Citrix Systems, Inc.

Juniper Networks, Inc.

Citrix Application Networking, LLC

Junxiao He

Charu Venkatraman

Ajay Soni

Shashi Nanjundaswamy

Anil N Shetty

Sergey Verzunov

Prabakar Sundarrajan

Amarnath Mullick

James Edward Harris

Arkesh Kumar

Josephine Suganthi

Jaspal Kohli

Kumar Narayanan

Shashidhara Mysore Nanjundaswamy

Saravana Annamalaisami

Navaneeth Krishnan Ramaswamy

Nicholas James Stavrakos

Rajiv Sinha

Roy Rajan

Vikram Venkataraghavan

Chris Koopmans

Bharath Bhushan

Mohammed Zubair Visharam

Michael Nishimoto

Kapil Dakhane

Fred Koopmans

Jeff Monks

Arun Kumar Srinivasan

Shashi Nanjundaswami

Prakabar Sundarrajan

A first server may receive, from a client device, an indication of a request for a content file via a network address; identify that the network address is a dynamic network address; establish a communication session with a second; receive a portion of the content file from the second server; determine an index parameter based on receiving the portion of the content file; determine whether the content file is being stored by the first server based on a cache index and based on the index parameter or based on information associated with the request for the content file; receive a remaining portion of the content file based on determining that the content file is not being stored by the first server; and provide the content file to the client device.

Caching objects identified by dynamic resource identifiers

Systems and methods are described for using a client agent operating in a virtual private network environment to intercept HyperText Transfer Protocol (HTTP) communications. Methods include: intercepting at the network layer, by a client agent executing on a client, an HTTP request from an application executing on the client; modifying the HTTP request; and transmitting, via a transport layer connection, the modified HTTP request to a server. Additional methods may comprise adding, removing, or modifying at least one cookie in the HTTP request. Still other methods may comprise modifying at least one name-value pair contained in the HTTP request. Corresponding systems are also described.

Systems and methods for using an HTTP-aware client agent

Systems and methods are described for using a client agent operating in a virtual private network environment to intercept HTTP communications. Methods include: intercepting at the network layer, by a client agent executing on a client, an HTTP request from an application executing on the client; modifying the HTTP request; and transmitting, via a transport layer connection, the modified HTTP request to a server. Additional methods may comprise adding, removing, or modifying at least one cookie in the HTTP request. Still other methods may comprise modifying at least one name-value pair contained in the HTTP request. Corresponding systems are also described.

Systems and methods are described for using a client agent to manage HTTP authentication cookies. One method includes intercepting, by a client agent executing on a client, a connection request from the client; establishing, by the client agent, a transport layer virtual private network connection with a network appliance; transmitting, by the client agent via the established connection, an HTTP request comprising an authentication cookie; and transmitting, by the client agent via the connection, the connection request. A second method includes intercepting, by a client agent executing on a client, an HTTP communication comprising a cookie from an appliance on a virtual private network to the client; removing, by the client agent, the cookie from the HTTP communication; storing, by the client agent, the received cookie; transmitting, by the client agent, the modified HTTP communication to an application executing on the client; intercepting, by the client agent, an HTTP request from the client; inserting, by the client agent in the HTTP request, the received cookie; and transmitting the modified HTTP request to the appliance. Corresponding systems are also described.

Systems and methods for using a client agent to manage HTTP authentication cookies

A method for allowing or denying, by an appliance, access to a resource by an application on a client via a virtual private network connection includes basing the decision to allow or deny access on identification of the application. The appliance intercepts a request from an application on a client on a first network to access via a virtual private network connection a resource on a second network. The appliance identifies the application and associates with the intercepted request an authorization policy based on the identity of the application. The appliance determines, using the authorization policy and the identity of the application, to either allow or deny access by the application to the resource.

Systems and methods for application based interception of SSL/VPN traffic

An appliance and method for authorizing a level of access of a client to a virtual private network connection, based on a client-side attribute includes the step of establishing, by an appliance, a control connection with a client upon receiving a client request to establish a virtual private network connection with a network. The appliance transmits, via the control connection, a request to the client to evaluate at least one clause of a security string, the at least one clause including an expression associated with a client-side attribute. The client transmits, via the control connection, a response to the appliance comprising a result of evaluating the at least one clause by the client. The appliance assigns the client to an authorization group based on the result of evaluation of the at least one clause.

Systems and methods for enhanced client side policy

A network device receives, from a client device, a client request associated with a connection with a server device, where the client request identifies requested content. The network device determines connection information that identifies the connection with the server device, transmits, to a proxy server, a connection transfer request that identifies the connection information and the requested content, and receives, from the proxy server, an indication that the proxy server is capable of providing the requested content. Based on receiving the indication, the network device provides, from the proxy server to the client device, a response to the client request, and provides, from the proxy server and to the server device, information that causes the server device to terminate the connection. The network device may use a connection request transfer protocol to transmit the connection transfer request, and the client request may be an HTTP request.

Connection management using connection request transfer protocol

A method for intercepting, by an agent of a client, communications from the client to be transmitted via a virtual private network connection includes the step of intercepting communications based on identification of an application from which the communication originates. The agent receives information identifying a first application. The agent determines a network communication transmitted by the client originates from the first application and intercepts that communication. The agent transmits the intercepted communication via the virtual private network connection.

Systems and methods for application-based interception of SSL/VPN traffic

The present invention is directed towards systems and methods for dynamically deploying and executing acceleration functionality on a client to improve the performance and delivery of remotely accessed applications. In one embodiment, the client-side acceleration functionality is provided by an acceleration program that performs a transport layer connection buffering technique for improving performance of communications and delivery of a remotely-accessed application. The acceleration program establishes a transport layer connection from the client to the server and buffers requests of the client based on determining a difference between a rate of consumption of responses received by the client from a server and a rate of production of requests transmitted by the client to the server. As such, the acceleration program can throttle transmissions of the client if the client's rate of consumption falls behind the rate of submission of requests.

Systems and methods for providing client-side accelerated access to remote applications via TCP buffering

Method and system for authorizing a level of access of a client to a virtual private network connection, based on a client-side attribute

The present invention is directed towards systems and methods for dynamically deploying and executing acceleration functionality on a client to improve the performance and delivery of remotely accessed applications. The acceleration program of the present invention is automatically installed and executed on a client in a manner transparent to and seamless with the operation of the client. An appliance may intercept a request of the client to establish a communication session or connection with a server, and transmit the acceleration program to the client. In some cases, the appliance determines whether the application being accessed by the client can be accelerated and only provides the acceleration program if the application can be accelerated. Upon receipt of the acceleration program, the client automatically performs a silent installation of the acceleration program and executes the acceleration program upon completion of the installation.

Systems and methods for automatic installation and execution of a client-side acceleration program

A method for automatically changing a version of a client agent for a non-administrative user account without rebooting the user's machine uses a service having installation privileges. The service executes on the client and installs a client agent. The client agent communicates with a network appliance. The client agent detects a difference between its version and a version of the client agent identified by the network appliance. The agent signals the service that it has detected the difference and, in response, the service executes an installation program that installs, without rebooting the client, the version of the client agent identified by the appliance. A corresponding system is also described.

Systems and methods of installing an application without rebooting

Growing community of inventors

Saratoga, CA, United States of America

Junxiao He