+

WO2008017011A3 - Systèmes et procédés pour l'interception et l'autorisation de trafic ssl/vpn fondées sur une application - Google Patents

Systèmes et procédés pour l'interception et l'autorisation de trafic ssl/vpn fondées sur une application Download PDF

Info

Publication number
WO2008017011A3
WO2008017011A3 PCT/US2007/075035 US2007075035W WO2008017011A3 WO 2008017011 A3 WO2008017011 A3 WO 2008017011A3 US 2007075035 W US2007075035 W US 2007075035W WO 2008017011 A3 WO2008017011 A3 WO 2008017011A3
Authority
WO
WIPO (PCT)
Prior art keywords
application
client
communication
agent
virtual private
Prior art date
Application number
PCT/US2007/075035
Other languages
English (en)
Other versions
WO2008017011A2 (fr
Inventor
Amarnath Mullick
Charu Venkatraman
Junxiao He
Shashi Nanjundaswami
James Harris
Ajay Soni
Original Assignee
Citrix Systems Inc
Amarnath Mullick
Charu Venkatraman
Junxiao He
Shashi Nanjundaswami
James Harris
Ajay Soni
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US11/462,329 external-priority patent/US8869262B2/en
Priority claimed from US11/462,321 external-priority patent/US8495181B2/en
Application filed by Citrix Systems Inc, Amarnath Mullick, Charu Venkatraman, Junxiao He, Shashi Nanjundaswami, James Harris, Ajay Soni filed Critical Citrix Systems Inc
Priority to CN200780037175.8A priority Critical patent/CN101636998B/zh
Priority to AU2007281166A priority patent/AU2007281166B2/en
Publication of WO2008017011A2 publication Critical patent/WO2008017011A2/fr
Publication of WO2008017011A3 publication Critical patent/WO2008017011A3/fr
Priority to HK10107195.6A priority patent/HK1140883A1/xx

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
    • H04L63/306—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information intercepting packet switched data communications, e.g. Web, Internet or IMS communications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Technology Law (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)
  • Telephonic Communication Services (AREA)

Abstract

L'invention porte sur un procédé qui permet à l'agent d'un client d'intercepter des communications émises par le client sur une connexion de réseau privé virtuel. Le procédé de l'invention consiste à intercepter les communications sur la base de l'identification d'une application à l'origine de la communication. L'agent reçoit des informations identifiant une première application. L'agent détermine qu'une communication de réseau transmise par le client provient de la première application et intercepte cette communication. L'agent transmet la communication interceptée via la connexion de réseau privé virtuel. Un autre procédé de l'invention permet à un appareil d'octroyer ou de refuser à une application exécutée sur un client l'accès à une ressource via une connexion de réseau privé virtuel, lequel procédé consiste à fonder la décision d'octroyer ou de refuser l'accès sur une identification de l'application. L'appareil associe à la demande interceptée une politique d'autorisation reposant sur l'identité de l'application. L'appareil détermine, au moyen de la politique d'autorisation et de l'identité de l'application, si l'accès de l'application à la ressource doit être octroyé ou refusé.
PCT/US2007/075035 2006-08-03 2007-08-02 Systèmes et procédés pour l'interception et l'autorisation de trafic ssl/vpn fondées sur une application WO2008017011A2 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN200780037175.8A CN101636998B (zh) 2006-08-03 2007-08-02 用于ssl/vpn业务的基于应用的拦截和授权的系统和方法
AU2007281166A AU2007281166B2 (en) 2006-08-03 2007-08-02 Systems and methods for application-based interception and authorization of SSL/VPN traffic
HK10107195.6A HK1140883A1 (en) 2006-08-03 2010-07-27 Systems and methods for application-based interception and authorization of ssl/vpn traffic

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US11/462,321 2006-08-03
US11/462,329 2006-08-03
US11/462,329 US8869262B2 (en) 2006-08-03 2006-08-03 Systems and methods for application based interception of SSL/VPN traffic
US11/462,321 US8495181B2 (en) 2006-08-03 2006-08-03 Systems and methods for application based interception SSI/VPN traffic

Publications (2)

Publication Number Publication Date
WO2008017011A2 WO2008017011A2 (fr) 2008-02-07
WO2008017011A3 true WO2008017011A3 (fr) 2008-07-03

Family

ID=38904791

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2007/075035 WO2008017011A2 (fr) 2006-08-03 2007-08-02 Systèmes et procédés pour l'interception et l'autorisation de trafic ssl/vpn fondées sur une application

Country Status (4)

Country Link
CN (1) CN103384250B (fr)
AU (1) AU2007281166B2 (fr)
HK (1) HK1140883A1 (fr)
WO (1) WO2008017011A2 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101729543B (zh) * 2009-12-04 2012-10-03 同济大学 利用异地Socks5技术改善移动SSL VPN性能的方法

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9237168B2 (en) * 2012-05-17 2016-01-12 Cisco Technology, Inc. Transport layer security traffic control using service name identification
CN104092691A (zh) * 2014-07-15 2014-10-08 北京奇虎科技有限公司 免root权限的联网防火墙的实现方法及客户端
CN104144126B (zh) * 2014-08-19 2018-01-23 北京奇虎科技有限公司 通过图像处理实现流量优化的方法及系统、客户端
US9560078B2 (en) 2015-02-04 2017-01-31 Intel Corporation Technologies for scalable security architecture of virtualized networks
CN105049431B (zh) * 2015-06-30 2019-02-15 深信服科技股份有限公司 数据访问控制方法和装置
CN109150751B (zh) * 2017-06-16 2022-05-27 阿里巴巴集团控股有限公司 一种网络控制方法及装置
CN109951575B (zh) * 2017-12-20 2022-06-10 新智数字科技有限公司 拦截指定域名的方法和系统
CN109543470A (zh) * 2018-11-01 2019-03-29 郑州云海信息技术有限公司 一种存储设备安全访问方法及系统
JP7515385B2 (ja) * 2020-11-30 2024-07-12 シャープ株式会社 情報処理装置、制御方法及びプログラム
CN116055408A (zh) * 2022-11-07 2023-05-02 中国银行股份有限公司 业务报文传输方法、装置和系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5987611A (en) * 1996-12-31 1999-11-16 Zone Labs, Inc. System and methodology for managing internet access on a per application basis for client computers connected to the internet
WO2002079949A2 (fr) * 2001-03-30 2002-10-10 Netscreen Technologies, Inc. Systeme de securite lie a l'internet
EP1418730A2 (fr) * 2002-11-06 2004-05-12 AT&T Corp. Croisements des réseaux privés virtuels basés sur des certificats
US20050265351A1 (en) * 2004-05-27 2005-12-01 Hewlett-Packard Development Company, L.P. Network administration
US20060005240A1 (en) * 2004-06-30 2006-01-05 Prabakar Sundarrajan System and method for establishing a virtual private network
EP1641215A2 (fr) * 2004-09-28 2006-03-29 Layer 7 Technologies, Inc. Système et procédé pour mettre en communication des identités dans une architecture orientée service
US7096495B1 (en) * 2000-03-31 2006-08-22 Intel Corporation Network session management

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7260599B2 (en) * 2003-03-07 2007-08-21 Hyperspace Communications, Inc. Supporting the exchange of data by distributed applications
US8572249B2 (en) * 2003-12-10 2013-10-29 Aventail Llc Network appliance for balancing load and platform services
US7818781B2 (en) * 2004-10-01 2010-10-19 Microsoft Corporation Behavior blocking access control
US20060130135A1 (en) * 2004-12-10 2006-06-15 Alcatel Virtual private network connection methods and systems

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5987611A (en) * 1996-12-31 1999-11-16 Zone Labs, Inc. System and methodology for managing internet access on a per application basis for client computers connected to the internet
US7096495B1 (en) * 2000-03-31 2006-08-22 Intel Corporation Network session management
WO2002079949A2 (fr) * 2001-03-30 2002-10-10 Netscreen Technologies, Inc. Systeme de securite lie a l'internet
EP1418730A2 (fr) * 2002-11-06 2004-05-12 AT&T Corp. Croisements des réseaux privés virtuels basés sur des certificats
US20050265351A1 (en) * 2004-05-27 2005-12-01 Hewlett-Packard Development Company, L.P. Network administration
US20060005240A1 (en) * 2004-06-30 2006-01-05 Prabakar Sundarrajan System and method for establishing a virtual private network
EP1641215A2 (fr) * 2004-09-28 2006-03-29 Layer 7 Technologies, Inc. Système et procédé pour mettre en communication des identités dans une architecture orientée service

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101729543B (zh) * 2009-12-04 2012-10-03 同济大学 利用异地Socks5技术改善移动SSL VPN性能的方法

Also Published As

Publication number Publication date
HK1140883A1 (en) 2010-10-22
CN103384250A (zh) 2013-11-06
WO2008017011A2 (fr) 2008-02-07
AU2007281166B2 (en) 2011-12-15
CN103384250B (zh) 2017-04-26
AU2007281166A1 (en) 2008-02-07

Similar Documents

Publication Publication Date Title
WO2008017011A3 (fr) Systèmes et procédés pour l'interception et l'autorisation de trafic ssl/vpn fondées sur une application
CN111490993B (zh) 一种应用访问控制安全系统及方法
US11263305B2 (en) Multilayered approach to protecting cloud credentials
US10630725B2 (en) Identity-based internet protocol networking
JP7027348B2 (ja) モバイルエッジにおけるコンピューティングのためのプラットフォーム
US20220103515A1 (en) Split tunneling based on content type to exclude certain network traffic from a tunnel
US20200389437A1 (en) Methods and systems for establishing a connection between a first device and a second device across a software-defined perimeter
EP2850770B1 (fr) Aiguillage du trafic de sécurité de la couche de transport utilisant une identification de nom de service
US20190116206A1 (en) Network Application Security Policy Enforcement
US20200021618A1 (en) Distributed Network Application Security Policy Enforcement
WO2006004725A3 (fr) Systeme et procede permettant d'etablir un reseau prive virtuel
US20090113517A1 (en) Security state aware firewall
WO2007042826A3 (fr) Acces a distance a des ressources
CN101136777A (zh) 网络管理系统中双加密通道协作的安全管理方法
WO2010021954A3 (fr) Système et procédé pour pare-feu de réseau personnel sans fil (wpan)
WO2013018028A3 (fr) Exécution de politique d'authentification
EP2974355A2 (fr) Dispositif, système et procédé associé destiné à une règle et mise en miroir de trafic dynamique et détermination d'application fonctionnant sur un réseau
WO2017208079A3 (fr) Procédé et système d'amélioration de sécurité réseau
Yan et al. Study on security of 5G and satellite converged communication network
SA522431490B1 (ar) طريقة تقسيم شبكة مركز البيانات
KR20150114921A (ko) 기업내 보안망 제공시스템 및 그 방법
CN114640512B (zh) 安全服务系统、访问控制方法和计算机可读存储介质
CN116827646A (zh) 一种基于eBPF的终端流量代理及访问控制方法
RU2008109223A (ru) Обеспечение согласованного прохода брандмауэра, имеющего информацию о приложении
CN109561099A (zh) 一种设备远程通信加密方法

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 200780037175.8

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07813683

Country of ref document: EP

Kind code of ref document: A2

WWE Wipo information: entry into national phase

Ref document number: 2007281166

Country of ref document: AU

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2007281166

Country of ref document: AU

Date of ref document: 20070802

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: RU

122 Ep: pct application non-entry in european phase

Ref document number: 07813683

Country of ref document: EP

Kind code of ref document: A2

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载