy,
identify, based on the URI, a device domain associated with the device, determine whether the device domain complies with the identified access control policy, and
permit, when the host domain and the device domain comply with the identified access control policy, the client device to access the information,
the one or more devices including a gateway device.
2. The system of claim 1 , where the rewritten HTTP request includes information identifying a default host domain that differs from the host domain, and
where the one or more devices are further to:
identify, based on the identifier and the default host domain, the host domain.
3. The system of claim 1 , where the identified access control policy includes:
a first access control policy, and
a second access control policy that differs from the first access control policy, and where the one or more devices, when determining whether to allow the rewritten HTTP request associated with the cross-domain request, are further to:
permit the client device to access the information in response to:
determining that the host domain complies with the first access control policy, and
determining that the device domain complies with the second access control policy.
4. The system of claim 1 , where the rewritten HTTP request is generated by FLASH executable code, operating on the client device.
5. A method comprising:
receiving, by a network device and via a sockets layer virtual private network (SSL VPN) connection associated with a firewall device, a rewritten hypertext transfer protocol (HTTP) request from a client device to access, via a device associated with a uniform resource identifier (URI) and a reference domain associated with the SSL VPN connection, information associated with a host domain, the rewritten HTTP request including an identifier associated with the client device, and the network device including a gateway device;
determining, by the network device, whether the reference domain and the host domain differ;
determining, by the network device, to allow the rewritten HTTP request when reference domain and the host domain do not differ;
when the reference domain and the host domain differ, determining, by the network device, whether to allow the rewritten HTTP request,
where the determining of whether to allow the rewritten HTTP request, when the reference domain and the host domain differ, including:
accessing, from a plurality of access control policies and based on the identifier, an access control policy associated with the client device,
determining whether the host domain complies with the access control policy, identifying, based on the URI, a device domain associated with the device,
determining whether the device domain complies with the identified access control policy, and
determining to allow the rewritten HTTP request, when the reference domain and the host domain differ, in response to determining that the host domain and the device domain comply with the access control policy; and
enabling, by the network device and in response to determining to allow the rewritten HTTP request, the client device to access the information through the host domain.
6. The method of claim 5 , where the rewritten HTTP request includes information identifying a default host domain that differs from the host domain, and
where method further includes:
identifying, based on the identifier and the default host domain, the host domain.
7. The method of claim 5 , where the identified access control policy includes a first access control policy, and a second access control policy that differs from the first access control policy, and
where determining, when the reference domain and the host domain differ, whether to allow the rewritten HTTP request further includes:
determining whether the host domain complies with the first access control policy,
determining whether the device domain complies with the second access control policy, and
determining to allow the rewritten HTTP request when the host domain complies with the first access control policy and the device domain complies with the second access control policy.
8. The method of claim 5 , where the rewritten HTTP request is generated by FLASH executable code, operating on the client device.
9. A non-transitory memory device comprising:
one or more instructions which, when executed by a processor included in a gateway device, cause the processor to receive, via a secure connection that includes a sockets layer virtual private network (SSL VPN) connection associated with a firewall device, a request from a client device to access information, associated with a host domain, via a device associated with a uniform resource identifier (URI) and a reference domain associated with the secure connection, the rewritten HTTP request including an identifier associated with the client device and information identifying a default host domain that differs from the host domain;
one or more instructions which, when executed by the processor, cause the processor to identify, based on the identifier and the default host domain, the host domain;
one or more instructions which, when executed by the processor, cause the processor to determine, whether the reference domain and the host domain differ;
one or more instructions which, when executed by the processor, cause the processor to enable the client device to access the information when the reference domain and the host domain do not differ;
one or more instructions which, when executed by the processor, cause the processor to determine, when the reference domain and the host domain differ, whether to enable the client device to access the information,
the one or more instructions to determine, when the reference domain and the host domain differ, whether to enable the client device to access the information including:
one or more instructions which, when executed by the processor, cause the processor to access, from a plurality of access control policies and based on the identifier, an access control policy associated with the client device,
one or more instructions to identify, based on the URI, a device domain associated with the device,
one or more instructions to determine whether the device domain complies with the identified access control policy,
one or more instructions which, when executed by the processor, cause the processor to determine whether the host domain complies with the access control policy, and
one or more instructions which, when executed by the processor, cause the processor to allow the rewritten HTTP request, when reference domain and the host domain differ, in response to determining that each of the device domain and the host domain complies with the access control policy.
10. The non-transitory memory device of claim 9 , where the identified access control policy includes a first access control policy, and a second access control policy that differs from the first access control policy, and
where the one or more instructions to determine, when the reference domain and the host domain differ, whether to enable the client device to access the information further include:
one or more instructions to determine whether the host domain complies with the first access control policy,
one or more instructions to determine whether the device domain complies with the second access control policy, and
one or more instructions to enable the client device, when the reference domain and the host domain differ, to access the information when the host domain complies with the first access control policy and the device domain complies with the second access control policy.
11. The non-transitory memory device of claim 9 , where the rewritten HTTP request is generated by FLASH executable code, operating on the client device.