# US 2014/0157358 A1 · Policy Driven Fine Grain URL Encoding Mechanism for SSL VPN Clientless Access

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157358 A1
- Document ID: US20140157358A1
- Status: Published application
- Kind: A1
- Application number: 14/172,385
- Filed: 2014-02-04
- Published: 2014-06-05
- Earliest claimed: 2008-01-26
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Puneet Agarwal; Ravindra Nath Thakur; Anil Kumar Gavini
- Web page: https://patentgrep.com/patent/US20140157358A1

## CPC

- H04L 63/0272: {Virtual private networks}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/105: {Multiple levels of security}
- H04L 63/166: {at the transport layer}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present disclosure presents methods, systems and intermediaries which determine an encoding scheme of a uniform resource location (URL) from a plurality of encoding schemes for a clientless secure socket layer virtual private network (SSL VPN) via a proxy. An intermediary may receive a response from a server comprising a URL. The response from the server may be directed to a client via a SSL VPN session and via the intermediary. The intermediary may determine, responsive to an encoding policy, one of a transparent, opaque or encrypted encoding scheme for encoding the URL. The intermediary may rewrite the URL for transmission to the client in accordance with the determined encoding scheme.

## Claims

### Claim 1

A method for determining an encoding scheme of a uniform resource locator (URL) from a plurality of encoding schemes, the method comprising:
(a) receiving, by a device, a communication from a server, the communication comprising a uniform resource locator (URL);
(b) selecting, by the device, an encoding scheme from a plurality of encoding schemes to modify the URL, each of the plurality of encoding schemes providing a different type of obfuscation of at least a portion of the URL;
(c) modifying, by the device, the URL to obfuscate at least the portion of the URL according to the selected encoding scheme; and
(d) maintaining, by the device, a mapping of the URL to the modified URL.

### Claim 2 (depends on 1)

The method of claim 1, further comprising forwarding, by the device, the communication with the modified URL instead of the URL.

### Claim 3 (depends on 1)

The method of claim 1, further comprising receiving, by the device, a second communication from a client, the second communication comprising the modified URL.

### Claim 4 (depends on 3)

The method of claim 3, further comprising identifying, by the device via the mapping, the URL for the modified URL, modifying the second communication to have the URL instead of the modified URL and forwarding the modified second communication to the server.

### Claim 5 (depends on 1)

The method of claim 1, wherein step (b) further comprises selecting, by the device, the encoding scheme based on applying a policy to the communication.

### Claim 6 (depends on 1)

The method of claim 1, wherein step (b) further comprises selecting, by the device, the encoding scheme for a session between the client and the server.

### Claim 7 (depends on 1)

The method of claim 1, wherein modifying the URL to obfuscate at least the portion of the URL further comprises replacing the portion of the URL with a different URL in accordance with the selected encoding scheme.

### Claim 8 (depends on 1)

The method of claim 1, wherein modifying the URL to obfuscate at least the portion of the URL further comprises encrypting at least the portion of the URL in accordance with the selected encoding scheme.

### Claim 9 (depends on 1)

The method of claim 1, wherein modifying the URL to obfuscate at least the portion of the URL further comprises transforming at least the portion of the URL using a reversible transformation function in accordance with the selected encoding scheme.

### Claim 10 (depends on 1)

The method of claim 1, wherein modifying the URL to obfuscate at least the portion of the URL further comprises rewriting at least the portion of the URL to have a unique identifier generated by the device and in accordance with the selected encoding scheme.

### Claim 11

A system for determining an encoding scheme of a uniform resource locator (URL) from a plurality of encoding schemes, the system comprising:
a device configure to receive a communication from a server, the communication comprising a uniform resource locator (URL);
a plurality of encoding schemes configured on the device, each of the plurality of encoding schemes providing a different type of obfuscation of at least a portion of the URL; and
wherein the device is configured to select an encoding scheme from the plurality of encoding schemes to modify the URL modify, the URL to obfuscate at least the portion of the URL according to the selected encoding scheme, and maintain a mapping of the URL to the modified URL.

### Claim 12 (depends on 11)

The system of claim 11, wherein the device is further configured to forward the communication with the modified URL instead of the URL.

### Claim 13 (depends on 11)

The system of claim 11, wherein the device is further configured to receive a second communication from a client, the second communication comprising the modified URL.

### Claim 14 (depends on 13)

The system of claim 13, wherein the device is further configured to identify, via the mapping, the URL for the modified URL, modify the second communication to have the URL instead of the modified URL and forward the modified second communication to the server.

### Claim 15 (depends on 11)

The system of claim 11, wherein the device is further configured to select the encoding scheme based on applying a policy to the communication.

### Claim 16 (depends on 11)

The system of claim 11, wherein the device is further configured to select the encoding scheme for a session between the client and the server.

### Claim 17 (depends on 11)

The system of claim 11, wherein the device is further configured to modify the URL to obfuscate at least the portion of the URL by replacing the portion of the URL with a different URL in accordance with the selected encoding scheme.

### Claim 18 (depends on 11)

The system of claim 11, wherein the device is further configured to modify the URL to obfuscate at least the portion of the URL by encrypting at least the portion of the URL in accordance with the selected encoding scheme.

### Claim 19 (depends on 11)

The system of claim 11, wherein the device is further configured to modify the URL to obfuscate at least the portion of the URL further by transforming at least the portion of the URL using a reversible transformation function in accordance with the selected encoding scheme.

### Claim 20 (depends on 11)

The system of claim 11, wherein the device is further configured to modify the URL to obfuscate at least the portion of the URL further by rewriting at least the portion of the URL to have a unique identifier generated by the device and in accordance with the selected encoding scheme.