Securing network activity managed by operating systems

Patent metadata

Field	Value
Publication number	US-10277578-B2
Application number	US-201614986971-A
Country	US
Kind code	B2
Filing date	Jan 4, 2016
Priority date	Jan 5, 2015
Publication date	Apr 30, 2019
Grant date	Apr 30, 2019

Abstract

Methods and systems are disclosed for providing approaches to receiving, by an enterprise framework device from an application executing on a computing device, a first request associated with accessing an enterprise resource and generating, by the data proxy device, a ticketed URL that is associated with resource device communications related to the first request. The methods and systems may include receiving, by the data proxy device from the operating system, a second request addressed to the ticketed URL, transmitting, by the data proxy device to the operating system, based on the second request addressed to the ticketed URL, a resource device response, and transmitting, by the enterprise framework device to the application, the resource device response.

First claim

What is claimed is:

1. A method comprising:
receiving, by an enterprise framework device and from an application executing on a computing device, a first request associated with accessing an enterprise resource;
transmitting, by the enterprise framework device, to a data proxy device, and via a foreground application programming interface of an operating system executing on the computing device, the first request, wherein the foreground application programming interface is different from the application;
transmitting, by the data proxy device, the first request to an enterprise resource device;
generating, by the data proxy device, a ticketed Uniform Resource Locator (URL), wherein the ticketed URL is associated with resource device communications related to the first request, and wherein the ticketed URL comprises at least one of a secure number, a use limit, or an access credential;
transmitting, by the data proxy device and via the enterprise framework device, the ticketed URL to the operating system;
receiving, by the data proxy device and from the operating system, a second request addressed to the ticketed URL;
transmitting, by the data proxy device, to the operating system, and based on the second request, a resource device response related to the first request for the enterprise resource device;
retrieving, by the enterprise framework device and from the operating system, the resource device response; and
transmitting, by the enterprise framework device and to the application, the resource device response.

2. The method of claim 1 , further comprising:
generating, by the enterprise framework device, an encryption key associated with the data proxy device;
encrypting, by the data proxy device and based on the encryption key, the resource device response; and
decrypting, by the enterprise framework device and based on the encryption key, the encrypted resource device response.

3. The method of claim 1 , further comprising:
receiving, by the data proxy device and from the enterprise framework device, the first request; and
initiating, by the data proxy device and based on receiving the first request, an authentication session with the enterprise resource device using one or more credentials that are unfamiliar to the operating system.

4. The method of claim 1 , further comprising:
caching, by the data proxy device and in a storage device, information associated with the first request, wherein the ticketed URL references a location of the cached information, and wherein the second request comprises the location of the cached information;
transmitting, by the data proxy device, to the enterprise resource device, and based on receiving the second request, the cached information associated with the first request; and
receiving, by the data proxy device and from the enterprise resource device, the resource device response.

5. The method of claim 1 , further comprising:
transmitting, by the data proxy device, to the enterprise resource device, via an authentication session, and based on receiving the second request, authentication credentials.

6. The method of claim 1 , further comprising:
buffering, by the data proxy device, a portion of the resource device response;
receiving, by the data proxy device, a call from the operating system; and
transmitting, by the data proxy device, to the operating system, and based on the call, the buffered portion of the resource device response.

7. The method of claim 1 , wherein the first request comprises a request to download a file or upload a file.

8. A system, comprising:
at least one processor; and
at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause the system to:
receive, by an enterprise framework device and from an application executing on a computing device, a first request associated with accessing an enterprise resource;
transmit, by the enterprise framework device, to a data proxy device, and via a foreground application programming interface of an operating system executing on the computing device, the first request, wherein the foreground application programming interface is different from the application;
transmit, by the data proxy device, the first request to an enterprise resource device;
generate, by the data proxy device, a ticketed Uniform Resource Locator (URL), wherein the ticketed URL is associated with resource device communications related to the first request, and wherein the ticketed URL comprises at least one of a secure number, a use limit, or an access credential;
transmit, by the data proxy device and via the enterprise framework device, the ticketed URL to the operating system;
receive, by the data proxy device and from the operating system, a second request addressed to the ticketed URL;
transmit, by the data proxy device, to the operating system, and based on the second request, a resource device response related to the first request for the enterprise resource device;
retrieve, by the enterprise framework device and from the operating system, the resource device response; and
transmit, by the enterprise framework device and to the application, the resource device response.

9. The system of claim 8 , wherein the computer-readable instructions further cause the system to:
generate, by the enterprise framework device, an encryption key associated with the data proxy device;
encrypt, by the data proxy device and based on the encryption key, the resource device response; and
decrypt, by the enterprise framework device and based on the encryption key, the encrypted resource device response.

10. The system of claim 8 , wherein the computer-readable instructions further cause the system to:
receive, by the data proxy device from the enterprise framework device, the first request; and
initiate, by the data proxy device and based on receiving the first request, an authentication session with the enterprise resource device using one or more credentials that are unfamiliar to the operating system.

11. The system of claim 8 , wherein the computer-readable instructions further cause the system to:
cache, by the data proxy device and in a storage device, information associated with the first request, wherein the ticketed URL references a location of the cached information, and wherein the second request comprises the location of the cached information;
transmit, by the data proxy device, to the enterprise resource device, and based on receiving the second request, the cached information associated with the first request; and
receive, by the data proxy device and from the enterprise resource device, the resource device response.

12. The system of claim 8 , wherein the computer-readable instructions further cause the system to:
transmit, by the data proxy device, to the enterprise resource device, via an authentication session, and based on receiving the second request, authentication credentials.

13. The system of claim 8 , wherein the computer-readable instructions further cause the system to:
buffer, by the data proxy device, a portion of the resource device response;
receive, by the data proxy device, a call from the operating system; and
transmit, by the data proxy device, to the operating system, and based on the call, the buffered portion of the resource device response.

14. The system of claim 8 , wherein the first request comprises a request to download a file or upload a file.

15. One or more non-transitory computer-readable storage media having computer-readable instructions stored thereon that, when executed by one or m

Assignees

• Citrix Systems Inc

Inventors

• Innes Andrew Carnegie

Classifications

• H04W12/06

  Authentication · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/2842

  Electricity · mapped topic

• H04L63/0281

  Proxies · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title