Patent Application
20080034420
The invention will now be described in greater detail with reference to the preferred embodiments illustrated in the accompanying drawings, in which like elements bear like reference numbers, and wherein:
As shown in
It can be appreciated that the authentication/authorization server 14 can be an authentication, authorization, and accounting (or auditing) server 14 (also known as an “AAA”), which typically includes a set of authentication interfaces, to which the VPN device 10 integrates easily. The AAA server 14 can be any suitable server or authentication or database, including but not limited to an external LDAP, Microsoft Active Directory, RADIUS, RSA SecurID server or a local authentication database.
For an additional level of protection, the VPN device 10 supports authentication that identifies clients 20 and associates them with user sessions based on unique certificates. The authorization role provides the VPN device 10 with a regulation for the security policy. Typically, the VPN device 10 allows administrators to limit access to information and applications based on a user's role within the organization. However, policies are typically flexible enough to meet the most complex requirements while allowing changes and updates to be applied quickly and easily. Accordingly, to minimize integration complexity, the VPN device 10 allows policies to be stored locally as well as on an external server (not shown). In addition, the authentication and authorization server (AAA) 14 can include an extensive audit trail, which can be a primary requirement for all security related regulations and policies. Typically, the VPN device 10 generates audit information in formats that allow easy analysis for both security and status monitoring purposes.
As shown in
The VPN device 10 also includes an operating system 92 (i.e., software component) having a kernel 94, which is responsible for the communication between hardware 70 and software components 90. The kernel 94 provides abstraction layers for the hardware components 70, especially for memory, processors and communication between hardware and software. In addition, the kernel 94 can also provide software facilities to userland applications such as process abstractions, interprocess communication and system calls. As shown in
Typically, while a portal page 100 having a set of HTML commands or (static) tags 110 is fine for static pages, a second set of (dynamic) content tags is needed for more dynamic content. For example, to add a footer or header to all files, or to insert document information automatically into the portal page 100. The dynamic content can be added to a web page or portal 100 via a Common Gateway Interface (CGI) protocol or any suitable standard protocol for interfacing external application software with an information server (not shown). However, VPN devices 10 typically provide for dynamic document or content delivery using an external server (not shown). The dynamic content is stored on the external server in a content format known as Server-Side-Includes or SSI. Server Side-Includes allows the programmer to embed a number of special “commands” or tags into the HTML commands. When the server reads an SSI document, it looks for the special commands or tags and performs the necessary action. Typically, since all SSI commands are stored within the HTML in HTML format, pages tagged with shtml reveal that “Server Side Includes” are being used on the server. Accordingly, while Htm and Html pages are static, the file is lifted off the server's disk and sent verbatim to the client. With SSI, a Web page or portal page 100 can contain a second set of (dynamic) tags indicating that another file should be inserted in place of the dynamic tag in the existing page. Thus, the web or portal page 100 is lifted off the server's disk and the server makes all the substitutions indicated. The server then sends the final page 100 to the client device 50. It can be appreciated, however, that if a VPN customer requires a more extensive customization, they typically must create their own portal page 100 and host it on the external server. Unfortunately, if this is done, the VPN customer or user will lose the ability to have web and fileshare links filtered by an access control list (ACL) mechanism within the VPN device 10.
In addition, some of the functionality of the VPN device 10 can be lost with an external server hosting the dynamic content. For example, if the external server hosting the dynamic content in a local area network (LAN) or corporate network 30 having one or more VPN devices 10 fails, or is temporarily offline or down, this can effect the VPN devices 10 performance and possible result in the VPN device 10 being offline or down temporarily. In addition, the external hosting of dynamic content requires a firewall or similar device between the VPN device 10 and the external server, which affects the security of the VPN device 10.
It can be also be appreciated that if the hosting of the customized portal page 100 is on an external server, the customer or remote user 20 will be unable to launch some web-enabled applications, such as an Application Manager and an L3VPN Client from the portal page 100. Alternatively, if the VPN device 10 includes a local host or host 150, which is configured to host the customized portal page 100 with the portal customization tags 120, which are added to provide dynamic content or documents 122, the security provided by the VPN device 10 can be maintained.
Accordingly, it would be desirable for a customized portal page to be hosted on the VPN device 10, in order for the VPN device 10 to maintain its ability to filter or prevent unauthorized use. It can be appreciated that the customized portal page 100 can be configured using portal customization tags 120, which are hosted by the VPN device 10. The portal customization tags 120 provide the VPN device 10 with the ability to filter the web and fileshare links via the ACL by determining the appropriate access rights to a given object depending on certain aspects of the process that is making the request, including the process's user identity. In addition, it can be appreciated that the access rights of each remote user 20 will be maintained within the AAA server 14, including the specific individual user or group rights to specific system objects, such as a program, a process, or a file.
As shown in
Typically, with most VPN devices or gateways 10, administrators (or programmers) can configure the custom login, portal, logout, and error pages. However, in order to extend the functionality of the VPN device 10, with the ability of the VPN device 10 to provide for portal customization, including an ability to include a plurality of “portal themes,” it is necessary to confine the hosting of the customized portal page 100 to a local host 150 within the VPN device or gateway 10. It can be appreciated that by hosting the portal customization on the VPN device 10, the security and tunneling provided by a VPN device or gateway 10 is still maintained.
It can be appreciated that with the hosting of the portal customization tags 120 on the VPN device 10, the customer and/or end user or client 20 can incorporate different portal themes into the portal page 100. For example, for a large company with several different divisions or groups which access the corporate network 30 via a single VPN device 10, customized portal pages 100 having different themes can be designed for each company or group of users. In addition, it can be appreciated that individual users or clients could also select individual portal page themes from a plurality of portal themes. The portal themes can be based on various parameters, including the ability of the customer to provide different access to portions of the network and/or information to individual groups and/or remote users.
In addition, the VPN device 10 also preferably includes a resource separation module 160, which is used to perform resource separation validation 222 of an original or initial URL 162 for any content and the passing of a final or local URL 164 to the importation agent 140. It can be appreciated that any suitable module, which can perform resource separation validation and then pass 223 the final or local URL to the importation agent 140 can be used.
The importation agent 140 will then parse 224 the file 104 for original or initial URLs 162 and import 225 any supported resources that it finds into a directory 154 within the VPN device 10. The importation agent 140 will then rewrite the original or initial URLs 162 for these imported content 102 and resources to point to the local path (local URL 164). For example, modified or local URL 164 can read as follows:
It can be appreciated that the parsing of the original or initial URL 162 can be performed with a HTML parser 166. For example, the HTML parser 166 can be modified copy of a WRM (Web Resource Mapping) HTML parser or any other suitable HTML parser. Accordingly, for each of the documents or content, which is imported into the host 150, the documents or content 102 is preferably converted from its original Uniform Resource Locator (URL) 162 to a local URL 164. The pages will then be parsed for embedded content links, and any content found (style sheet, images, JavaScript, etc.) can be automatically imported into the rewritten or modified local URL 164.
Upon retrieval of the content or document from the host 150, the content 102 will be preferably passed 248 through a content mapping application 190, such as a Web Resource Mapping (WRM) feature or other suitable content mapping application, so that non-resource related content can be rewritten. The content mapping application 190 will then examine 250 the portal pages 100 for included portal customization tags 120. The pages 100 are preferably split into chucks at each tag boundary. The appropriate content 102 will then be inserted based on the portal customization tag 120 information, and the final portal page 100 sent to the client 50.
It can be appreciated that in accordance with one embodiment, the kernel portion 180 in addition to storing the configuration, the kernel portion 180 will also perform the tag parsing and content insertion. When a request is received by the VPN device 10 for content (i.e., portal page 100), a check 252 will be made against a database 154 having each of the configured portal customization entries 156. For efficiency the check can be made using a radix tree, a Patricia trie/tree, or a crit bit tree search 158. Preferably the check will be a Patricia tree; however any suitable search structure can be used. If there is a match, a portal customization resource 182 will be used. The request will be serviced by the host 150 on the VPN device 10. It can be appreciated that in the userland section, the mismatch between the URL format and the actual path that files are stored, is configured to remove the need for the developer to know the specific directory information on the VPN device 10. However, in order to allow the host 150, to find the file, the Security Manager 182 will modify the URL 164 just before it services the request.
When the Security Manager 182 receives the response, it will check if the response was for portal customization content. If so, and if the content-type of the response is one that allows portal customization tags 120 (for example, images would not contain any tags), it will pass the content to the portal customization module. The portal customization module will then parse the content for portal customization tags 120, and when found, replace 256 the tags 120 with actual content. It can be appreciated that in a preferred embodiment, no portal customization tags 120 will be left in the final response data. In order to support the new portal customization tags 120, two additional state tables 132 can be added to the kernel 180 parsers, one for tags (pc_tag) 134 and one for attributes (pc_attr) 136.
The tag replacement will preferably be done in a memory optimal way. However, it can be appreciated that any suitable replacement method can be used. In use, when a portal customization tag 120 is found, the content will be split 254 at the start of the tag 120. The tag 120 will then be parsed, and the content split again at the end of the tag. The appropriate function will be called to generate the tag content 122. At this point there will be four content pieces: pre-tag, tag, post tag, and tag content 122. The tag piece will be freed. The pre-tag, tag content 122, and post-tag pieces will be joined together, and parsing will continue with the first byte of the post-tag piece. Several functions can be added to support the generation of each specific tag. In addition, it can be appreciated that where possible these functions will mirror or reuse existing function. The custom portal page 100 is then send 258 to the client 50, wherein the content tags 110 and the customization tags 120 generate a portal theme when served to the client 50.
It can be appreciated that in accordance with one embodiment, the following commands can be added to a shell site:
[no] portal theme create<theme name>
Create a new portal theme or delete an existing theme and all imported content.
show portal theme create
Display a list of configured portal themes.
portal theme object<keyword><theme name><object name><URL><filetype>
The list of valid page identifiers for <keyword> is:
The list of valid filetypes for <filetype> is: html, css, js, htc, xml, text, and binary.
It should be appreciated that in accordance with one embodiment, <theme name> and <object name> should be at most 20 characters long, and should only contain ASCII characters a-z, A-Z, 0-9, ., -, and _. All other characters are preferably restricted.
Any portal page not assigned a custom object will remain the default page.
show portal theme object <theme name>[object name]
Display a list of resources imported for theme <theme name>. If the [object name] is given, resource embedded within that object will be displayed along with their file sizes.
portal theme assign <keyword><theme name><object name>
Reassign object <object name> from its current portal page to the new page <keyword>.
[no|show] portal theme active
Display or remove the currently active theme from the virtual site.
portal theme import <url> [theme name]
Import a prepackaged theme from <url>. If no [theme name] is given, the filename of the package file minus the file extension (if any) will be used as the theme name. The package file must be a ZIP format archive. It must have at its base level a file named “index.txt” which must list all theme object resources included in the theme. The format for this listing will be multiple lines consisting of:
For example, the following HTML tags are supported:
<_AN_web_links>
Purpose: The ACL filtered list of configured portal link entries.
Attributes: All options are optional and may be omitted.
rows=“#” or cols=“#”: How many rows or columns to organize the links into. Only one
can be specified. The default portal page is equivalent to cols=“2”.
class=“class”: Specify a style sheet class for the links.
bullet=“url”: Specify an image to use as a bullet icon.
denied=“text”: Specify text to be used if no links are configured or permitted.
<_AN_fileshare_links>
Purpose: The list of configured fileshare entries.
Attributes: All options are optional and may be omitted.
rows=“#” or cols=“#”: How many rows or columns to organize the links into. Only one can be specified. The default portal page is equivalent to cols=“2”.
class =“class”: Specify a style sheet class for the links.
bullet=“url”: Specify an image to use as a bullet icon.
denied=“text”: Specify test to be used if no links are configured or permitted.
<_AN_tes_links>
Purpose: The ACL filtered list of configured tcs module entries.
Attributes: All options are optional and may be omitted.
rows=“#” or cols=“#”: How many rows or columns to organize the links into. Only one can be specified. The default portal page is equivalent to cols=“2”.
class=“class”: Specify a style sheet class for the links.
bullet=“url”: Specify an image to use as a bullet icon.
denied=“text”: Specify test to be used if no links are configured or permitted.
<_AN_clientapp_list>
Purpose: The ACL filtered list of configured clientapp service entries.
Attributes: All options are optional and may be omitted.
Only one can be specified. The default portal page is equivalent to cols=“2”.
denied=“text”: Specify test to be used if no links are configured or permitted.
<_AN_winredir_list>
Purpose: The ACL filtered list of configured clientapp winredir ip/exe entries.
Attributes: All options are optional and may be omitted.
Only one can be specified. The default portal page is equivalent to cols=“2”.
denied=“text”: Specify test to be used if no links are configured or permitted.
<_AN_fileshare_content>
Purpose: The relevant fileshare content will be inserted. This tag is only valid for the page configured using the keyword “fileshare”.
Attributes: There are no options for this tag.
class=“class”: Specify a style sheet class for the button/input text.
<_AN_browse>
Purpose: The browse input/button from the default portal page, used for browsing to an arbitrary URL through the SP.
Attributes: All options are optional and may be omitted.
<_AN_clientapp_applet>
Purpose: The clientapp applet object.
Attributes: There are no options for this tag.
<_AN—13vpn_activex>
Purpose: The L3VPN activex object.
Attributes: There are no options for this tag.
In addition, the following JavaScript tags are supported:
<_AN_web_links_var>
Purpose: An array of ACL filtered web link objects containing the text and url for each link.
<_AN fileshare_links_var>
Purpose: An array of ACL filtered fileshare link objects containing the text and url for each link.
<_AN_tcs_links_var>
Purpose: An array of ACL filtered tcs link objects containing the text and url for each link.
<_AN_clientapp_list_var>
Purpose: An array of ACL filtered clientapp service entries.
<_AN_winredir_list_var>
Purpose: An array of ACL filtered clientapp winredir ip/exe entries.
<_AN_clientapp_launch_script>
Purpose: The required JavaScript functions for clientapp operations.
The above are exemplary modes of carrying out the invention and are not intended to be limiting. It will be apparent to those of ordinary skill in the art that modifications thereto can be made without departure from the spirit and scope of the invention as set forth in the following claims.
