Methods and systems for providing trusted signaling of domain-specific security policies
View Patent ↗Methods and systems for providing trusted signaling of domain-specific security policies. One method includes intercepting a connection request to a remote server from a client device on a domain and returning a security certificate with policy information for regulating the communications with the target server.
1. A method of regulating the use of a network-based on-line presentation application, comprising:
storing domain specific administrator policies in a security gateway located in a local domain, wherein the domain specific administrator policies define rights and capabilities of client on-line presentation software when the client on-line presentation software is downloaded from a remote application server computer located outside the local domain and executed on any of a plurality of client computers located in the local domain;
intercepting, by the security gateway, a secure connection request transmitted from a copy of the client on-line presentation software executing on a local client computer to the remote server computer, wherein the local client computer is one of the plurality of client computers located in the local domain, the client on-line presentation software executing on the local client computer providing an online presentation to a user of the local client computer, and wherein the client on-line presentation software executing on the local client computer was downloaded from the remote application server computer onto the local client computer;
generating, by the security gateway, a replacement certificate, at least in part by copying the domain specific administrator policies into application specific extensions of the replacement certificate; and
transmitting, by the security gateway to the local client computer, the replacement certificate, the domain specific administrator policies stored in the application specific extensions of the replacement certificate limiting actions performed by the client on-line presentation software executing on the local client computer in providing the on-line presentation to the user of the local client computer.
2. The method of claim 1 , further comprising:
wherein the limiting of the actions performed by the client on-line presentation software executing on the local client computer in providing the on-line presentation to the user of the local client computer includes interpreting, by a browser executing on the local client computer, the domain specific administrator policies stored in the application specific extensions of the replacement certificate.
3. The method of claim 1 , further comprising:
wherein the limiting of the actions performed by the client on-line presentation software executing on the local client computer in providing the on-line presentation to the user of the local client computer includes communicating, by the client on-line presentation software executing on the local client computer, the domain specific administrator policies stored in the application specific extensions of the replacement certificate to application security layer software of the local client computer and interpreting, by the application security layer software, the domain specific administrator policies.
4. The method of claim 3 , wherein the application security layer software, in response to interpreting the domain specific administrator policies, enforces the domain specific administrator policies while the client on-line presentation software provides the on-line presentation to the user of the local client computer.
5. The method of claim 4 , wherein the domain specific administrator policies include a policy prohibiting the on-line presentation software from transmitting files outside the local domain; and
wherein the application security layer enforces the domain specific administrator policies by preventing the on-line presentation software from transmitting at least one file to a destination outside the local domain.
6. The method of claim 1 , further comprising:
wherein the storing of the domain specific administrator policies in the security gateway includes storing the domain specific administrator policies in a replacement certificate profile stored in the security gateway;
modifying, by local information technology (IT) staff, the domain specific administrator policies stored in the security gateway by modifying the domain specific administrator policies stored in the replacement certificate profile; and
wherein the generating of the replacement certificate by the security gateway includes copying the modified domain specific administrator policies from the replacement certificate profile into the application specific extensions of the replacement certificate.
7. The method of claim 1 , further comprising:
digitally signing, by a local certificate authority controlled by an enterprise that also controls the local domain, the replacement certificate, including creating a digital signature of the local certificate authority;
wherein transmitting the replacement certificate to the local client computer includes transmitting the digital signature of the local certificate authority to the local client computer for validating, by the client on-line presentation software executing on the local client computer, based on the digital signature of the local certificate authority, the domain specific administrator policies stored in the application specific extensions of the replacement certificate, prior to limiting the actions performed by the client on-line presentation software executing on the local client computer.
8. The method of claim 7 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from
presenting a virtual desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain,
giving remote control of the virtual desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain,
executing at least one multimedia platform on any of the plurality of client computers located in the local domain,
presenting at least one streaming video website on any of the plurality of client computers located in the local domain, and
presenting at least one streaming audio website on any of the plurality of client computers located in the local domain; and
wherein limiting the actions performed by the client on-line presentation software executing on the local client computer includes preventing the client on-line presentation software executing on the local client computer from
presenting a virtual desktop of the local client computer to any computer located outside of the local domain,
giving remote control of the virtual desktop of the local client computer to any computer located outside of the local domain,
executing the at least one multimedia platform on the local client computer,
presenting the at least one streaming video website on the local client computer to the user of the local client computer, and
presenting the at least one streaming audio website on the local client computer to the user of the local client computer.
9. The method of claim 1 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from presenting a virtual desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain; and
wherein limiting the actions performed by the client on-line presentation software executing on the local client computer includes preventing the client on-line presentation software executing on the local client computer from presenting a virtual desktop of the local client computer to any computer located outside of the local domain.
10. The method of claim 1 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from giving remote control of a virtual desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain; and
wherein limiting the actions performed by the client on-line presentation software executing on the local client computer includes preventing the client on-line presentation software executing on the local client computer from giving remote control of a virtual desktop of the local client computer to any computer located outside of the local domain.
11. The method of claim 1 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from executing at least one multimedia platform on any of the plurality of client computers located in the local domain; and
wherein limiting the actions performed by the client on-line presentation software executing on the local client computer includes preventing the client on-line presentation software executing on the local client computer from executing the at least one multimedia platform on the local client computer.
12. The method of claim 1 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from presenting at least one streaming video website on any of the plurality of client computers located in the local domain; and
wherein limiting the actions performed by the client on-line presentation software executing on the local client computer includes preventing the client on-line presentation software executing on the local client computer from presenting the streaming video website on the local client computer to the user of the local client computer.
13. The method of claim 1 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from presenting at least one streaming audio website on any of the plurality of client computers located in the local domain; and
wherein limiting the actions performed by the client on-line presentation software executing on the local client computer includes preventing the client on-line presentation software executing on the local client computer from presenting the streaming audio website on the local client computer to the user of the local client computer.
14. A security gateway, located in a local domain, for regulating the use of a network-based on-line presentation application, comprising:
at least one processor;
a memory storing
i) domain specific administrator policies that define rights and capabilities of client on-line presentation software when the client on-line presentation software is downloaded from a remote application server computer located outside the local domain and executed on any of a plurality of client computers located in the local domain, and
ii) program code, which, when executed on the processor, causes the security gateway to
intercept a secure connection request transmitted from a copy of the client on-line presentation software executing on a local client computer to the remote server computer, wherein the local client computer is one of the plurality of client computers located in the local domain, the client on-line presentation software executing on the local client computer providing an online presentation to a user of the local client computer, and wherein the client on-line presentation software executing on the local client computer was downloaded from the remote application server computer onto the local client computer;
generate a replacement certificate, at least in part by copying the domain specific administrator policies into application specific extensions of the replacement certificate; and
transmit, to the local client computer, the replacement certificate, wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit actions performed by the client on-line presentation software executing on the local client computer in providing an on-line presentation to a user of the local client computer.
15. The security gateway of claim 14 , further comprising:
wherein the domain specific administrator policies in the memory are stored in a replacement certificate profile; and
wherein the program code, when executed on the processor, further causes the security gateway to:
modify, in response to local information technology (IT) staff, the domain specific administrator policies stored in the replacement certificate profile, and
generate the replacement certificate at least in part by copying the modified domain specific administrator policies from the replacement certificate profile into the application specific extensions of the replacement certificate.
16. The security gateway of claim 14 , wherein the program code, when executed on the processor, further causes the security gateway to:
digitally sign the replacement certificate by including a digital signature with the replacement certificate when transmitting the replacement certificate to the to the local client computer so that the client on-line presentation software executing on the local client computer validates the domain specific administrator policies stored in the application specific extensions of the replacement certificate based on the digital signature, prior to limiting the actions performed by the client on-line presentation software executing on the local client computer based on the domain specific administrator policies.
17. The security gateway of claim 16 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from
presenting a virtual desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain,
giving remote control of the virtual desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain,
executing at least one multimedia platform on any of the plurality of client computers located in the local domain,
presenting at least one streaming video website on any of the plurality of client computers located in the local domain, and
presenting at least one streaming audio website on any of the plurality of client computers located in the local domain; and
wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit the actions performed by the client on-line presentation software executing on the local client computer by preventing the client on-line presentation software executing on the local client computer from
presenting a virtual desktop of the local client computer to any computer located outside of the local domain,
giving remote control of the virtual desktop of the local client computer to any computer located outside of the local domain,
executing the at least one multimedia platform on the local client computer,
presenting the at least one streaming video website on the local client computer to the user of the local client computer, and
presenting the at least one streaming audio website on the local client computer to the user of the local client computer.
18. The security gateway of claim 14 , further comprising:
wherein the domain specific administrator policies stored in the memory prohibit the client on-line presentation software from presenting a desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain, and
wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit the actions performed by the client on-line presentation software executing on the local client computer by preventing the client on-line presentation software from presenting a virtual desktop of the local client computer to any computer located outside of the local domain.
19. The security gateway of claim 14 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from giving remote control of a desktop of any of the plurality of client computers located in the local domain to any computer located outside of the local domain; and
wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit the actions performed by the client on-line presentation software executing on the local client computer by preventing the client on-line presentation software executing on the local client computer from giving remote control of a virtual desktop of the local client computer to any computer located outside of the local domain.
20. The security gateway of claim 14 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from executing at least one multimedia platform on any of the plurality of client computers located in the local domain; and
wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit the actions performed by the client on-line presentation software executing on the local client computer by preventing the client on-line presentation software executing on the local client computer from executing the at least one multimedia platform on the local client computer.
21. The security gateway of claim 14 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from presenting at least one streaming video website on any of the plurality of client computers located in the local domain; and
wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit the actions performed by the client on-line presentation software executing on the local client computer by preventing the client on-line presentation software from presenting the streaming video website on the local client computer to the user of the local client computer.
22. The security gateway of claim 14 , further comprising:
wherein the domain specific administrator policies prohibit the client on-line presentation software from presenting at least one streaming audio website on any of the plurality of client computers located in the local domain; and
wherein the domain specific administrator policies stored in the application specific extensions of the replacement certificate limit the actions performed by the client on-line presentation software executing on the local client computer by preventing the client on-line presentation software from presenting the streaming audio website on the local client computer to the user of the local client computer.