[미국특허]
Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
H04L-029/06
G06F-021/60
출원번호
US-0846778
(2010-07-29)
등록번호
US-8700892
(2014-04-15)
발명자
/ 주소
Bollay, Benn Sapin
Hawthorne, Jonathan Mini
출원인 / 주소
F5 Networks, Inc.
대리인 / 주소
Frommer Lawrence & Haug LLP
인용정보
피인용 횟수 :
33인용 특허 :
93
초록▼
A traffic management device (TMD), system, and processor-readable storage medium are directed to determining that an end-to-end encrypted session has been established between a client and an authentication server, intercepting and decrypting subsequent task traffic from the client, and forwarding th
A traffic management device (TMD), system, and processor-readable storage medium are directed to determining that an end-to-end encrypted session has been established between a client and an authentication server, intercepting and decrypting subsequent task traffic from the client, and forwarding the intercepted traffic toward a server. In some embodiments, a second connection between the TMD and server may be employed to forward the intercepted traffic, and the second connection may be unencrypted or encrypted with a different mechanism than the encrypted connection to the authentication server. The encrypted connection to the authentication server may be maintained following authentication to enable termination of the second connection if the client becomes untrusted, and/or to enable logging of client requests, connection information, and the like. In some embodiments, the TMD may act as a proxy to provide client access to a number of servers and/or resources.
대표청구항▼
1. A traffic management device for managing network traffic between a client device and a plurality of server devices, comprising: a transceiver to send and receive data over a network; anda processor, in communication with the transceiver, that performs actions, including: obtaining a key associate
1. A traffic management device for managing network traffic between a client device and a plurality of server devices, comprising: a transceiver to send and receive data over a network; anda processor, in communication with the transceiver, that performs actions, including: obtaining a key associated with an encrypted first connection between the client device and an authentication server device, wherein the encrypted first connection is established using a two-way authentication between the client device and the authentication server device;intercepting a message sent from the client device toward the authentication server device over the encrypted first connection;performing an analysis of the intercepted message based on the key; andselectively forwarding the intercepted message toward a determined server device based on the analysis, using a second connection between the traffic management device and the determined server device that is separate from communication with the authentication server device, while the encrypted first connection is actively maintained between the client device and the authentication server device. 2. The traffic management device of claim 1, wherein the analysis of the intercepted message includes decrypting the intercepted message using one or more connection keys derived from the key. 3. The traffic management device of claim 1, wherein the actions further include: receiving from the authentication server device a token identifying the client device as authenticated by the two-way authentication; andproviding the token in the intercepted message forwarded to the determined server device. 4. The traffic management device of claim 1, wherein the actions further include: suspending the forwarding of the intercepted message to the determined server device, in response to receiving a request for a renegotiation of the encrypted first connection between the client device and the authentication server device; andresuming the forwarding of the intercepted message to the determined server device, in response to receiving an indication of a completion of the renegotiation. 5. The traffic management device of claim 1, wherein forwarding the intercepted message to the determined server device further includes encrypting the intercepted message prior to forwarding. 6. The traffic management device of claim 1, wherein the actions further include forwarding the intercepted message to the authentication server device, to enable the authentication server device to log at least some information included in the intercepted message. 7. The traffic management device of claim 1, wherein the actions further comprise: receiving from the determined server device a response message to the forwarded intercepted message;encrypting the response message based on the key; andforwarding the encrypted response message to the client device, using the encrypted first connection. 8. A system for managing network traffic, comprising: a plurality of server devices;an authentication server device; anda traffic management device in communication with the plurality of server devices, the authentication server device, and a client device, and configured to perform actions including: obtaining a key associated with an encrypted first connection between the client device and the authentication server device, wherein the encrypted first connection is established using a two-way authentication between the client device and the authentication server device;intercepting a message sent from the client device toward the authentication server device over the encrypted first connection;performing an analysis of the intercepted message based on the key; andselectively forwarding the intercepted message toward a determined server device based on the analysis, using a second connection between the traffic management device and the determined server device that is separate from communication with the authentication server device, while the encrypted first connection is actively maintained between the client device and the authentication server device. 9. The system of claim 8, wherein the analysis of the intercepted message includes decrypting the intercepted message using one or more connection keys derived from the key, and wherein forwarding the intercepted message to the determined server device further includes re-encrypting the intercepted message prior to forwarding. 10. The system of claim 8, wherein the actions further include: receiving from the authentication server device a token identifying the client device as authenticated by the two-way authentication; andproviding the token in the intercepted message forwarded to the determined server device. 11. The system of claim 8, wherein the actions further include: suspending the forwarding of the intercepted message to the determined server device, in response to receiving a request for a renegotiation of the encrypted first connection between the client device and the authentication server device; andresuming the forwarding of the intercepted message to the determined server device, in response to receiving an indication of a completion of the renegotiation. 12. The system of claim 8, wherein the encrypted first connection is actively maintained between the client device and the authentication server device based on at least one keep alive message. 13. The system of claim 8, wherein the actions further include forwarding the intercepted message to the authentication server device, to enable the authentication server device to log at least some information included in the intercepted message. 14. A processor readable non-transitory storage medium storing instructions that enable a processor to perform actions for managing network traffic between a client device and a plurality of server devices, comprising: obtaining a key associated with an encrypted first connection between the client device and an authentication server device, wherein the encrypted first connection is established using a two-way authentication between the client device and the authentication server device;intercepting a message sent from the client device toward the authentication server device over the encrypted first connection;performing an analysis of the intercepted message based on the key; andselectively forwarding the intercepted message toward a determined server device based on the analysis, using a second connection between the traffic management device and the determined server device that is separate from communication with the authentication server device, while the encrypted first connection is actively maintained between the client device and the authentication server device. 15. The processor readable non-transitory storage medium of claim 14, wherein the actions further comprise: receiving from the determined server device a response message to the forwarded intercepted message;encrypting the response message based on the key; andforwarding the encrypted response message to the client device, using the encrypted first connection. 16. The processor readable non-transitory storage medium of claim 14, wherein the actions further include: suspending the forwarding of the intercepted message to the determined server device, in response to receiving a request for a renegotiation of the encrypted first connection between the client device and the authentication server device; andresuming the forwarding of the intercepted message to the determined server device, in response to receiving an indication of a completion of the renegotiation. 17. The processor readable non-transitory storage medium of claim 14, wherein forwarding the intercepted message to the at least one server device further includes encrypting the intercepted message prior to forwarding. 18. The processor readable non-transitory storage medium of claim 14, wherein the actions further include forwarding the intercepted message to the authentication server device, to enable the authentication server device to log at least some information included in the intercepted message. 19. The processor readable non-transitory storage medium of claim 14, wherein the message sent from the client device includes a request for a particular resource available from the determined server device. 20. The processor readable non-transitory storage medium of claim 14, wherein the message sent from the client device includes a request for access to a plurality of servers that include the determined server device.
Mark Charles Davis ; David G. Kuehr-McLaren ; Timothy Glenn Shoriak, Extending SSL to a multi-tier environment using delegation of authentication and authority.
Zimmerman, Gary D.; Skaggs, Terrence L.; Wiley, Anthony J.; McBride, Brian W.; Banks, David, Initiation of communication between network service system and customer-premises equipment.
Ilnicki, Slawomir K.; Rice, James P., Method and apparatus for allowing a secure and transparent communication between a user device and servers of a data access network system via a firewall and a gateway.
Crichton Joseph M. ; Garvin Peter F. ; Staten Jeffrey W. ; Wright Waiki L., Method and apparatus for lightweight secure communication tunneling over the internet.
Aziz, Ashar; Baehr, Geoffrey; Caronni, Germano; Gupta, Amit; Gupta, Vipul; Scott, Glenn C., Method and apparatus for providing secure communication with a relay in a network.
Bobde, Nikhil; Demirtjis, Ann; Han, Mu, Method and system for integrating security mechanisms into session initiation protocol request messages for client-proxy authentication.
Boyle John ; Holden James M. ; Levin Stephen E. ; Maiwald Eric S. ; Nickel James O. ; Snow David Wayne ; Wrench ; Jr. Edwin H., Method for establishing trust in a computer network via association.
Cooper, Nathaniel; Hodecker, Steven; Yeager, Douglas, Method of authentication processing during a single sign on transaction via a content transform proxy service.
Lownsbrough,Derek Leigh, Methods, apparatuses and systems for transparently intermediating network traffic over connection-based authentication protocols.
Baskey, Michael Edward; Hahn, Timothy James; Kandlur, Dilip Dinkar; Kuehr-McLaren, David Gerard, Methods, systems and computer program products for enhanced security identity utilizing an SSL proxy.
Lin David Dah-Haur ; Shaheen Amal Ahmed ; Yellepeddy Krishna Kishore, Multiple remote data access security mechanism for multitiered internet computer networks.
Yamaguchi,Kensaku; Nakakita,Hideaki; Hashimoto,Mikio, Radio network system using multiple authentication servers with consistently maintained information.
Little, Herbert A.; Janhunen, Stefan E.; Hobbs, Dale J., System and method for supporting multiple certificate status providers on a mobile communication device.
Norman,Stuart; Halasz,David E., System and method of controlling access by a wireless client to a network that utilizes a challenge/handshake authentication protocol.
malik Sohail ; Muresan Michael, System, method, and computer program for communicating a key recovery block to enable third party monitoring without modification to the intended receiver.
Panasyuk,Anatoliy; Kramer,Andre; Pedersen,Bradley Jay; Stone,David Sean; Treder,Terry, Systems and methods for maintaining a session between a client and host service.
Qian, Gaoqiang; Lonial, Sumit; Ahmed, Zahid N, Method and apparatus for providing key management for data encryption for cloud-based big data environments.
Duminuco, Alessandro; Bosch, Hendrikus G. P.; Kumar, Surendra M.; La Roche, Humberto J.; Napper, Jeffrey; Shatzkamer, Kevin D.; Wing, Daniel G., Method, system, and logic for in-band exchange of meta-information.
Duminuco, Alessandro; Bosch, Hendrikus G. P.; Kumar, Surendra M.; La Roche, Humberto J.; Napper, Jeffrey; Shatzkamer, Kevin D.; Wing, Daniel G., Method, system, and logic for in-band exchange of meta-information.
Duminuco, Alessandro; Bosch, Hendrikus G. P.; Kumar, Surendra M.; La Roche, Humberto J.; Napper, Jeffrey; Shatzkamer, Kevin D.; Wing, Daniel G., Method, system, and logic for in-band exchange of meta-information.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Philippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Phillippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Pahl, Sébastien Andreas Henry; Tourne, Matthieu Phillippe François; Sikora, Piotr; Bejjani, Ray Raymond; Knecht, Dane Orion; Prince, Matthew Browning; Graham-Cumming, John; Holloway, Lee Hahn; Sullivan, Nicholas Thomas; Strasheim, Albertus, Secure session capability using public-key cryptography without access to the private key.
Kumar, Surendra M.; Bagepalli, Nagaraj A.; Patra, Abhijit; Quinn, Paul; Guichard, James N.; Bosch, Hendrikus G. P., Service node originated service chains in a network environment.
Reddy, K. Tirumaleswar; Pignataro, Carlos M.; Guichard, James; Wing, Daniel G.; Geller, Michael D., Steering of cloned traffic in a service function chain.
Bosch, Hendrikus G. P.; Campbell, Ian McDowell; La Roche, Humberto J.; Guichard, James N.; Kumar, Surendra M.; Quinn, Paul; Duminuco, Alessandro; Napper, Jeffrey; Shekhar, Ravi, System and method for transporting information to services in a network environment.
Bosch, Hendrikus G. P.; Campbell, Ian McDowell; La Roche, Humberto J.; Guichard, James N.; Kumar, Surendra M.; Quinn, Paul; Duminuco, Alessandro; Napper, Jeffrey; Shekhar, Ravi, System and method for transporting information to services in a network environment.
Batz, Robert M.; Campbell, Ian McDowell; Bosch, Hendrikus G. P., System and method to facilitate the assignment of service functions for service chains in a network environment.
Batz, Robert M.; Campbell, Ian McDowell; Bosch, Hendrikus G. P., System and method to facilitate the assignment of service functions for service chains in a network environment.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.