[미국특허]
Aggressive rehandshakes on unknown session identifiers for split SSL
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
G06F-021/00
H04L-029/06
H04L-029/08
G06F-021/60
출원번호
US-0848096
(2010-07-30)
등록번호
US-9210131
(2015-12-08)
발명자
/ 주소
Bollay, Benn Sapin
Hammersmark, Erick Nils
출원인 / 주소
F5 Networks, Inc.
대리인 / 주소
Branch, John W.
인용정보
피인용 횟수 :
0인용 특허 :
100
초록▼
A traffic management device (TMD), system, and processor-readable storage medium are directed to monitoring an encrypted session between a client and a server, determining that the session identifier is unknown, and requesting a renegotiation of the session to acquire a session identifier for the re
A traffic management device (TMD), system, and processor-readable storage medium are directed to monitoring an encrypted session between a client and a server, determining that the session identifier is unknown, and requesting a renegotiation of the session to acquire a session identifier for the renegotiated session. Determination that the session identifier is unknown may be based on interception and analysis of handshake messages sent by the client and/or the server. Following such determination, a renegotiation of the encrypted session may be triggered by sending a renegotiation request to the client, and a session identifier for the renegotiated session may be determined based on information extracted from subsequent handshake messages exchanged between the client and server during the renegotiation. Determination of the session identifier may enable decryption, encryption and modification of subsequent communications traffic, for example insertion of third party content into traffic sent to the client.
대표청구항▼
1. A traffic management device for managing network traffic between a client device and a server device, comprising: a transceiver to send and receive data over a network; anda processor processing device that is operative to perform actions comprising: determining that the traffic management device
1. A traffic management device for managing network traffic between a client device and a server device, comprising: a transceiver to send and receive data over a network; anda processor processing device that is operative to perform actions comprising: determining that the traffic management device is not in possession of a first session identifier included in an intercepted first handshake message sent to establish a first encrypted session between the client device and the server device;creating and transmitting toward the client device a second handshake message to establish the first encrypted session between the client device and the traffic management device instead of between the client device and the server device, the first encrypted session being identified by the first session identifier;transmitting a session renegotiation request towards the client device over the first encrypted session, wherein the session renegotiation request is directed to establishing a second encrypted session between the client device and the server device;monitoring a session renegotiation for establishing the second encrypted session between the client device and the server device in response to the session renegotiation request being transmitted from the traffic management device to the client device;determining a second session identifier that identifies the second encrypted session based at least on the monitored session renegotiation between the client device and the server device, wherein the second session identifier is different from the first session identifier, wherein the traffic management device is enabled to employ the second session identifier in part to decrypt content sent between the client device and the server device over the second encrypted session;employing a third party server device to provide additional content that is to be subsequently inserted by the traffic management device into decrypted content sent from the server device to the client device, wherein the additional content is stored by the traffic management device prior to insertion into decrypted content; andemploying the traffic management device to determine when to insert the stored additional content into one or more pages of the decrypted content based on one or more criteria. 2. The traffic management device of claim 1, wherein determining that the traffic management device is not in possession of the first session identifier is based on an analysis of information in the intercepted first handshake message. 3. The traffic management device of claim 1, wherein the actions further comprise: forwarding the first handshake message toward the server device; andintercepting a third handshake message sent by the server device toward the client device in response to the first handshake message, wherein the third handshake message includes the first session identifier, andwherein determining that the traffic management device is not in possession of the first session identifier is based on an analysis of information in the intercepted third handshake message. 4. The traffic management device of claim 1, wherein the first encrypted session is a first SSL session, and the second encrypted session is a second SSL session. 5. The traffic management device of claim 1, wherein determining the second session identifier further includes intercepting a set of renegotiation handshake messages sent between the client device and the server device during the monitored session renegotiation, and determining the second session identifier based on an analysis of the intercepted set of renegotiation handshake messages. 6. The traffic management device of claim 1, wherein the actions further comprise employing the second session identifier in part to decrypt and modify a communication between the client device and the server device over the second encrypted session. 7. A non-transitory processor readable storage medium that stores instructions to enable actions for managing network traffic between a client device and a server device, comprising: determining that a traffic management device is not in possession of a first session identifier included in an intercepted first handshake message to establish a first encrypted session between the client device and the server device;creating and transmitting toward the client device a second handshake message to establish the first encrypted session between the client device and the traffic management device instead of between the client device and the server device, the first encrypted session being identified by the first session identifier;transmitting a session renegotiation request toward the client device over the first encrypted session, wherein the session renegotiation request is directed to establishing a second encrypted session between the client device and the server device;monitoring a session renegotiation for establishing the second encrypted session between the client device and the server device in response to the session renegotiation request being transmitted from the traffic management device to the client device;determining a second session identifier that identifies the second encrypted session based at least on the monitored session renegotiation between the client device and the server device, wherein the second session identifier is different from the first session identifier, wherein the traffic management device is enabled to employ the second session identifier in part to decrypt content sent between the client device and the server device over the second encrypted session;employing a third party server device to provide additional content that is to be subsequently inserted by the traffic management device into decrypted content sent from the server device to the client device, wherein the additional content is stored by the traffic management device prior to insertion into decrypted content; andemploying the traffic management device to determine when to insert the stored additional content into one or more pages of the decrypted content based on one or more criteria. 8. The non-transitory processor readable storage medium of claim 7, wherein the actions further comprise employing the second session identifier to decrypt and modify communications traffic between the client device and the server device over the second encrypted session. 9. The non-transitory processor readable storage medium of claim 8, wherein the modification of communications traffic includes compression of the communications traffic. 10. The non-transitory processor readable storage medium of claim 8, wherein the modification of communications traffic includes insertion of content into the communications traffic. 11. The non-transitory processor readable storage medium of claim 7, wherein determining that the traffic management device is not in possession of the first session identifier is based on an analysis of information in the intercepted first handshake message. 12. The non-transitory processor readable storage medium of claim 7, wherein the actions further comprise: forwarding the first handshake message toward the server device; andintercepting a third handshake message sent by the server device toward the client device in response to the first handshake message, wherein the third handshake message includes the first session identifier; andwherein determining that the traffic management device is not in possession of the first session identifier is based on an analysis of information in the intercepted third handshake message. 13. The non-transitory processor readable storage medium of claim 7, wherein the first encrypted session is a first SSL session, and the second encrypted session is a second SSL session. 14. The system for managing network traffic between a client device and a server device, comprising: the server device; anda traffic management device in communication with the client device and the server device, comprising a processing device configured to perform actions including: determining that the traffic management device is not in possession of a first session identifier included in an intercepted first handshake message to establish a first encrypted session between the client device and the server device;creating and transmitting toward the client device a second handshake message to establish the first encrypted session between the client device and the traffic management device instead of between the client device and the server device, the first encrypted session being identified by the first session identifier;transmitting a session renegotiation request toward the client device over the first encrypted session, wherein the session renegotiation request is directed to establishing a second encrypted session between the client device and the server device;monitoring a session renegotiation for establishing the second encrypted session between the client device and the server device in response to the session renegotiation request being transmitted from the traffic management device to the client device;determining a second session identifier that identifies the second encrypted session based at least on the monitored session renegotiation between the client device and the server device, wherein the second session identifier is different from the first session identifier, wherein the traffic management device is enabled to employ the second session identifier in part to decrypt content sent between the client device and the server device over the second encrypted session;employing a third party server device to provide additional content that is to be subsequently inserted by the traffic management device into decrypted content sent from the server device to the client device, wherein the additional content is stored by the traffic management device prior to insertion into decrypted content; andemploying the traffic management device to determine when to insert the stored additional content into one or more pages of the decrypted content based on one or more criteria. 15. The system of claim 14, wherein determining that the traffic management device is not in possession of the first session identifier is based on an analysis of information in the intercepted first handshake message. 16. The system of claim 14, wherein the actions further comprise: forwarding the first handshake message toward the server device; andintercepting a third handshake message sent by the server device toward the client device in response to the first handshake message, wherein the third handshake message includes the first session identifier; andwherein determining that the traffic management device is not in possession of the first session identifier is based on an analysis of information in the intercepted third handshake message. 17. The system of claim 14, wherein the actions further comprise employing the second session identifier to decrypt and modify communications traffic between the client device and the server device over the second encrypted session. 18. The system of claim 17, wherein the modification of communications traffic includes compression of the communications traffic. 19. The system of claim 17, wherein the modification of communications traffic includes insertion of third party content into the communications traffic. 20. The system of claim 14, wherein determining the second session identifier further includes intercepting a set of renegotiation handshake messages sent between the client device and the server device during the monitored session renegotiation, and determining the second session identifier based on an analysis of the intercepted set of renegotiation handshake messages.
Mark Charles Davis ; David G. Kuehr-McLaren ; Timothy Glenn Shoriak, Extending SSL to a multi-tier environment using delegation of authentication and authority.
Zimmerman, Gary D.; Skaggs, Terrence L.; Wiley, Anthony J.; McBride, Brian W.; Banks, David, Initiation of communication between network service system and customer-premises equipment.
Ilnicki, Slawomir K.; Rice, James P., Method and apparatus for allowing a secure and transparent communication between a user device and servers of a data access network system via a firewall and a gateway.
Crichton Joseph M. ; Garvin Peter F. ; Staten Jeffrey W. ; Wright Waiki L., Method and apparatus for lightweight secure communication tunneling over the internet.
Aziz, Ashar; Baehr, Geoffrey; Caronni, Germano; Gupta, Amit; Gupta, Vipul; Scott, Glenn C., Method and apparatus for providing secure communication with a relay in a network.
Bobde, Nikhil; Demirtjis, Ann; Han, Mu, Method and system for integrating security mechanisms into session initiation protocol request messages for client-proxy authentication.
Boyle John ; Holden James M. ; Levin Stephen E. ; Maiwald Eric S. ; Nickel James O. ; Snow David Wayne ; Wrench ; Jr. Edwin H., Method for establishing trust in a computer network via association.
Cooper, Nathaniel; Hodecker, Steven; Yeager, Douglas, Method of authentication processing during a single sign on transaction via a content transform proxy service.
Lownsbrough,Derek Leigh, Methods, apparatuses and systems for transparently intermediating network traffic over connection-based authentication protocols.
Baskey, Michael Edward; Hahn, Timothy James; Kandlur, Dilip Dinkar; Kuehr-McLaren, David Gerard, Methods, systems and computer program products for enhanced security identity utilizing an SSL proxy.
Lin David Dah-Haur ; Shaheen Amal Ahmed ; Yellepeddy Krishna Kishore, Multiple remote data access security mechanism for multitiered internet computer networks.
Yamaguchi,Kensaku; Nakakita,Hideaki; Hashimoto,Mikio, Radio network system using multiple authentication servers with consistently maintained information.
Little, Herbert A.; Janhunen, Stefan E.; Hobbs, Dale J., System and method for supporting multiple certificate status providers on a mobile communication device.
Norman,Stuart; Halasz,David E., System and method of controlling access by a wireless client to a network that utilizes a challenge/handshake authentication protocol.
malik Sohail ; Muresan Michael, System, method, and computer program for communicating a key recovery block to enable third party monitoring without modification to the intended receiver.
Panasyuk,Anatoliy; Kramer,Andre; Pedersen,Bradley Jay; Stone,David Sean; Treder,Terry, Systems and methods for maintaining a session between a client and host service.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.