Systems and methods for improving HTTPS security

Patent metadata

Field	Value
Publication number	US-10225237-B2
Application number	US-201615295054-A
Country	US
Kind code	B2
Filing date	Oct 17, 2016
Priority date	Oct 17, 2016
Publication date	Mar 5, 2019
Grant date	Mar 5, 2019

Abstract

Systems and methods for HyperText Transfer Protocol (HTTP) HTTP Strict Transport Security (HSTS), are implemented by one or more servers associated with a gateway in a cloud based proxy. A method includes managing a preloaded list of HTTP Security (HTTPS) support of a plurality of domains; receiving a domain request from an HSTS application executed on a user device, wherein the HSTS application is configured to detect the domain request from a browser or application executed on the user device; and transmitting a response to the user device with header information related to support of HTTPS the domain.

First claim

What is claimed is:

1. A method for HyperText Transfer Protocol (HTTP) HTTP Strict Transport Security (HSTS), implemented by one or more servers associated with a gateway in a cloud based proxy, the method comprising:
managing a preloaded list of HTTP Security (HTTPS) support of a plurality of domains;
receiving a domain request from an HSTS application executed on a user device, wherein the HSTS application is configured to detect the domain request from a browser or application executed on the user device; and
transmitting a response to the user device with header information related to support of HTTPS the domain.

2. The method of claim 1 , further comprising:
subsequent to the receiving and prior to the transmitting, determining the support of HTTPS of the domain.

3. The method of claim 2 , wherein the determining comprises:
sending a request to the domain without sensitive information from the domain request; and
receiving a redirect from the domain.

4. The method of claim 2 , wherein the determining comprises checking the preloaded list and wherein the header information comprises any exceptions based on the preloaded list.

5. The method of claim 1 , wherein the HSTS application removes sensitive information from the domain request prior to the receiving.

6. The method of claim 1 , wherein communications between the user device and the gateway are secure.

7. The method of claim 6 , wherein the domain does not support HSTS, and further comprising:
transmitting the domain request with sensitive information in plain text between the gateway and the domain.

8. A gateway in a cloud based proxy, configured to implement HyperText Transfer Protocol (HTTP) HTTP Strict Transport Security (HSTS), the gateway comprising:
a network interface, a data store, and a processor communicatively coupled to one another; and
memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to perform steps of
managing a preloaded list of HTTP Security (HTTPS) support of a plurality of domains;
receiving a domain request from an HSTS application executed on a user device, wherein the HSTS application is configured to detect the domain request from a browser or application executed on the user device; and
transmitting a response to the user device with header information related to support of HTTPS the domain.

9. The gateway of claim 8 , wherein the memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions further cause the processor to perform steps of
subsequent to the receiving and prior to the transmitting, determining the support of HTTPS of the domain.

10. The gateway of claim 9 , wherein the determining comprises:
sending a request to the domain without sensitive information from the domain request; and
receiving a redirect from the domain.

11. The gateway of claim 9 , wherein the determining comprises checking the preloaded list and wherein the header information comprises any exceptions based on the preloaded list.

12. The gateway of claim 8 , wherein the HSTS application removes sensitive information from the domain request prior to the receiving.

13. The gateway of claim 8 , wherein communications between the user device and the gateway are secure.

14. The gateway of claim 13 , wherein the domain does not support HSTS, and wherein the memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions further cause the processor to perform steps of
transmitting the domain request with sensitive information in plain text between the gateway and the domain.

15. A method for HyperText Transfer Protocol (HTTP) HTTP Strict Transport Security (HSTS), implemented by a user device in communication with a gateway in a cloud based proxy, the method comprising:
detecting a domain request from a browser or application executed on the user device by an HSTS application on the user device;
securely forwarding the domain request to a gateway;
receiving a response from the gateway with header information related to HTTP Security (HTTPS) support of the domain; and
responsive to the domain supporting HTTPS based on the header information, securely communicating with the domain.

16. The method of claim 15 , wherein the browser or application does not support HSTS.

17. The method of claim 15 , wherein the HSTS application removes sensitive information from the domain request prior to the forwarding.

18. The method of claim 15 , wherein the gateway determines whether the domain supports HTTPS independent of the user device.

19. The method of claim 18 , wherein the gateway determines through a request sent to the domain without sensitive information from the domain request; and reception of a redirect from the domain.

20. The method of claim 18 , wherein the gateway determines by checking a preloaded list managed thereon of HTTPS supporting domains and wherein the header information comprises any exceptions based on the preloaded list.

Assignees

• Zscaler Inc

Inventors

• Singh Ajit

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/168

  above the transport layer · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title