User device-based enterprise web filtering
Web-filtering operations may be implemented on the user device, rather than on a centralized proxy server, to improve reliability, performance, and/or security of the web-filtering operations. Some or all of the necessary functions related to web-filtering may be performed on the end user device to remove the complexity and security issues inherent with the current methodology. One technique for allowing operation of proxy servers on user devices is to install smart agents on the user device. The smart agents, under control of a management server, may configure the proxy server, issue trust certificates to applications on the device, and/or provide proxy access configuration (PAC) files to applications on the device.
1. A method, comprising:
receiving, by a proxy server executing on a user device, a secure communication from an application, the application executing on the user device also executing the proxy server;
decrypting, by the proxy server, the secure communication from the application using a first trust certificate associated with the proxy server and the application, the secure communication including a request for a network resource located at a network address;
comparing, by the proxy server, the network address to a list of network addresses to determine whether communication with a network server at the network address is permitted; and
when communication with the network server is permitted:
communicating securely, by the proxy server, with the network server at the network address to retrieve the network resource using a second trust certificate associated with the proxy server and the network server to obtain the network resource; and
communicating securely, by the proxy server, with the user device to forward the network resource using the first trust certificate associated with the proxy server and the application.
2. The method of claim 1 , further comprising:
installing, on the user device, a smart agent configured to manage secure communications on the user device by registering the user device with a management server; and
configuring, by the smart agent, the proxy server on the user device.
3. The method of claim 2 , further comprising installing, by the smart agent, the first trust certificate for communicating securely between the application and the proxy server.
4. The method of claim 3 , the step of installing the first trust certificate comprising installing the first trust certificate in an independent certificate store for the application, the application using the independent certificate store to communicate securely with the proxy server.
5. The method of claim 3 , the step of installing the first trust certificate comprising installing the first trust certificate in an operating system certificate store, the application using the operating system certificate store to communicate securely with the proxy server.
6. The method of claim 2 , further comprising:
updating, by the smart agent, the list of network addresses for applying web filtering to secure communications from the application, the updating based on information received from the management server; and
transmitting, by the smart agent, a log of secure communications from the application, the log being transmitted to the management server.
7. The method of claim 2 , the step of installing the smart agent comprising creating a local and unique Certificate Authority (CA) on the device, the Certificate Authority (CA) being automatically and transparently setup as trusted on the device without user interaction.
8. A computer program product, comprising:
a non-transitory computer readable medium comprising code to perform steps comprising:
receiving, by a proxy server executing on a user device, a secure communication from an application, the application executing on the user device also executing the proxy server;
decrypting, by the proxy server, the secure communication from the application using a first trust certificate associated with the proxy server and the application, the secure communication including a request for a network resource located at a network address;
comparing, by the proxy server, the network address to a list of network addresses to determine whether communication with a network server at the network address is permitted; and
when communication with the network server is permitted:
communicating securely, by the proxy server, with the network server at the network address to retrieve the network resource using a second trust certificate associated with the proxy server and the network server to obtain the network resource; and
communicating securely, by the proxy server, with the user device to forward the network resource using the first trust certificate associated with the proxy server and the application.
9. The computer program product of claim 8 , wherein the medium further comprises code to perform steps comprising:
installing, on the user device, a smart agent configured to manage secure communications on the user device by registering the user device with a management server; and
configuring, by the smart agent, the proxy server on the user device.
10. The computer program product of claim 9 , wherein the medium further comprises code to perform steps comprising installing, by the smart agent, the first trust certificate for communicating securely between the application and the proxy server.
11. The computer program product of claim 10 , the step of installing the first trust certificate comprising installing the first trust certificate in an independent certificate store for the application, the application using the independent certificate store to communicate securely with the proxy server.
12. The computer program product of claim 10 , the step of installing the first trust certificate comprising installing the first trust certificate in an operating system certificate store, the application using the operating system certificate store to communicate securely with the proxy server.
13. The computer program product of claim 9 , wherein the medium further comprises code to perform steps comprising:
updating, by the smart agent, the list of network addresses for applying web filtering to secure communications from the application, the updating based on information received from the management server; and
transmitting, by the smart agent, a log of secure communications from the application, the log being transmitted to the management server.
14. The computer program product of claim 9 , the step of installing the smart agent comprising creating a local and unique Certificate Authority (CA) on the device, the Certificate Authority (CA) being automatically and transparently setup as trusted on the device without user interaction.
15. An apparatus, comprising:
a memory; and
a processor coupled to the memory, wherein the processor is configured by code in the memory to execute a proxy server to perform steps comprising:
receiving a secure communication from an application, the application executing on the user device also executing the proxy server;
decrypting the secure communication from the application using a first trust certificate associated with the proxy server and the application, the secure communication including a request for a network resource located at a network address;
comparing the network address to a list of network addresses to determine whether communication with a network server at the network address is permitted; and
when communication with the network server is permitted:
communicating securely with the network server at the network address to retrieve the network resource using a second trust certificate associated with the proxy server and the network server to obtain the network resource; and
communicating securely with the user device to forward the network resource using the first trust certificate associated with the proxy server and the application.
16. The apparatus of claim 15 , wherein the processor is further configured to perform steps comprising:
installing, on the user device, a smart agent configured to manage secure communications on the user device by registering the user device with a management server; and
configuring, by the smart agent, the proxy server on the user device.
17. The apparatus of claim 16 , wherein the processor is further configured to perform steps comprising installing, by the smart agent, the first trust certificate for communicating securely between the application and the proxy server.
18. The apparatus of claim 17 , the step of installing the first trust certificate comprising installing the first trust certificate in an independent certificate store for the application, the application using the independent certificate store to communicate securely with the proxy server.
19. The apparatus of claim 17 , the step of installing the first trust certificate comprising installing the first trust certificate in an operating system certificate store, the application using the operating system certificate store to communicate securely with the proxy server.
20. The apparatus of claim 16 , wherein the processor is further configured to perform steps comprising:
updating, by the smart agent, the list of network addresses for applying web filtering to secure communications from the application, the updating based on information received from the management server; and
transmitting, by the smart agent, a log of secure communications from the application, the log being transmitted to the management server.