Secure sockets layer proxy architecture

• US 7,827,404 B1
• Filed: 11/06/2006
• Issued: 11/02/2010
• Est. Priority Date: 07/06/2001
• Status: Expired due to Term

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Gannesan, Elango, Freed, Michael
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US11/556,951
• Time in Patent Office: 1,457 Days
• Field of Search: 713/168
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A method for secure communications between a client and one of a plurality of servers performed on an intermediate device coupled to the client and the plurality of servers.

Claims

1. A method for secure communications between a client and one of a plurality of servers performed on an intermediate device coupled to the client and the plurality of servers, comprising:

receiving encrypted application data from the client via a secure communications session, wherein the encrypted application data was encrypted by the client device by encrypting application data at a session layer above a packet level of a network stack of the client; and

decrypting the encrypted application data and forwarding the decrypted application data to the server without processing the application data with an application layer of the network stack of the intermediate device.

2. The method of claim 1,

wherein forwarding the decrypted application data comprises forwarding the decrypted application data from the intermediate device to the server using a communication session negotiated by the client and the server when the intermediate device operates in a direct mode, and

wherein forwarding the decrypted application data comprises forwarding the decrypted application data from the intermediate device to the server using a communication session negotiated by the server and the intermediate device when the intermediate device operates in a proxy mode.

3. The method of claim 2 further comprising negotiating the secure communications session as a Secure Sockets Layer (SSL) session.

4. The method of claim 1,

wherein receiving encrypted application data comprise receiving the application data as multi-segment records,

and wherein decrypting and forwarding comprises:

forwarding at least a portion of the decrypted application data for each of the records prior to receiving complete records;

discarding the portion of each of the records after forwarding the portion to be discarded; and

authenticating the decrypted application data of each record using a remaining non-discarded portion of the record upon receiving a final segment of the multi-segment record.

5. The method of claim 1 wherein forwarding decrypted application data comprises forwarding unauthenticated application data.

6. The method of claim 5 wherein forwarding unauthenticated application data includes subsequently authenticating the data.

7. The method of claim 1 further comprising selecting one of the plurality of servers to which to forward the decrypted authentication data based on a load balancing algorithm that calculates current processing loads associated with each of the servers.

8. The method of claim 1 further comprising tracking data passing between the client and the one of the plurality of servers.

9. The method of claim 8 wherein tracking comprises establishing a session tracking database that records, for each session, a session ID, a Transmission Control Protocol (TCP) sequence number and a Secure Sockets Layer (SSL) session number.

10. The method of claim 9 further comprising tracking, for each session, an initialization vector.

11. An apparatus comprising:

a communications engine to decrypt encrypted application data from a client at a packet level within a network stack of the apparatus, wherein the encrypted application data was encrypted by the client at a layer above a packet level within a network stack of the client,

wherein the communications engine forwards the decrypted application data to a server without processing the application data with an application layer of the network stack of the apparatus.

12. The apparatus of claim 11,

wherein the apparatus supports a direct mode and a proxy mode,

wherein, when operating in the direct mode, the communications engine decrypts the data packets and forwards decrypted data packets from the apparatus to the server using a communication session negotiated by the client and the server, and

wherein, when operating in the proxy mode, the communications engine forwards decrypted data packets from the apparatus to the server using a communication session negotiated by the server and the apparatus.

13. The apparatus of claim 11 further comprising a negotiation manager that enables the apparatus as a Transmission Control Protocol (TCP) and Secure Sockets Layer (SSL) proxy for the server.

14. The apparatus of claim 11 further including a session tracking database having at least one record per communication session between the client and the server.

15. The apparatus of claim 14 wherein the at least one record includes a TCP sequence number and an SSL sequence number.

16. The apparatus of claim 14 further including a recovery manager using the database to recover from communication errors.

17. The apparatus of claim 11 wherein the communications engine decrypts packets from SSL data that spans over multiple TCP segments.

18. The apparatus of claim 17 wherein the application data is not buffered during decryption.

19. The apparatus of claim 11,

wherein the communication engine performs an authentication process that authenticates the decrypted data after a final segment of a multi-segment encrypted data record is received, and

wherein the authentication process discards at least a portion of the data record after forwarding the portion to be discarded and authenticates decrypted data using the remaining portion of the data record after the final segment is received.

20. An intermediate network device to be positioned within a network between a client and a server, the intermediate network device comprising:

a communications engine that is configurable to operate in a direct mode or a proxy mode;

wherein, when operating in the direct mode, the communications engine (i) intercepts encrypted data packets sent by the client on a communication session between the client and the server, (ii) decrypts the data packets, and (iii) forwards decrypted data packets from the intermediate network device to the server using the communication session between the client and the server, and

wherein, when operating in the proxy mode, the communications engine (i) receives encrypted data packets sent by the client on a communication session between the client and the intermediate network device, (ii) decrypts the data packets, and (iii) forwards decrypted data packets from the intermediate network device to the server using the communication session between the intermediate network device and the server.