# US 8,543,805 B2 · Systems and methods for split proxying of SSL via WAN appliances > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,805 B2 - Document ID: US8543805B2 - Status: Granted - Kind: B2 - Application number: 12/764,633 - Filed: 2010-04-21 - Published: 2011-10-27 - Granted: 2013-09-24 - Earliest claimed: 2010-04-21 - Assignees: Citrix Systems, Inc. - Applicants: Michael Ovsiannikov - Inventors: Michael Ovsiannikov - Web page: https://patentgrep.com/patent/US8543805B2 ## CPC - H04L 63/168: {above the transport layer} - H04L 63/0281: {Proxies} - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - H04L 63/166: {at the transport layer} - H04L 67/2876: Pairs of inter-processing entities at each side of the network, e.g. split proxies - H04L 67/565: Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561) - H04L 67/5651: Reducing the amount or size of exchanged application data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention is directed towards systems and methods for split proxying Secure Socket Layer (SSL) communications via intermediaries deployed between a client and a server. The method includes establishing, by a server-side intermediary, a SSL session with a server. A client-side intermediary may establish a second SSL session with a client using SSL configuration information received from the server-side intermediary. Both intermediaries may communicate via a third SSL session. The server-side intermediary may decrypt data received from the server using the first SSL session's session key. The server-side intermediary may transmit to the client-side intermediary, via the third SSL session, data encrypted using the third SSL session's session key. The client-side intermediary may decrypt the encrypted data using the third SSL session's session key. The client-side intermediary may transmit to the client the data encrypted using the second SSL session's session key. ## Claims ### Claim 1 A method for split proxying Secure Socket Layer (SSL) communications across intermediaries deployed between a client and a server, the method comprising: a) establishing, by a first intermediary device in communication with a server, a first Secure Socket Layer (SSL) session with the server; b) establishing, by a second intermediary device in communication with one or more clients, a second Secure Socket Layer (SSL) session with a client using SSL configuration information received from the first intermediary device, the second intermediary device and the first intermediary device communicating via a third SSL session established between the first intermediary device and the second intermediary device; c) decrypting, by the first intermediary device, encrypted data received, via the first SSL session, from the server using a first session key of the first SSL session; d) transmitting, by the first intermediary device to the second intermediary device via the third SSL session, the data encrypted using a third session key of the third SSL session; e) decrypting, by the second intermediary device, the data encrypted via the third SSL session using the third session key; f) transmitting, by the second intermediary device to the client via the second SSL session, the data encrypted using the second session key of the second SSL session; g) receiving by the second intermediary device from the first intermediary device SSL configuration information identifying a type of SSL proxying to be provided by the first intermediary device and the second intermediary device; and h) establishing by the first intermediary device and the second intermediary device the type of SSL proxying. ### Claim 2 (depends on 1) The method of claim 1, wherein step (a) further comprises transmitting, by the second intermediary device to the first intermediary device, a request from the client to establish a transport layer connection with the server, the first intermediary device modifying the request to indicate to the second intermediary device to perform Secure Socket Layer (SSL) acceleration. ### Claim 3 (depends on 1) The method of claim 1, wherein step (b) further comprises transmitting, by the first intermediary device to the second intermediary, device a message identifying SSL configuration for client-side SSL proxying. ### Claim 4 (depends on 3) The method of claim 3, wherein step (b) further comprises transmitting, by the second intermediary device, to the client a server hello, a server certificate and a server hello done message using the SSL configuration received from the first intermediary device. ### Claim 5 (depends on 3) The method of claim 3, wherein step (b) further comprises transmitting, by the first intermediary device to the second intermediary device, a request to perform split SSL proxying. ### Claim 6 (depends on 1) The method of claim 1, further comprising transmitting, by the second intermediary device to the first intermediary device, a request for a crypto operation. ### Claim 7 (depends on 6) The method of claim 6, further comprising performing, by the first intermediary device, the requested crypto operation on behalf of the second intermediary device and communicating to second intermediary device a response to the request. ### Claim 8 (depends on 1) The method of claim 1, wherein step (c) further comprises compressing by the first intermediary device the received data using a compression history stored on the first intermediary device. ### Claim 9 (depends on 1) The method of claim 1, wherein step (e) further comprises decompressing by the second intermediary device the received data using the compression history stored on the second intermediary device. ### Claim 10 (depends on 1) The method of claim 1, further comprising identifying, by the first intermediary device and the second intermediary device, the third SSL session from a pool of pre-established SSL sessions maintained by each of the first intermediary device and the second intermediary device. ### Claim 11 A system for split proxying Secure Socket Layer (SSL) communications across intermediaries deployed between a client and a server, comprising: means for establishing, by a first intermediary device in communication with a server, a first Secure Socket Layer (SSL) session with the server; means for establishing, by a second intermediary device in communication with one or more clients, a second Secure Socket Layer (SSL) session with a client using SSL configuration information received from the first intermediary device, the second intermediary device and the first intermediary device communicating via a third SSL session established between the first intermediary device and the second intermediary device; means for decrypting, by the first intermediary device, encrypted data received, via the first SSL session, from the server using a first session key of the first SSL session; means for transmitting, by the first intermediary device to the second intermediary device via the third SSL session, the data encrypted using a third session key of the third SSL session; means for decrypting, by the second intermediary device, the data encrypted via the third SSL session using the third session key; means for transmitting, by the second intermediary device to the client via the second SSL session, the data encrypted using a second session key of the second SSL session; means for receiving by the second intermediary device from the first intermediary device SSL configuration information identifying a type of SSL proxying to be provided by the first intermediary device and the second intermediary device; and means for establishing by the first intermediary device and the second intermediary device the type of SSL proxying. ### Claim 12 (depends on 1) The system of claim 1, further comprising means for transmitting, by the second intermediary device to the first intermediary device, a request from the client to establish a transport layer connection with the server, the first intermediary device modifying the request to indicate to the second intermediary device to perform Secure Socket Layer (SSL) acceleration. ### Claim 13 (depends on 1) The system of claim 1, further comprising means for transmitting, by the first intermediary device to the second intermediary device, a message identifying SSL configuration for client-side SSL proxying. ### Claim 14 (depends on 3) The system of claim 3, further comprising means for transmitting, by the second intermediary device, to the client a server hello, a server certificate and a server hello done message using the SSL configuration received from the first intermediary device. ### Claim 15 (depends on 3) The system of claim 3, further comprising means for transmitting, by the first intermediary device to the second intermediary device, a request to perform split SSL proxying. ### Claim 16 (depends on 1) The system of claim 1, further comprising means for transmitting, by the second intermediary device to the first intermediary device, a request for a crypto operation. ### Claim 17 (depends on 6) The system of claim 6, further comprising means for performing, by the first intermediary device, the requested crypto operation on behalf of the second intermediary device and communicating to second intermediary a response to the request. ### Claim 18 (depends on 1) The system of claim 1, further comprising means for compressing, by the first intermediary device, the received data using a compression history stored on the first intermediary device. ### Claim 19 (depends on 1) The system of claim 1, further comprising means for decompressing, by the second intermediary device, the received data using the compression history stored on the second intermediary device. ### Claim 20 (depends on 1) The system of claim 1, further comprising means for identifying, by the first intermediary device and the second intermediary device, the third SSL session from a pool of pre-established SSL sessions maintained by each of the first intermediary device and the second intermediary device. ### Claim 21 (depends on 1) The method of claim 1, comprising receiving the SSL configuration information identifying the type of SSL proxying, the type of SSL proxying comprising split proxying or spoofing proxying.