IPC분류정보
| 국가/구분 |
United States(US) Patent
등록
|
| 국제특허분류(IPC7판) |
|
| 출원번호 |
US-0420677
(2006-05-26)
|
| 등록번호 |
US-8782393
(2014-07-15)
|
|
발명자
/ 주소 |
- Rothstein, Jesse Abraham
- Mukerji, Arindum
- Schmitt, David D.
- Hughes, John R.
|
| 출원인 / 주소 |
|
| 대리인 / 주소 |
|
| 인용정보 |
피인용 횟수 :
10 인용 특허 :
93 |
초록
▼
A method, system, and apparatus are directed towards enabling access to payload by a third-party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the
A method, system, and apparatus are directed towards enabling access to payload by a third-party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the SSL handshake messages are routed through the proxy, the proxy may extract data. In addition, one of the client or the server may send another message within, or out-of-band to, the series of SSL handshake message directly to the proxy. The other SSL message may include secret data that the proxy may use to generate a session key for the SSL connection. With the session key, the proxy may receive SSL messages over the SSL connection, modify and/or transpose the payload within the received SSL messages, and/or terminate the SSL connection at the proxy.
대표청구항
▼
1. A system for managing an SSL communication over a network, comprising: a traffic management device (TMD) operative to perform actions comprising: receiving an SSL handshake message from a client device;sending another SSL handshake message to the client device; andestablishing an SSL session with
1. A system for managing an SSL communication over a network, comprising: a traffic management device (TMD) operative to perform actions comprising: receiving an SSL handshake message from a client device;sending another SSL handshake message to the client device; andestablishing an SSL session with the client device based, in part, on the SSL handshake message and other SSL handshake message, wherein the SSL session includes a single SSL session between the TMD and the client device; anda proxy device interposed between the client device and the TMD, the proxy operative to perform actions comprising:receiving the SSL handshake message from the client device, and forwarding the received SSL handshake message to the TMD;extracting data from at least one of the SSL handshake messages between the client device and the TMD, wherein the at least one of the SSL handshake messages is separate from an acknowledgement (ACK) message or a synchronize (SYN) message;receiving the other SSL handshake message from the TMD, and forwarding the received other SSL handshake message to the client device;receiving secret data associated with the SSL session; employing, in part, the secret data to generate a session key associated with the established SSL session;decrypting an SSL message over the SSL session based at least in part on the session key; andperforming on the decrypted SSL message at least one of scanning, auditing, and logging. 2. The system of claim 1, wherein the secret data is sent to the proxy device for use by the proxy device by one of the client device, or the TMD. 3. The system of claim 1, the proxy device further operative to perform actions comprising: sending the secret data to a third-party device to establish a third-party SSL session between the proxy device and the third-party device. 4. A traffic management device (TMD) for use in communicating a secure message over a network, comprising: a transceiver to send and receive data over the network; anda processor that is operative to perform actions comprising: establishing at the TMD an SSL session with a first network device;sending from the TMD to a second network device, other than the first network device, secret data that is associated with the SSL session, wherein the secret data is both extracted from at least one of the SSL handshake messages used to establish the SSL session between the TMD and the first network device and being configured to enable the second network device to generate a session key associated with the SSL session, and wherein the at least one of the SSL handshake messages is separate from an acknowledgement (ACK) message or a synchronize (SYN) message, and wherein the TMD is further configured to load-balance messages from the first network device to at least one of a plurality of server devices;decrypting an SSL message over the SSL session based at least in part on a session key; andperforming on the decrypted SSL message at least one of scanning, auditing, and logging. 5. The TMD of claim 4, wherein the second network device is a proxy device interposed between the TMD and the first network device. 6. The TMD of claim 4, wherein the secret data further comprises at least one of a master secret or a pre-master secret associated with the SSL session. 7. The TMD of claim 4, wherein the secret data is sent to the second network device over a secure channel. 8. A method for managing an SSL connection, the method comprising: establishing the SSL connection between a first network device and a second network device using at least one of SSL handshake messages; andsending to a third network device secret data that is associated with the SSL connection, wherein the secret data is both extracted from at least one of the SSL handshake messages used to establish the SSL connection between the first network device and the second network device and enables the third network device to generate a session key associated with the SSL connection, and wherein the at least one of the SSL handshake messages is an acknowledgement (ACK) message or a synchronize (SYN) message, and wherein a traffic management device (TMD) is configured to load-balance messages from the first network device to at least one of a plurality of server devices; decrypting an SSL message over an SSL session based at least in part on a session key; andperforming on the decrypted SSL message at least one of scanning, auditing, and logging. 9. The method of claim 8, wherein the third network device is a proxy device interposed between the first and the second network devices. 10. The method of claim 8, wherein the secret data further comprises one of a master secret, or a pre-master secret. 11. The method of claim 8, further comprising: if the SSL session is to be reused between the first and the second network devices, using the secret data to establish another SSL connection between the first network device and the second network device. 12. A non-transitory computer readable storage medium configured to include program instructions for performing the method of claim 8.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.