# US 2014/0157361 A1 · Systems and methods for configuration driven rewrite of ssl vpn clientless sessions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157361 A1
- Document ID: US20140157361A1
- Status: Published application
- Kind: A1
- Application number: 14/175,616
- Filed: 2014-02-07
- Published: 2014-06-05
- Earliest claimed: 2008-01-26
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Puneet Agarwal; Srinivasan Thirunarayanan; Vamsi Korrapatti; Prakash Khemani; Rajiv Mirani; Anoop Reddy
- Web page: https://patentgrep.com/patent/US20140157361A1

## CPC

- H04L 63/0272: {Virtual private networks}
- H04L 63/0281: {Proxies}
- H04L 63/105: {Multiple levels of security}
- H04L 63/166: {at the transport layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066)
- H04L 67/563: Data redirection of data network streams
- H04L 67/59: Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present disclosure provides solutions for an enterprise providing services to a variety of clients to enable the client to use the resources provided by the enterprise by modifying URLs received and the URLs from the responses from the servers to the client's requests before forwarding the requests and the responses to the intended destinations. An intermediary may identify an access profile for a clients' request to access a server via a clientless SSL VPN session. The intermediary may detect one or more URLs in content served by the server in response to the request using one or more regular expressions of the access profile. The intermediary may rewrite or modify, responsive to detecting, the one or more detected URLs in accordance with a URL transformation specified by one or more rewrite policies of the access profile. The response with modified URLs may be forwarded to the client.

## Claims

### Claim 1

A method for rewriting by an intermediary content transmitted between a client and a server, the method comprising:
a) identifying, by a device intermediary to a client and a server, an access profile for a request from the client to access content from the server based on applying a rule to content of the request, the access profile including a rewrite policy for rewriting uniform resource locators (URLs) and a plurality of pattern sets comprising regular expressions for finding the URLs to rewrite in different types of content transmitted by the server to the client;
b) finding, by the device, a URL in content in a response of the server to the request by matching a regular expression of one of the plurality of pattern sets to a portion of the content;
c) rewriting, by the device, in accordance with the rewrite policy the URL found in the content; and
d) transmitting, by the device to the client, the response comprising the rewritten URL.

### Claim 2 (depends on 1)

The method of claim 1, wherein (a) further comprises identifying, by the device, the access profile from a plurality of access profiles configured on the device by matching an expression of the rule of the access profile to the content of the request.

### Claim 3 (depends on 1)

The method of claim 1, wherein (a) further comprises identifying, by the device, the access profile configured for a predetermined application, the device determining from the content of the request that the request corresponds to the predetermined application.

### Claim 4 (depends on 1)

The method of claim 1, wherein the access profile further includes at least one of a script rewrite policy for rewriting portions of a script in the content or a header rewrite policy for rewriting one or more headers of a protocol of the content.

### Claim 5 (depends on 1)

The method of claim 1, wherein (b) further comprises finding the URL in content comprising Extensible Markup Language (XML) by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in XML.

### Claim 6 (depends on 1)

The method of claim 1, wherein (b) further comprises finding the URL in content comprising JavaScript by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in JavaScript.

### Claim 7 (depends on 1)

The method of claim 1, wherein (b) further comprises finding the URL in content comprising cascading style sheet (CSS) by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in CSS.

### Claim 8 (depends on 1)

The method of claim 1, wherein (b) further comprises finding the URL in content comprising XComponent by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in the XComponent.

### Claim 9 (depends on 1)

The method of claim 1, wherein (c) further comprises rewriting the URL by modifying the URL within the content.

### Claim 10 (depends on 1)

The method of claim 1, wherein (d) further comprises modifying the response to include the rewritten URL instead of the found URL.

### Claim 11

A system for rewriting by an intermediary content transmitted between a client and a server, the system comprising:
a device intermediary to a client and a server;
an access profile configured on the device, the access profile including a rewrite policy for rewriting uniform resource locators (URLs) and a plurality of pattern sets comprising regular expressions for finding the URLs to rewrite in different types of content transmitted by the server to the client
wherein the device is configured to identify the access profile for a request from the client to access content from the server based on applying a rule to content of the request;
wherein the device is configured to find a URL in content in a response of the server to the request by matching a regular expression of one of the plurality of pattern sets to a portion of the content, rewrite the URL found in the content in accordance with the rewrite policy and transmit to the client the response comprising the rewritten URL.

### Claim 12 (depends on 11)

The system of claim 11, wherein the device is further configured to identify the access profile from a plurality of access profiles configured on the device by matching an expression of the rule of the access profile to the content of the request.

### Claim 13 (depends on 11)

The system of claim 11, wherein the device is further configured to identify the access profile configured for a predetermined application, the device configured to determine from the content of the request that the request corresponds to the predetermined application.

### Claim 14 (depends on 11)

The system of claim 11, wherein the access profile further includes at least one of a script rewrite policy for rewriting portions of a script in the content or a header rewrite policy for rewriting one or more headers of a protocol of the content.

### Claim 15 (depends on 11)

The system of claim 11, wherein the device is further configured to find the URL in content comprising Extensible Markup Language (XML) by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in XML.

### Claim 16 (depends on 11)

The system of claim 11, wherein the device is further configured to find the URL in content comprising JavaScript by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in JavaScript.

### Claim 17 (depends on 11)

The system of claim 11, wherein the device is further configured to find the URL in content comprising cascading style sheet (CSS) by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in CSS.

### Claim 18 (depends on 11)

The system of claim 11, wherein the device is further configured to find the URL in content comprising XComponent by matching the regular expression for a pattern set of the plurality of pattern sets of the access profile configured for finding the URL in the XComponent.

### Claim 19 (depends on 11)

The system of claim 11, wherein the device is further configured to rewrite the URL by modifying the URL within the content.

### Claim 20 (depends on 11)

The system of claim 11, wherein the device is further configured to modify the response to include the rewritten URL instead of the found URL.