Methods and systems for proxying data
Methods and systems are provided for proxying data between an application server and a client device. One exemplary application system includes an application server to generate a virtual application and a proxy server coupled to the application server over a network to provide the virtual application to a client device. The proxy server receives input data from the client device and provides the input data to the application server, wherein the application server encodes the input data for an action in response to authenticating the proxy server and provides the data encoded for the action to the proxy server. The proxy server performs the action on the data and provides the result to the client device.
1. A method, comprising:
receiving, by a proxy server, an input comprising first data and second data;
encrypting, by the proxy server, the second data based upon a determination that the second data requires encryption according to a rule associated with the input;
forwarding, by the proxy server, the first data, the encrypted second data, and an identifier that indicates encryption of the second data to an application server;
receiving, by the proxy server, instructions from the application server that integrate the first data, the encrypted second data, and a post-decryption action bypassed by the application server;
decrypting, by the proxy server, the encrypted second data and processing the post-decryption action on the decrypted second data; and
providing, by the proxy server in response to the input, the instructions with the decrypted second data as processed by the post-decryption action.
2. The method of claim 1 , wherein decrypting the encrypted second data includes:
detecting, by the proxy server, malicious code in the decrypted second data; and
performing, by the proxy server, a remedial action configured to prevent execution of the malicious code.
3. The method of claim 1 , further comprising:
receiving, by the proxy server, an identifier that indicates the post-decryption action.
4. The method of claim 1 , wherein the identifier that indicates encryption of the second data is a unique identifier associated with the application server, and wherein decrypting the encrypted second data comprises:
using the unique identifier to mark operators of code generated by the application server separately from potentially malicious code.
5. The method of claim 1 , wherein encrypting the second data comprises generating the identifier that indicates encryption of the second data as a unique identifier associated with the application server.
6. The method of claim 1 , wherein decrypting the encrypted second data and processing the post-decryption action includes distinguishing the encrypted second data from the instructions based on an encoding authentication protocol established between the proxy server and the application server.
7. The method of claim 1 , wherein encrypting the second data further comprises:
hashing, by the proxy server, the encrypted second data to a hexadecimal representation; and
provide, by the proxy server, the hexadecimal representation as a parameter to a post-decryption function.
8. A non-transitory, computer-readable medium storing computer executable instructions configured to cause a processor to perform operations comprising:
receiving, by a proxy server, an input comprising first data and second data;
encrypting, by the proxy server, the second data based upon a determination that the second data requires encryption according to a rule associated with the input;
forwarding, by the proxy server, the first data, the encrypted second data, and an identifier that indicates encryption of the second data to an application server;
receiving, by the proxy server, instructions from the application server that integrate the first data, the encrypted second data, and a post-decryption action bypassed by the application server;
decrypting, by the proxy server, the encrypted second data and processing the post-decryption action on the decrypted second data; and
providing, by the proxy server in response to the input, the instructions with the decrypted second data as processed by the post-decryption action.
9. The computer-readable medium of claim 8 , wherein decrypting the encrypted second data includes:
detecting, by the proxy server, malicious code in the decrypted second data; and
performing, by the proxy server, a remedial action configured to prevent execution of the malicious code.
10. The computer-readable medium of claim 8 , wherein the identifier that indicates encryption of the second data is a unique identifier associated with the application server, and wherein decrypting the encrypted second data comprises:
using the unique identifier to mark operators of code generated by the application server separately from potentially malicious code.
11. The computer-readable medium of claim 8 , wherein encrypting the second data comprises generating the identifier that indicates encryption of the second data as a unique identifier associated with the application server.
12. The computer-readable medium of claim 8 , wherein decrypting the encrypted second data and processing the post-decryption action includes distinguishing the encrypted second data from the instructions based on an encoding authentication protocol established between the proxy server and the application server.
13. The computer-readable medium of claim 8 , wherein encrypting the second data further comprises:
hashing, by the proxy server, the encrypted second data to a hexadecimal representation; and
provide, by the proxy server, the hexadecimal representation as a parameter to a post-decryption function.
14. The computer-readable medium of claim 8 , the operations further comprising:
receiving, by the proxy server, an identifier that indicates the post-decryption action.
15. A system, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
receive, by a proxy server, an input comprising first data and second data;
encrypt, by the proxy server, the second data based upon a determination that the second data requires encryption according to a rule associated with the input;
forward, by the proxy server, the first data, the encrypted second data, and an identifier that indicates encryption of the second data to an application server;
receive, by the proxy server, instructions from the application server that integrate the first data, the encrypted second data, and a post-decryption action bypassed by the application server;
decrypt, by the proxy server, the encrypted second data and process the post-decryption action on the decrypted second data; and
provide, by the proxy server in response to the input, the instructions with the decrypted second data as processed by the post-decryption action.
16. The system of claim 15 , the at least one processor further configured to:
receive, by the proxy server, an identifier that indicates the post-decryption action.
17. The system of claim 15 , wherein the identifier that indicates encryption of the second data is a unique identifier associated with the application server, and wherein to decrypt the encrypted second data, the at least one processor is configured to:
use, by the proxy server, the unique identifier to mark operators of code generated by the application server separately from potentially malicious code.
18. The system of claim 15 , wherein to encrypt the second data, the at least one processor is configured to:
hash, by the proxy server, the encrypted second data to a hexadecimal representation; and
provide, by the proxy server, the hexadecimal representation as a parameter to a post-decryption function.
19. The system of claim 15 , wherein to decrypt the encrypted second data, the at least one processor is configured to:
detect, by the proxy server, malicious code in the encrypted second data; and
perform, by the proxy server, a remedial action configured to prevent execution of the malicious code.
20. The system of claim 15 , wherein to decrypt the encrypted second data and process the post-decryption action, the at least one processor is configured to:
distinguish the encrypted second data from the instructions based on an encoding authentication protocol established between the proxy server and the application server.