Method and apparatus for resource locator identifier rewrite
A method and apparatus for resource locator identifier rewrite have been presented. A security device receives from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session. The response includes a uniform resource locator (URL) that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol. The URL is located in the response and modified to designate the secure resource access protocol. After modification, the response is transmitted via the secure resource access protocol session to the client.
1. A system for rewriting resource locator identifiers, the system comprising:
a host computer; and
one or more computers communicatively coupled with the host computer, the one or more computers including a firewall, wherein at least one of the firewall or a proxy:
receives a secure message from a client device over a secure access protocol session, the secure message including encrypted information,
decrypts the encrypted information in the secure message for inclusion in a decrypted request message,
sends the decrypted request message to the host computer via a non-secure communication session,
receives a response message to the decrypted request message from the host computer via the non-secure communication session,
identifies that the response message includes a field value that indicates that the response message is a redirect response message,
composes a message that includes a generated resource locator identifier (RLI) for transmission to the client device via the secure access protocol session, the generated RLI associated with a secure protocol based on the field value in the response message indicating that the response message is the redirect response message, and the RLI identifying that a resource associated with the RLI is to be accessed according to the secure protocol, and
transmits the composed message over the secure access communication session to the client device.
2. The system of claim 1 , wherein one of the firewall or the proxy receives the secure message from the client device, and wherein the other of the firewall or the proxy transmits the decrypted message to the host computer.
3. The system of claim 1 , wherein the decrypted information in the secure message is analyzed for malignant elements prior to transmitting the request message to the host computer.
4. The system of claim 1 , wherein composing the message includes encrypting information included in the response message.
5. A method for rewriting resource locator identifiers, the method comprising:
receiving a secure message from a client device over a secure access protocol session at a firewall, the message including encrypted information;
decrypting the encrypted information in the secure message for inclusion in a decrypted request message;
sending the decrypted request message to a host computer via a non-secure access communication session;
receiving a response message to the decrypted request message from the host computer via the non-secure communication session;
identifying that the response message includes a field value that indicates that the response message is a redirect response message;
composing a message that includes a generated resource locator identifier (RLI) for transmission to the client device via the secure access protocol session, wherein the generated RLI is associated with a secure protocol based on the field value in the response message indicating that the response message is the redirect response message, and the RLI identifies that a resource associated with the RLI is to be accessed according to the secure protocol; and
transmitting the composed message over the non-secure access communication session to the client device.
6. The method of claim 5 , wherein the secure message is received from the client device over a first network interface and the decrypted message is transmitted to the host computer over a second network interface.
7. The method of claim 5 , further comprising forwarding the secure message from the firewall to a proxy for decryption of the encrypted information, generation of the RLI, and transmission of the composed message over the non-secure access communication session to the client device.
8. The method of claim 5 , further comprising analyzing the decrypted information in the secure message for malignant elements prior to transmitting the request message to the host computer.
9. The method of claim 5 , wherein composing the message includes encrypting information included in the response message.
10. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor performing a method for rewriting resource locator identifiers, the method comprising a computing device:
receiving a secure message from a client device over a secure access protocol session at a firewall, the message including encrypted information;
decrypting the encrypted information in the secure message for inclusion in a decrypted request message;
sending the decrypted request message to a host computer via a non-secure access communication session;
receiving a response message to the decrypted request message from the host computer via the non-secure communication session;
identifying that the response message includes a field value that indicates that the response message is a redirect response message;
composing a message that includes a generated resource locator identifier (RLI) for transmission to the client device via the secure access protocol session, wherein the generated RLI is associated with a secure protocol based on the field value in the response message indicating that the response message is the redirect response message, and the RLI identifies that a resource associated with the RLI should be accessed according to the secure protocol; and
transmitting the composed message over the non-secure access communication session to the client device.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the secure message is received from the client device over a first network interface and the composed message is transmitted to the host computer over a second network interface.
12. The non-transitory computer-readable storage medium of claim 10 , wherein the program further comprises instructions executable to forward the secure message from the firewall to a proxy for decryption of the encrypted information, generation of the RLI, and transmission of the composed message over the non-secure access communication session to the client device.
13. The non-transitory computer-readable storage medium of claim 10 , wherein the program further comprises instructions executable to analyze the decrypted information in the secure message for malignant elements prior to transmitting the request message to the host computer.
14. The non-transitory computer-readable storage medium of claim 10 , wherein composing the message for transmission via the secure access protocol session includes encrypting information included in the response message.
15. The system of claim 1 , further comprising a first port that receives the secure message and a second port over which the decrypted request message is sent.
16. The system of claim 1 , further comprising one or more servers that are communicatively coupled to the at least one of the firewall or the proxy.
17. The system of claim 1 , wherein the secure message is received according to the hypertext transfer secure protocol (HTTPS).
18. The system of claim 1 , wherein persistent connection is supported.
19. The system of claim 1 , wherein persistent connection is not supported, and wherein at least one of the firewall or the proxy ensures that the request message does not indicate that persistent connection is supported.
20. The system of claim 1 , wherein at least one of the firewall or the proxy modifies a header of the composed message.
21. The system of claim 20 , wherein a content length field value within the header is modified.