US20130097656A1

US20130097656A1 - Methods and systems for providing trusted signaling of domain-specific security policies

Info

Publication number: US20130097656A1
Application number: US13/274,756
Authority: US
Inventors: John Kennedy
Original assignee: Individual
Current assignee: Citrix Systems Inc
Priority date: 2011-10-17
Filing date: 2011-10-17
Publication date: 2013-04-18
Also published as: US20150180904A1; US9231983B2

Abstract

Methods and systems for providing trusted signaling of domain-specific security policies. One method includes intercepting a connection request to a remote server from a client device on a domain and returning a security certificate with policy information for regulating the communications with the target server.

Description

FIELD

The disclosure relates generally to providing trusted signaling of domain-specific security policies. More specifically, the disclosure relates to providing domain-specific security policies to application clients using SSL server certificates.

BACKGROUND

In some on-line environments, local IT security staff block all programs which may compromise or otherwise disclose information on a local domain to sources outside the domain. For example, local IT security staff block remote collaboration applications which may give users outside the local domain various rights to the screen or desktop of a computer on the domain. In a specific example, a remote collaboration tool may give a remote user external to a local domain the ability to control the desktop of a computer on the local domain. Healthcare, pharmaceutical, financial, defense, Federal Government, and other regulated, risk-averse IT environments are typical examples of environments where such programs are blocked. Thus, to be compatible with these types of secure environments, provisioning of on-line resources must permit local IT security staff to communicate policies to protect the interests of a specific domain.
One option for compatibility is to modify the registry on each computer. When using a computer's registry, a software client will always refer to the registry when executing. A problem with this solution is that it is difficult to deploy the registry settings to every computer on a network, which could be in the thousands. Another option would be to direct software toward an active directory. A problem with this solution, however, requires pre-programming of the software client.

SUMMARY

The deployment of security gateways and the need for them to create replacement SSL server certificates provides the opportunity to control the functionality of a network-based application client in a domain-specific and trusted fashion. For example, if the security gateway includes additional, application-specific extensions in an X.509v3 digital certificate profile when creating the replacement certificate, then the client has an opportunity to receive, validate and act on this digitally-signed information. Thus, local IT staff may modify a certificate profile to regulate and communicate policies for any functionality of network-based applications made available at target server located outside the local domain.
In one embodiment of the systems and methods disclosed herein, trusted signaling of domain-specific policies is provided by storing a replacement certificate at a proxy server on a local domain; intercepting by the proxy server a first outbound connection request received from a local application executing on a client computer on the local domain, wherein the request is to connect to a network-based application server outside the local domain; initiating a second outbound connection request to the network-based application server; facilitating the establishment of a first connection between the proxy server and the network-based application server in response to the second outbound connection request and using a target certificate for verifying the identity of the network-based application server; facilitating the establishment of a second connection between the proxy server and the client; and transmitting the replacement certificate to the client by the proxy server in response to the first outbound connection request; wherein the replacement certificate stores a policy for regulating the use of one or more applications being accessed at the network-based application server.
In various embodiments, the proxy server is an SSL-inspecting proxy server and the first and second connections are SSL connections. In some embodiments, the replacement certificate is an X.509v3 digital certificate. In some embodiments, the policy is stored as an extension in the X.509v3 digital certificate. In some embodiments, the local application is an on-line presentation participant software. In some embodiments, the network-based application server is an on-line presentation server. In some embodiments, the policy prohibits transmitting a desktop or screen image, files, or other information from the client computer outside of the local domain. In some embodiments, the policy prohibits giving remote control of the client computer to an entity outside the local domain.
In one embodiment of the systems and methods disclosed herein, trusted signaling of domain-specific policies is provided using a proxy server on a local domain for providing trusted signaling of domain-specific policies that includes a computer storage medium for storing a replacement certificate, which stores a policy for regulating the use of one or more applications being accessed at a network-based application server; and a network interface for intercepting by the proxy server a first outbound connection request received from a local application executing on a client computer on the local domain, wherein the request is to connect to a network-based application server outside the local domain, initiating a second outbound connection request to the network-based application server, facilitating the establishment of a first connection between the proxy server and the network-based application server in response to the second outbound connection request and using a target certificate for verifying the identity of the network-based application server, facilitating the establishment of a second connection between the proxy server and the client, and transmitting the replacement certificate to the client by the proxy server in response to the first outbound connection request.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing discussion will be understood more readily from the following detailed description of the disclosure, when taken in conjunction with the accompanying drawings, in which:

FIG. 1 shows an embodiment of distributed computing environment;

FIG. 2 shows an embodiment of a security certificate including policy information for regulating a network-based application.

DETAILED DESCRIPTION

An embodiment of a distributed computing environment 10 is depicted in FIG. 1. The environment 10 comprises a local network or domain 12 of users 14. On the local network 12 is an SSL proxy server 16. The local network 12 is connected to an unsecure network, such as the Internet 18. A network-based application service 19 is also connected to the Internet 18.
Web security gateways or proxy servers, such as SSL proxy servers 16, are employed by a growing number of enterprises to mitigate risks associated with malware, sensitive data threat/leakage, and unauthorized access to objectionable Internet content or applications. Some of these gateways 16 intercept outbound connection requests and serve as a middle man between a client 14 and target 19. In doing so, the gateways 16 return a security certificate signed by a trusted, internal certificate authority. For example, an SSL proxy server 16 intercepts outbound SSL connection requests, generates “spoofed,” replacement SSL server certificates which it returns to the requester 14, and then establishes a second SSL connection to the target server 19 identified in the request. The spoofed certificate is signed by an internal certificate authority that the enterprise controls. As long as the client 14 trusts the internal certificate authority, the security gateway 16 can act as a so-called “man in the middle” and inspect the plaintext traffic between the client 14 and target server 19.
These security certificates may be used to communicate local-IT administrators' policies for a particular network-based application available at a network-based application service 19 to clients 14 seeking access to the network-based application. As used herein, “network-based application” broadly refers to any application that uses information received from a network to operate. Digital security certificates are not limited to distributing only cryptographic information. For example, as illustrated in FIG. 2, an X.509v3 digital certificate 20 may optionally include one or more extensions 22 in its structure. These extensions 22 may be used to transmit data with the certificate 20. Ordinarily, in prior art systems, extensions 22 are used to distribute information about the certificate 20 itself, not for regulating policies regarding applications that may use the certificate 20. If the security gateway 16 adds application-specific extensions 22 in an X.509v3 digital certificate 20 profile when creating a replacement certificate to send to a client 14, then the client 14 has an opportunity to receive, validate, and act on this digitally-signed information. The information provided in these application-specific extensions 22 may be policy information that a browser or proprietary software application can interpret. More information on security certificates and extensions may be found in the Internet Engineering Task Force's (IETF) Request For Comments (RFC) 5280, entitled “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile,” from May 2008, which is incorporated in its entirety by reference herein. Thus, a trusted security certificate returned from an internal certificate authority can double as a distributor for policies regulating permissions granted to a network-based application for which the certificate was issued. In other words, functionality of a network-based application may be restricted through the SSL proxy process.
In various embodiments, the network-based application's client-side software is configured to detect and parse information included in a security certificate. The code is also adapted to communicate the policy conveyed in the certificate 20 to the application security layer in the client 14 for interpretation and enforcement. The client-side software is also able to accept and trust local certificate authorities either by accessing a local certificate store on the client computer or through additional logic and GUI elements to confirm acceptance of non-standard certificate authority root certificates by the user, e.g., such as exists within standard Internet browsers.
The following is a work flow example of an embodiment of the present disclosure. A user 14 directs its browser towards an on-line presentation application's server 19. The user 14 then downloads from the server 19 client software to run the on-line presentation. The user 14 next attempts to establish an SSL connection to an on-line presentation server. When initiating its outbound SSL communications with the on-line presentation server, the client software expects to receive a valid security certificate in response. A local SSL proxy server 16 intercepts the SSL connection request and establishes a connection with the on-line presentation server. The SSL proxy server 16 also returns a replacement certificate 20 in response to the outbound connection request. Because the certificate 20 is signed by a local certificate authority, the client 14 trusts the contents of the certificate 20. The certificate 20 includes policy information, stored in an extension 22 of the certificate, for identifying the rights and capabilities of the on-line presentation software running on the client computer 14. For example, in environments that prohibit presenting or giving remote control to a local computer's desktop to outside computers, if the certificate 20 includes appropriately encoded policy information along the lines of “On-Line Presentation Software—No Share Desktop” or “On-Line Presentation Software—No Remote Control,” then the local IT security staff could allow employees to use the on-line presentation software with the desired functionality restrictions needed to comply with local policy. Accordingly, the on-line presentation software operates according to the restrictions and permissions identified in the security certificate.
Use of security certificates is beneficial because an internal certificate authority is a central place for IT to distribute updated policies to any machine on a domain that is seeking access to a particular network-based application. Because these systems already have a gateway for intercepting SSL requests and transmitting replacement certificates, it is beneficial to take advantage of these replacement certificates to simultaneously distribute policies to regulate the use of network-based applications with entities outside of a local, trusted domain.
For IT staff that are inclined to implement many web security controls at these security gateways, this method provides an advantage over, say, using Windows registry settings to signal policy to the application client. It also does not require IT staff to contact each network-based application vendor to request manually blocking or hobbling client functionality based on the requesting IP address. For vendors of security gateways and SSL-inspecting proxies in particular, this systems and methods disclosed herein provide a way to enhance the value of products to customers and better accommodate the needs of mutual customers.
Aspects of this disclosure are compatible with any browser or software client that has functionality distributed outside a local domain. A local computer will operate according to the policies identified in the trusted security certificate received from its local security certificate authority. For example, a digital security certificate may include a policy that prohibits the execution of various multimedia platforms, including Adobe Systems Inc.'s ADOBE FLASH PLAYER.
Various embodiments of this disclosure may be used to distribute domain-specific policies for downloading content or programs from servers outside of the domain by way of security certificates. In yet other embodiments, security certificates may be used to distribute domain-specific policies to regulate viewing and listening of streaming video or audio websites. The systems and methods disclosed herein are not limited to the examples disclosed, but are applicable to regulating domain-specific policies in instances where a security certificate is distributed.
The previously described embodiments may be implemented as a method, apparatus or article of manufacture using programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof. The term “article of manufacture” as used herein is intended to encompass code or logic accessible from and embedded in one or more computer-readable devices, firmware, programmable logic, memory devices (e.g., EEPROMs, ROMs, PROMs, RAMs, SRAMs, etc.), hardware (e.g., integrated circuit chip, Field Programmable Gate Array (FPGA), Application Specific Integrated Circuit (ASIC), etc.), electronic devices, a computer readable non-volatile storage unit (e.g., CD-ROM, floppy disk, hard disk drive, etc.), a file server providing access to the programs via a network transmission line, wireless transmission media, signals propagating through space, radio waves, infrared signals, etc. The article of manufacture includes hardware logic as well as software or programmable code embedded in a computer readable medium that is executed by a processor. Of course, those skilled in the art will recognize that many modifications may be made to this configuration without departing from the scope of the present disclosure.
Although the present disclosure has been described with reference to specific details, it is not intended that such details should be regarded as limitations upon the scope of the disclosure, except as and to the extent that they are included in the accompanying claims.

Claims

What is claimed is:

1. A method for providing trusted signaling of domain-specific policies comprising:

storing a replacement certificate at a proxy server on a local domain;

intercepting by the proxy server a first outbound connection request received from a local application executing on a client computer on the local domain, wherein the request is to connect to a network-based application server outside the local domain;

initiating a second outbound connection request to the network-based application server;

facilitating the establishment of a first connection between the proxy server and the network-based application server in response to the second outbound connection request and using a target certificate for verifying the identity of the network-based application server;

facilitating the establishment of a second connection between the proxy server and the client; and

transmitting the replacement certificate to the client by the proxy server in response to the first outbound connection request;

wherein the replacement certificate stores a policy for regulating the use of one or more applications being accessed at the network-based application server.

2. The method of claim 1, wherein the proxy server is an SSL-inspecting proxy server and the first and second connections are SSL connections.

3. The method of claim 1 wherein the replacement certificate is an X.509v3 digital certificate.

4. The method of claim 3, wherein the policy is stored as an extension in the X.509v3 digital certificate.

5. The method of claim 1 wherein the local application is an on-line presentation participant software.

6. The method of claim 5, wherein the network-based application server is an on-line presentation server.

7. The method of claim 6, wherein the policy prohibits transmitting a desktop or screen image, files, or other information from the client computer outside of the local domain.

8. The method of claim 6, wherein the policy prohibits giving remote control of the client computer to an entity outside the local domain.

9. A proxy server on a local domain for providing trusted signaling of domain-specific policies comprising

a computer storage medium for storing a replacement certificate, which stores a policy for regulating the use of one or more applications being accessed at a network-based application server; and

a network interface for

intercepting by the proxy server a first outbound connection request received from a local application executing on a client computer on the local domain, wherein the request is to connect to a network-based application server outside the local domain,

initiating a second outbound connection request to the network-based application server,

facilitating the establishment of a first connection between the proxy server and the network-based application server in response to the second outbound connection request and using a target certificate for verifying the identity of the network-based application server,

facilitating the establishment of a second connection between the proxy server and the client, and

transmitting the replacement certificate to the client by the proxy server in response to the first outbound connection request.

10. The proxy server of claim 9, wherein the proxy server is an SSL-inspecting proxy server and the first and second connections are SSL connections.

11. The method of claim 9 wherein the replacement certificate is an X.509v3 digital certificate.

12. The method of claim 11, wherein the policy is stored as an extension in the X.509v3 digital certificate.

13. The method of claim 9 wherein the local application is an on-line presentation participant software.

14. The method of claim 13, wherein the network-based application server is an on-line presentation server.

15. The method of claim 14, wherein the policy prohibits transmitting a desktop or screen image, files, or other information from the client computer outside of the local domain.

16. The method of claim 14, wherein the policy prohibits giving remote control of the client computer to an entity outside the local domain.