US 8,478,986 B2 · Reducing latency of split-terminated secure communication protocol sessions

Abstract

A method is provided for establishing a split-terminated secure communication connection between a client and a server. A first network intermediary intercepts a secure communication connection request directed from the client to the server. A second intermediary having a digital certificate in the name of the server (and a corresponding private key) acts in place of the server to establish a first secure communication session with the client, during which it receives a secret from the client for generating the session key. The second intermediary supplies the secret and/or the session key to the first intermediary, which allows the first intermediary to establish follow-on secure communication sessions in which the secret is reused. The second intermediary may also supply the first intermediary with a copy of its certificate so that it can respond to new secure communication requests and, yet further, may also supply a copy of the private key.

Claims12

Dependent claims

A method of establishing a split-terminated secure communication connection between a client computing device and a server computing device, the method comprising:

at a client-side intermediary interposed in a communication path between the client and a network coupling the client to the server;
receiving from a server-side intermediary a certificate issued in a name of the server;
intercepting a request from the client for a secure communication connection with the server;
forwarding to the server-side intermediary a client-key exchange message received from the client;
and
establishing a secure client-side communication session between the client and the client-side intermediary;
and
at the server-side intermediary, interposed between the network and the server:
receiving the forwarded client-key-exchange message;
calculating the master secret from a client secret extracted from the client-key exchange message;
transmitting the master secret to the client-side intermediary;
and
establishing a secure server-side communication session with the server;
wherein the split-terminated secure communication connection comprises the secure client-side communication session, the secure server-side communication session and a communication connection between the client-side intermediary and the server-side intermediary;
and
wherein the split-terminated secure communication connection is established with no more than three communications exchanged across the network, the three communications including:
the certificate transmitted from the server-side intermediary to the client-side intermediary;
the client-key exchange message transmitted from the client-side intermediary to the server-side intermediary;
and
the master secret transmitted from the server-side intermediary to the client-side intermediary.

17 more elements

A method of establishing a secure communication channel between a client computing device and a server computing device, the method comprising:

at a client-side intermediary interposed in a communication path between the client and a network separating the client and the server:
receiving from a server-side intermediary a certificate issued in a name of the server, and a corresponding private cryptographic key;
intercepting a request for a secure communication connection directed to the server;
notifying the server-side intermediary of the intercepted request;
during a secure protocol handshaking process with the client, accepting a client-key-exchange message comprising a client secret for generating a key;
decrypting the client secret with the private cryptographic key;
calculating a master secret from the client secret;
and
establishing a secure client-side communication session with the client;
and
at the server-side intermediary, interposed between the network and the server;
receiving the notification of the intercepted request;
and
establishing a secure server-side communication session with the server;
wherein the secure communication channel between the client and the server comprises the secure client-side communication session, the secure server-side communication session and a communication connection between the client-side intermediary and the server-side intermediary;
and
wherein the secure communication channel between the client and the server is established with only one round-trip of communications transiting the network, the round-trip of communications including:
the transmission of the certificate and the private cryptographic key from the server-side intermediary to the client-side intermediary;
and
said notifying of the server-side intermediary, by the client-side intermediary, of the intercepted request.

17 more elements

A system for facilitating a split-terminated secure communication connection between a client computing device and a server computing device, the system comprising:

a server-side intermediary interposed between the server and a network coupling the client and the server, the server-side intermediary comprising:
a certificate issued in a name of the server;
a first processor;
and
a first storage medium storing instructions that, when executed by the first processor, cause the server-side intermediary to perform a method comprising:
transmitting the certificate to a client-side intermediary interposed between the client and the network;
decrypting a client-key-exchange message received from the client-side intermediary, with a private cryptographic key corresponding to the certificate;
calculating a master secret from a client secret extracted from the decrypted client-key-exchange message;
transmitting the master secret to the client-side intermediary;
and
establishing a first secure communication with the server;
and
the client-side intermediary, comprising:
a second processor;
and
a second storage medium storing instructions that, when executed by the second processor, cause the client-side intermediary to perform a method comprising:
intercepting a request from the client for a secure communication connection with the server;
forwarding to the server-side intermediary the client-key-exchange message received from the client;
and
establishing a second secure communication session with the client;
wherein the split-terminated secure communication connection comprises the first communication session, the second secure communication session and a communication connection between the server-side intermediary and the client-side intermediary;
and
wherein the split-terminated secure communication connection is established with no more than three communications exchange across the network, the three communications including:
the certificate transmitted from the server-side intermediary to the client-side intermediary;
the client-key-exchange message transmitted form the client-side intermediary to the server-side intermediary;
and
the master secret transmitted from the server-side intermediary to the client-side intermediary.

24 more elements

A system for facilitating a secure communication channel between a client computing device and a server computing device, the system comprising:

a server-side intermediary interposed between the server and a network separating the client and the server, the server-side intermediary comprising:
a certificate issued in a name of the server;
a first processor;
and
a first storage medium storing instructions that, when executed by the first processor, cause the server-side intermediary to perform a method comprising:
transmitting the certificate and a corresponding private cryptographic key to a client-side intermediary interposed between the client and the network;
and
establishing a first secure communication session with the server in response to a notification from the client-side intermediary;
and
the client-side intermediary, comprising:
a second processor;
and
a second storage medium storing instructions that, when executed by the second processor, cause the client-side intermediary to perform a method comprising:
intercepting a request for a secure client-server communication connection, directed from the client toward the server;
notifying the server-side intermediary of the intercepted request;
decrypting, with the private cryptographic key, a client secret received from the client;
calculating master secret from the client secret;
and
establishing a second secure communication session with the client;
wherein the secure communication channel comprises the first secure communication session, the second secure communication session and a communication connection between the server-side intermediary and the client-side intermediary;
and
wherein the secure communication channel is established with only one round-trip of communications across the network, the round-trip of communications including:
said transmission of the certificate and the private cryptographic key from the server-side intermediary to the client-side intermediary;
and
said notifying of the server-side intermediary, by the client-side intermediary, of the intercepted request.

22 more elements

Dependencies are inferred from the claim text.

Reducing latency of split-terminated secure communication protocol sessions

Life of this patent

Reducing latency of split-terminated secure communication protocol sessions

Life of this patent

Abstract

Claims12