User device-based enterprise web filtering
Web-filtering operations may be implemented on the user device, rather than on a centralized proxy server, to improve reliability, performance, and/or security of the web-filtering operations. Some or all of the necessary functions related to web-filtering may be performed on the end user device to remove the complexity and security issues inherent with the current methodology. One technique for allowing operation of proxy servers on user devices is to install smart agents on the user device. The smart agents, under control of a management server, may configure the proxy server, issue trust certificates to applications on the device, and/or provide proxy access configuration (PAC) files to applications on the device.
1. A method, comprising:
receiving, by a proxy server executing on a user device, a secure communication from an application, the application executing on the user device also executing the proxy server;
decrypting, by the proxy server, the secure communication from the application using a first trust certificate associated with the proxy server and the application, the secure communication including a request for a network resource located at a network server, the network server having a network address;
determining, by the proxy server, whether the request for the network resource is permitted; and
when the request for the network resource is permitted:
communicating securely, by the proxy server, with the network server at the network address to retrieve the network resource using a second trust certificate associated with the proxy server and the network server; and
communicating securely, by the proxy server, with the application to forward the network resource using the first trust certificate associated with the proxy server and the application.
2. The method of claim 1 , further comprising:
installing, on the user device, a smart agent configured to manage secure communications on the user device by registering the user device with a management server; and
configuring, by the smart agent, the proxy server on the user device.
3. The method of claim 2 , further comprising installing, by the smart agent, the first trust certificate associated with the application and the proxy server.
4. The method of claim 3 , wherein the step of installing the first trust certificate comprises at least one of: installing the first trust certificate in an independent certificate store for the application; or installing the first trust certificate in an operating system certificate store.
5. The method of claim 1 , wherein when the request for the network resource is not permitted:
dropping the request from the application for the network resource; and
transmitting, to the application, a message indicating the network resource is unavailable.
6. The method of claim 1 , wherein determining whether the request for the network resource is permitted comprises applying a web filtering policy to the request, the method further comprising receiving, from a management server, an update to the web filtering policy.
7. The method of claim 1 , wherein determining whether the request for the network resource is permitted comprises applying a web filtering policy to the request, the method further comprising transmitting, to a management server, a log of requests denied during the applying of the web filtering policy.
8. A computer program product, comprising:
a non-transitory computer readable medium comprising code to perform steps comprising:
receiving, by a proxy server executing on a user device, a secure communication from an application, the application executing on the user device also executing the proxy server;
decrypting, by the proxy server, the secure communication from the application using a first trust certificate associated with the proxy server and the application, the secure communication including a request for a network resource located at a network server, the network server having a network address;
determining, by the proxy server, whether the request for the network resource is permitted; and
when the request for the network resource is permitted:
communicating securely, by the proxy server, with the network server at the network address to retrieve the network resource using a second trust certificate associated with the proxy server and the network server; and
communicating securely, by the proxy server, with the application to forward the network resource using the first trust certificate associated with the proxy server and the application.
9. The computer program product of claim 8 , wherein the medium further comprises code to perform steps comprising:
installing, on the user device, a smart agent configured to manage secure communications on the user device by registering the user device with a management server; and
configuring, by the smart agent, the proxy server on the user device.
10. The computer program product of claim 9 , wherein the medium further comprises code to perform steps comprising installing, by the smart agent, the first trust certificate associated with the application and the proxy server.
11. The computer program product of claim 10 , wherein the step of installing the first trust certificate comprises at least one of: installing the first trust certificate in an independent certificate store for the application; or installing the first trust certificate in an operating system certificate store.
12. The computer program product of claim 8 , wherein when the request for the network resource is not permitted:
dropping the request from the application for the network resource; and
transmitting, to the application, a message indicating the network resource is unavailable.
13. The computer program product of claim 9 , wherein determining whether the request for the network resource is permitted comprises applying a web filtering policy to the request, the method further comprising receiving, from a management server, an update to the web filtering policy.
14. The computer program product of claim 9 , wherein determining whether the request for the network resource is permitted comprises applying a web filtering policy to the request, the method further comprising transmitting, to a management server, a log of requests denied in the applying of the web filtering policy.
15. An apparatus, comprising:
a memory; and
a processor coupled to the memory, wherein the processor is configured by code in the memory to execute a proxy server to perform steps comprising:
receiving a secure communication from an application, the application executing on the user device also executing the proxy server;
decrypting the secure communication from the application using a first trust certificate associated with the proxy server and the application, the secure communication including a request for a network server, the network server having a network address;
determining, by the proxy server, whether the request for the network resource is permitted; and
when the request for the network resource is permitted:
communicating securely with the network server at the network address to retrieve the network resource using a second trust certificate associated with the proxy server and the network server; and
communicating securely with the application to forward the network resource using the first trust certificate associated with the proxy server and the application.
16. The apparatus of claim 15 , wherein the processor is further configured to perform steps comprising:
installing, on the user device, a smart agent configured to manage secure communications on the user device by registering the user device with a management server; and
configuring, by the smart agent, the proxy server on the user device.
17. The apparatus of claim 16 , wherein the processor is further configured to perform steps comprising installing, by the smart agent, the first trust certificate associated with the application and the proxy server.
18. The apparatus of claim 17 , wherein the step of installing the first trust certificate comprises at least one of: installing the first trust certificate in an independent certificate store for the application; or installing the first trust certificate in an operating system certificate store.
19. The apparatus of claim 15 , wherein when the request for the network resource is not permitted:
dropping the request from the application for the network resource; and
transmitting, to the application, a message indicating the network resource is unavailable.
20. The apparatus of claim 15 , wherein determining whether the request for the network resource is permitted comprises applying a web filtering policy to the request, the method further comprising receiving, from a management server, an update to the web filtering policy.
21. The apparatus of claim 15 , wherein determining whether the request for the network resource is permitted comprises applying a web filtering policy to the request, the method further comprising transmitting, to a management server, a log of requests denied in the applying of the web filtering policy.