Method and system for providing persistence in a secure network access

• US 7,996,886 B1
• Filed: 09/19/2008
• Issued: 08/09/2011
• Est. Priority Date: 09/03/2002
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Gilde, Robert G., Hughes, John R., Masters, Richard Roderick
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US12/234,592
• Time in Patent Office: 1,054 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system and method for providing persistence in a secure network access by using a client certificate sent by a client device to maintain the identity of a target. A security handshake is performed with a client device to establish a secure session. A target is determined. A client certificate is associated with the target. During subsequent secure sessions, the client certificate is used to maintain persistent communications between the client and a target. A session ID can be used in combination with the client certificate, by identifying the target based on the session ID or the client certificate, depending on which one is available in a client message.

Claims

1. A load balancing system comprising:

a first load balancer;

a second load balancer;

a plurality of SSL proxies communicating with the first load balancer; and

a processor operable to execute an action with at least one of a plurality of modules, including;

a first module for communicating first identifying data associated with a client from an SSL proxy of the plurality of SSL proxies to the first load balancer, the first identifying data comprising a first client certificate;

a second module for determining a target server associated with the client; and

a third module for maintaining a persistent communication between the client and the target server, based on the first client certificate;

a fourth module for communicating a second identifying data associated with the client from the SSL proxy to the second load balancer, the second identifying data comprising a second client certificate; and

a fifth module for maintaining persistent communications between the client and the target server, based on the first identifying data and the second identifying data, wherein at least a portion of the persistent communications is processed at the first load balancer, and at least a portion of the persistent communications is processed at the second load balancer.

2. The load balancing system of claim 1, wherein the plurality of modules further include:

a sixth module for communicating a second identifying data associated with the client from a second SSL proxy to the first load balancer, the second identifying data comprising a second client certificate; and

a seventh module for maintaining the persistent communication based on the first client certificate and the second client certificate.

3. The load balancing system of claim 1, wherein the plurality of modules further include another module for maintaining the persistent communication based on the first client certificate, the second client certificate, and a session ID.

4. A method of maintaining a communication with a client device on a network having a plurality of targets, comprising:

receiving a first secure communication protocol handshake message from the client device;

determining a target from the plurality of targets;

determining an identifier that directly identifies the target based on at least a portion of a client certificate from the client device;

maintaining a persistent communication between the client and the target server, based on the identifier;

receiving a second message from the client device, the second message comprising the client certificate; and

maintaining a second persistent communication between the client device and the target, based on the identifier, wherein at least a different portion of the second persistent communication is processed at a different one of a plurality of load balancers, and wherein maintaining the second persistent communication further comprises hashing the portion of the client certificate to directly determine the target.

5. The method of claim 4, wherein the determining the identifier comprises determining the identifier so that a hash of the client certificate directly identifies the target.