May 2nd, 2007

What is a SSL Proxy ?1


A growing subset of Web traffic uses HTTPS to create an encrypted tunnel. Regulations often require all Intranet and ASP applications handling sensitive data to use encryption. Traditional (HTTP) proxies can not cache encrypted traffic; hence provide no acceleration, control or bandwidth savings for SSL applications.

HTTPS Proxies are specifically designed to decrypt, apply policy, cache and re-encrypt SSL traffic. As a result, HTTPS Proxies can transparently monitor, control and accelerate SSL traffic. An HTTPS Proxy can also apply malware scanning and content filtering to inhibit phishing, spyware and computer viruses hiding inside encrypted tunnels.

There are privacy concerns with SSL proxies. In essence, the IT department is conducting a Man-in-the-middle attack, potentially exposing sensitive corporate information, personal online banking information, etc. Countries such as Sweden have very strong privacy laws, which may require the proxy (*) to handle corporate information with different policy than personal traffic. Content filtering can differentiate this traffic. Additional compromise policy options include caching GIF and JPEG objects (which typically are user interface elements and lack confidential data), but exclude from caching HTML and TXT traffic.

Sometimes the term “SSL proxy” also refers to CGI web proxies that are accessible via encrypted SSL connections. In this case, SSL adds an extra layer of security on top of the CGI proxy system, lessening the chance of data interception.

(*) In sweden, privacy laws apply to non-SSL proxies too. PUL (Personuppgiftslagen) doesn’t differ between encrypted and unencrypted data. But as long as no details about the identity of the user is stored or collected, PUL (a Swedish privacy law, see above) dosent apply, and unrestricted scanning of SSL information is allowed, as long as you don’t arrange it in a way that may look like that you are trying to steal bank information. Then its called “preparing to fraud” by swedish law, and is punishable. (Example: Making sure the SSL-proxy only “activates” itself when a specific internetbank URL is accessed will be considered “preparing to fraud”)

What is a Web Proxy ?0


A common proxy application is a caching web proxy. This provides a nearby cache of web pages and files available on remote web servers, allowing local network clients to access them more quickly or reliably.

When it receives a request for a web resource (specified by a URL), a caching proxy looks for the resulting URL in its local cache. If found, it returns the document immediately. Otherwise it fetches it from the remote server, returns it to the requester and saves a copy in the cache. The cache usually uses an expiry algorithm to remove documents from the cache, according to their age, size, and access history. Two simple cache algorithms are Least Recently Used (LRU) and Least Frequently Used (LFU). LRU removes the documents that have been left the longest, while LFU removes the least popular documents. The algorithms can also be combined.

Some censorware applications — which attempt to block offensive web content — are implemented as web proxies. Other web proxies reformat web pages for a specific purpose or audience; for example, Skweezer reformats web pages for cell phones and PDAs. Network operators can also deploy proxies to intercept computer viruses and other hostile content served from remote web pages.

A special case of web proxies are “CGI proxies.” These are web sites which allow a user to access a site through them. They generally use PHP or CGI to implement the proxying functionality. CGI proxies are frequently used to gain access to web sites blocked by corporate or school proxies. Since they also hide the user’s own IP address from the web sites they access through the proxy, they are sometimes also used to gain a degree of anonymity, called “Proxy Avoidance.”

What is a Proxy Server ?0


A proxy server is a computer that offers a computer network service to allow clients to make indirect network connections to other network services. A client connects to the proxy server, then requests a connection, file, or other resource available on a different server. The proxy provides the resource either by connecting to the specified server or by serving it from a cache. In some cases, the proxy may alter the client’s request or the server’s response for various purposes.

A proxy server can also serve as a firewall.

Imhotep theme designed by Chris Lin. Proudly powered by Wordpress.
XHTML | CSS | RSS | Comments RSS