[미국특허]
Strong SSL proxy authentication with forced SSL renegotiation against a target server
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
H04L-029/06
G06F-021/60
출원번호
US-0052005
(2011-03-18)
등록번호
US-9100370
(2015-08-04)
발명자
/ 주소
Bollay, Benn Sapin
출원인 / 주소
F5 Networks, Inc.
대리인 / 주소
Branch, John W.
인용정보
피인용 횟수 :
0인용 특허 :
98
초록▼
An encrypted session is established between a client device and a target server device when the client device initiates network connections through a proxy device. The client device initiates an encrypted session with the proxy device. Once the encrypted session is established, the client device com
An encrypted session is established between a client device and a target server device when the client device initiates network connections through a proxy device. The client device initiates an encrypted session with the proxy device. Once the encrypted session is established, the client device communicates the address of the target server device to the proxy device. Then, the proxy device sends an encrypted session renegotiation message to the client device. The client device responds to the encrypted session renegotiation message by transmitting an encrypted session handshake message to the proxy device. The proxy device forwards the encrypted session handshake message to the target server device, and continues to forward handshake messages between the client device and the target server device, enabling the client device and the target server device to establish an encrypted session.
대표청구항▼
1. A proxy device interposed between a client device and a plurality of target server devices, comprising: a transceiver to send and receive data over a network; anda processor that is operative to perform actions comprising:establishing a first encrypted session with the client device;receiving a n
1. A proxy device interposed between a client device and a plurality of target server devices, comprising: a transceiver to send and receive data over a network; anda processor that is operative to perform actions comprising:establishing a first encrypted session with the client device;receiving a network identifier of a first target server device;establishing an unencrypted network connection with the first target server device, wherein the proxy device enables communication in the first encrypted session between the client device and the first target server device:sending an encrypted session renegotiation message to the client device in response to determining header information extracted from session communication between the client device and the first target server device includes criteria for a change from the first target server device,decrypting and redirecting a handshake message received from the client device to a second target server device, wherein the handshake message was sent by the client device in response to the encrypted session renegotiation message;replacing the first target server device in the first encrypted session for communication with the client device with a second target server device. 2. The proxy device of claim 1, wherein the actions further comprise forwarding additional handshake messages sent by the client device to the target server device and from the target server device to the client device, to establish a second encrypted session between the client device and the second target server device. 3. The proxy device of claim 1, wherein the actions further comprise: forwarding additional handshake messages sent by the client device to the target server device and from the target server device to the client device, to establish a second encrypted session between the client device and the target server device; andforwarding messages sent over the second encrypted session from the client device to the second target server device and from the second target server device to the client device. 4. The proxy device of claim 1, wherein the proxy device comprises a SOCKS proxy device. 5. The proxy device of claim 1, wherein the proxy device comprises an HTTP proxy device, and wherein the first encrypted session is created in response to receiving an HTTP request from the client device. 6. The proxy device of claim 1, wherein the first encrypted session is created in response to a request received from the client device. 7. The proxy device of claim 1, wherein the encrypted session renegotiation message includes an “SSL HELLO REQUEST” message and the handshake message received from the client device includes a “CLIENT HELLO” message. 8. A system comprising: a client device: a first target server device: a second target server device: and a proxy device interposed between the client device and the first and the second target devices, wherein the proxy device is configured to perform actions including: establishing a first encrypted session with the client device, wherein the prow device enables communication in the first encrypted session between the client device and the first target server device: receiving a network identifier of the first target server device;establishing an unencrypted network connection with the first target server device;sending an encrypted session renegotiation message to the client device in response to determining header information extracted from session communication between the client device and the first target server device includes criteria for a change from the first target server device,decrypting and redirecting a handshake message received from the client device to a second target server device, wherein the handshake message was sent by the client device in response to the encrypted session renegotiation message;replacing the first target server device in the first encrypted session for communication with the client device with a second target server device. 9. The system of claim 8, wherein the actions further comprise: forwarding, additional handshake messages sent by the client device to the second target server device and from the second target server device to the client device, to establish a second encrypted session between the client device and the second target server device; andforwarding messages sent over the second encrypted session from the client device to the second target server device and from the second target server device to the client device. 10. The system of claim 8, wherein the proxy device comprises a SOCKS proxy device. 11. The system of claim 8, wherein the proxy device comprises an HTTP proxy device, and wherein the first encrypted session is created in response to receiving an HTTP request from the client device. 12. The system of claim 8, wherein the first encrypted session is created in response to a request received from the client device. 13. The system of claim 8, wherein the encrypted session renegotiation message includes an “SSL HELLO REQUEST” message and the handshake message received from the client device includes a “CLIENT HELLO” message. 14. A non-transitory processor readable storage medium storing processor readable instructions that when executed by a processor perform actions comprising: establishing a first encrypted session with a client device: receiving a network identifier of a first target server device; establishing a first unencrypted network connection with the first target server device wherein the prow device enables communication in the first encrypted session between the client device and the first target server device:sending an encrypted session renegotiation message to the client device in response to determining header information extracted from session communication between the client device and the first target server device includes criteria for a change from the first target server device,decrypting and redirecting a handshake message received from the client device to a second target server device, wherein the handshake message was sent by the client device in response to the encrypted session renegotiation message;replacing the first target server device in the first encrypted session for communication with the client device with a second target server device. 15. The processor readable storage medium of claim 14, wherein the actions further comprise forwarding additional handshake messages sent by the client device to the second target server device and from the second target server device to the client device, to establish a second encrypted session between the client device and the second target server device. 16. The processor readable storage medium of claim 14, wherein the actions further comprise: forwarding additional handshake messages sent by the client device to the second target server device and from the second target server device to the client device, to establish a second encrypted session between the client device and the second target server device; andforwarding messages sent over the second encrypted session from the client device to the second target server device and from the target server device to the client device. 17. The processor readable storage medium of claim 14, wherein the proxy device comprises a SOCKS proxy device. 18. The processor readable storage medium of claim 14 wherein the proxy device comprises an HTTP proxy device, and wherein the first encrypted session is created in response to receiving an HTTP request from the client device. 19. The processor readable storage medium of claim 14, wherein the first encrypted session is created in response to a request received from the client device. 20. The system of claim 8, wherein the proxy device is further configured to establish the first encrypted session between the client device and the first target server device such that the first target server device is an endpoint of the first encrypted session, and wherein the proxy device is configured to employ forwarding the handshake message received from the client device to the second target service device to replace the first target server device with the second target service device as the endpoint of the first encrypted session. 21. the proxy device of claim 1, wherein the a criteria for a change from the first target server device comprises type of data requested by the client device, a periodic schedule, a system upgrade of the server device, network traffic type, network topology, capacity of a server device, and/or a request by an administrator. 22. the system of claim 8, the a criteria for a change from the first target server device comprises type of data requested by the client device, a periodic schedule, a system upgrade of the server device, network traffic type, network topology, capacity of a server device, and/or a request by an administrator. 23. the non-transitory processor readable storage medium of claim 14, the a criteria for a change from the first target server device comprises type of data requested by the client device, a periodic schedule, a system upgrade of the server device, network traffic type, network topology, capacity of a server device, and/or a request by an administrator.
Mark Charles Davis ; David G. Kuehr-McLaren ; Timothy Glenn Shoriak, Extending SSL to a multi-tier environment using delegation of authentication and authority.
Zimmerman, Gary D.; Skaggs, Terrence L.; Wiley, Anthony J.; McBride, Brian W.; Banks, David, Initiation of communication between network service system and customer-premises equipment.
Ilnicki, Slawomir K.; Rice, James P., Method and apparatus for allowing a secure and transparent communication between a user device and servers of a data access network system via a firewall and a gateway.
Crichton Joseph M. ; Garvin Peter F. ; Staten Jeffrey W. ; Wright Waiki L., Method and apparatus for lightweight secure communication tunneling over the internet.
Aziz, Ashar; Baehr, Geoffrey; Caronni, Germano; Gupta, Amit; Gupta, Vipul; Scott, Glenn C., Method and apparatus for providing secure communication with a relay in a network.
Bobde, Nikhil; Demirtjis, Ann; Han, Mu, Method and system for integrating security mechanisms into session initiation protocol request messages for client-proxy authentication.
Boyle John ; Holden James M. ; Levin Stephen E. ; Maiwald Eric S. ; Nickel James O. ; Snow David Wayne ; Wrench ; Jr. Edwin H., Method for establishing trust in a computer network via association.
Cooper, Nathaniel; Hodecker, Steven; Yeager, Douglas, Method of authentication processing during a single sign on transaction via a content transform proxy service.
Lownsbrough,Derek Leigh, Methods, apparatuses and systems for transparently intermediating network traffic over connection-based authentication protocols.
Baskey, Michael Edward; Hahn, Timothy James; Kandlur, Dilip Dinkar; Kuehr-McLaren, David Gerard, Methods, systems and computer program products for enhanced security identity utilizing an SSL proxy.
Lin David Dah-Haur ; Shaheen Amal Ahmed ; Yellepeddy Krishna Kishore, Multiple remote data access security mechanism for multitiered internet computer networks.
Yamaguchi,Kensaku; Nakakita,Hideaki; Hashimoto,Mikio, Radio network system using multiple authentication servers with consistently maintained information.
Little, Herbert A.; Janhunen, Stefan E.; Hobbs, Dale J., System and method for supporting multiple certificate status providers on a mobile communication device.
Norman,Stuart; Halasz,David E., System and method of controlling access by a wireless client to a network that utilizes a challenge/handshake authentication protocol.
malik Sohail ; Muresan Michael, System, method, and computer program for communicating a key recovery block to enable third party monitoring without modification to the intended receiver.
Panasyuk,Anatoliy; Kramer,Andre; Pedersen,Bradley Jay; Stone,David Sean; Treder,Terry, Systems and methods for maintaining a session between a client and host service.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.