SYSTEMS AND METHODS FOR OPTIMIZING SSL HANDSHAKE PROCESSING

• US 20080046717A1
• Filed: 08/21/2006
• Published: 02/21/2008
• Est. Priority Date: 08/21/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Udupa, Sivaprasad, Kanekar, Tushar
• Granted Patent: US 8,230,214 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method for enabling efficient SSL handshakes through precomputing of handshake messages, the method includes: receiving, by an appliance, a server certificate identifying a server; generating, by the appliance, at least one of: (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message; storing, by the appliance, the generated messages; receiving, by the appliance from a client, an SSL client hello message identifying the server; and transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages. Corresponding systems are also described.

Claims

1. A method for enabling efficient SSL handshakes through precomputing of handshake messages, the method comprising:

(a) receiving, by an appliance, a server certificate identifying a server;

(b) generating, by the appliance, at least one of;

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message;

(c) storing, by the appliance, the generated messages;

(d) receiving, by the appliance from a client, an SSL client hello message identifying the server; and

(e) transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages.

2. The method of claim 1, wherein step (a) comprises receiving, by an appliance providing access to a server, a server certificate identifying the server.

3. The method of claim 1, wherein step (a) comprises receiving, by an appliance providing access to a plurality of servers, a plurality of server certificates, each identifying one of the plurality of servers.

4. The method of claim 1, wherein step (b) comprises generating, by the appliance, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

5. The method of claim 1, wherein step (b) comprises generating, by the appliance for each of a plurality of received server certificates, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

6. The method of claim 1, wherein step (b) comprises generating, by the appliance prior to receiving an SSL client hello message, at least one of:

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

7. The method of claim 1, wherein step (b) comprises generating, by the appliance prior to receiving an SSL client hello message, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

8. The method of claim 1, wherein step (b) comprises generating, by the appliance prior to receiving an SSL client hello message identifying the server, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

9. The method of claim 1, wherein step (f) comprises transmitting, by the appliance to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single transport layer packet.

10. The method of claim 1, wherein step (f) comprises transmitting, by the appliance to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single network layer packet.

11. A computer implemented system for enabling efficient SSL handshakes through precomputing of handshake messages, the system comprising:

a network appliance which receives a server certificate identifying a server;

generates at least one of;

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message;

stores the generated messages;

receives, from a client, an SSL client hello message identifying the server; and

transmits, to the client, an SSL server hello message and at least one of the stored messages.

12. The system of claim 11 wherein the appliance provides access to a server.

13. The system of claim 11 wherein the appliance provides access to a plurality of servers, and receives a plurality of server certificates, each identifying one of the plurality of servers.

14. The system of claim 11 wherein the appliance generates (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

15. The system of claim 11 wherein the appliance generates, for each of a plurality of received server certificates, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

16. The system of claim 11 wherein the appliance generates, prior to receiving an SSL client hello message, at least one of:

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

17. The system of claim 11 wherein the appliance generates, prior to receiving an SSL client hello message, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

18. The system of claim 11 wherein the appliance generates, prior to receiving an SSL client hello message identifying the server, at least one of:

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

19. The system of claim 11 wherein the appliance transmits, to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single transport layer packet.

20. The system of claim 11 wherein the appliance transmits, to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single network layer packet.