Client-side inspection and processing of secure content

• US 20040015725A1
• Filed: 07/24/2002
• Published: 01/22/2004
• Est. Priority Date: 08/07/2000
• Status: Abandoned Application

• Current Assignee: SafeNet Incorporated (Thales SA)
• Original Assignee: SafeNet Incorporated (Thales SA)
• Inventors: Boneh, Dan, Modadugu, Nagendra, Fountain, Thomas D., Chawla, Rajeev, Murchison, Rod
• Application Number:
  US10/205,575
• Publication Number:
  US 20040015725A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

An apparatus and method are provided for client-side content processing such as filtering and caching of secure content sent using Transport Layer Security (TLS) or Secure Socket Layer (SSL) protocols. An appliance functions as a controlled man-in-the-middle on the client side to terminate, cache, switch, and modify secure client side content.

Claims

1. A computer implemented method for client side transparent content processing, said computer implemented process comprising the acts of:

establishing a secure transport session between a client and a server via a transparent controlled man-in-the-middle proxy;

receiving, at said controlled man-in-the-middle proxy, a client request intended for said server, at least a portion of said client request being encrypted;

decrypting said client request; and

processing said decrypted client request.

2. A computer implemented method as recited in claim 1, wherein said processing includes inspecting said client request.

3. A computer implemented method as recited in claim 1, wherein said processing includes blocking said client request.

4. A computer implemented method as recited in claim 1, wherein said processing includes determining whether a response to said client request is cached.

5. A computer implemented method as recited in claim 1, wherein said processing includes performing content transformation on said client request.

6. A computer implemented method as recited in claim 5, wherein said content transformation includes content filtering.

7. A computer implemented method as recited in claim 1, wherein said client is a web browser.

8. A computer implemented method as recited in claim 1, wherein said server is a web server computer.

9. A computer implemented method as recited in claim 1, wherein the act of establishing a secure transport session includes the sub-acts of:

intercepting at said proxy a client request to establish a client-server secure session with said server computer;

establishing a client-proxy secure session between said proxy and said client computer such that said client interprets said client-proxy secure session as said requested client-server secure session; and

establishing a proxy-server secure session between said proxy and said server computer.

10. A computer implemented method as recited in claim 9, wherein said server computer interprets said proxy-server secure session as said requested client-server secure session.

11. A computer implemented method as recited in claim 9, wherein said secure sessions include the Secure Socket Layer protocol.

12. A computer implemented method as recited in claim 9, wherein said secure sessions include the Transport Layer Security protocol.

13. A computer implemented method as recited in claim 12, wherein said intercepting a client request includes receiving a CONNECT and Client-hello message.

14. A computer implemented method as recited in claim 9, wherein said establishing a client-proxy secure session comprises the acts of:

said proxy replying to said client request with a response affirming said request to establish said client-server secure session, said response including a server certificate identifying the proxy as said server.

15. A computer implemented method as recited in claim 14, wherein said establishing a client-proxy secure session further comprises the acts of:

generating a Certificate Authority (CA) public/private key pair held by said proxy;

obtaining a session public/private key pair held by said proxy;

wherein said server certificate includes said session public key and the identification of said server, and is signed using said CA private key.

16. A computer implemented method as recited in claim 15, wherein said server identification is determined from the destination address of said intercepted request.

17. A computer implemented method as recited in claim 16, wherein the destination address is the IP address and said determining includes a reverse DNS lookup.

18. A computer implemented method as recited in claim 14, wherein said establishing a client-proxy secure session further comprises the acts of:

providing for said client computer to accept said server certificate as valid.

19. A computer implemented method as recited in claim 18, wherein said providing includes installing said CA public key on said client.

20. A computer implemented method as recited in claim 18, wherein said providing includes allowing said client to access said CA public key.

21. A computer implemented method as recited in claim 9, wherein said establishing a proxy-server secure session comprises the acts of:

said proxy generating a proxy request to establish a proxy-server secure session with said server;

receiving from said server a second server certificate identifying said server; and

verifying that said second server certificate is validly signed.

22. A computer implemented method as recited in claim 21, further comprising the acts of:

in response to a server request for authentication, issuing a proxy certificate signed by a certificate authority recognized by said server.

23. A computer implemented process as recited in claim 1, further comprising the acts of:

receiving, at said proxy, a server response intended for said client computer, at least a portion of said server response being encrypted;

decrypting said server response; and

processing said decrypted server response.

63. A computer implemented method as recited in claim 15, wherein said obtaining includes generating a session public/private key pair.

64. A computer implemented method as recited in claim 15, wherein said obtaining includes retrieving a commonly used session public/private key pair held by said proxy.

24. A computer implemented method for establishing a secure transport session between a client computer and a server computer via a transparent controlled man-in-the-middle proxy, said method comprising the acts of:

intercepting at said proxy a client request to establish a client-server secure session with said server computer;

establishing a client-proxy secure session between said proxy and said client computer such that said client interprets said client-proxy secure session as said requested client-server secure session; and

establishing a proxy-server secure session between said proxy and said server computer.

25. A computer implemented method as recited in claim 24, wherein said server computer interprets said proxy-server secure session as said requested client-server secure session.

26. A computer implemented method as recited in claim 24, wherein said secure sessions include the Secure Socket Layer protocol.

27. A computer implemented method as recited in claim 24, wherein said secure sessions include the Transport Layer Security protocol.

28. A computer implemented method as recited in claim 27, wherein said intercepting a client request includes receiving a CONNECT and Client-hello message.

29. A computer implemented method as recited in claim 24, wherein said establishing a client-proxy secure session comprises the acts of:

said proxy replying to said client request with a response affirming said request to establish said client-server secure session, said response including a server certificate identifying the proxy as said server.

30. A computer implemented method as recited in claim 29, wherein said establishing a client-proxy secure session further comprises the acts of:

generating a Certificate Authority (CA) public/private key pair held by said proxy;

obtaining a session public/private key pair held by said proxy;

wherein said server certificate includes said session public key and the identification of said server, and is signed using said CA private key.

31. A computer implemented method as recited in claim 30, wherein said server identification is determined from the destination address of said intercepted request.

32. A computer implemented method as recited in claim 31, wherein the destination address includes the IP address and said determining includes a reverse DNS lookup.

33. A computer implemented method as recited in claim 29, wherein said establishing a client-proxy secure session further comprises the acts of:

providing for said client to accept said server certificate as valid.

34. A computer implemented method as recited in claim 33, wherein said providing includes installing said CA public key on said client.

35. A computer implemented method as recited in claim 33, wherein said providing includes allowing said client to access said CA public key.

36. A computer implemented method as recited in claim 24, wherein said establishing a proxy-server secure session comprises the acts of:

said proxy generating a proxy request to establish a proxy-server secure session with said server;

receiving from said server a second server certificate identifying said server; and

verifying that said second server certificate is validly signed.

37. A computer implemented method as recited in claim 36, further comprising the acts of:

in response to a server request for authentication, issuing a proxy certificate signed by a certificate authority recognized by said server.

65. A computer implemented method as recited in claim 30, wherein said obtaining includes generating a session public/private key pair.

66. A computer implemented method as recited in claim 30, wherein said obtaining includes retrieving a commonly used session public/private key pair held by said proxy.

38. A computer implemented method for client side transparent content processing, said computer implemented process comprising the acts of:

establishing a secure transport session between a client and a server via a transparent controlled man-in-the-middle proxy;

receiving, at said proxy, a server response intended for said client computer, at least a portion of said server response being encrypted;

decrypting said server response; and

processing said decrypted server response.

39. A computer implemented method as recited in claim 38, wherein said processing includes inspecting said server response.

40. A computer implemented method as recited in claim 38, wherein said processing includes blocking said server response.

41. A computer implemented method as recited in claim 38, wherein said processing includes caching at least a portion of said server response.

42. A computer implemented method as recited in claim 38, wherein said processing includes performing content transformation on said server response.

43. A computer implemented method as recited in claim 42, wherein said content transformation includes content filtering.

44. A computer implemented method as recited in claim 38, wherein said client is a web browser.

45. A computer implemented method as recited in claim 38, wherein said server is a web server computer.

46. A computer implemented method as recited in 38, wherein the act of establishing a secure transport session includes the sub-acts of:

intercepting at said proxy a client request to establish a client-server secure session with said server computer;

establishing a client-proxy secure session between said proxy and said client computer such that said client interprets said client-proxy secure session as said requested client-server secure session; and

establishing a proxy-server secure session between said proxy and said server computer.

47. A computer implemented method as recited in claim 46, wherein said server computer interprets said proxy-server secure session as said requested client-server secure session.

48. A computer implemented method as recited in claim 46, wherein said secure sessions include the Secure Socket Layer protocol.

49. A computer implemented method as recited in claim 46, wherein said secure sessions include the Transport Layer Security protocol.

50. A computer implemented method as recited in claim 49, wherein said intercepting a client request includes receiving a CONNECT and Client-hello message.

51. A computer implemented method as recited in claim 46, wherein said establishing a client-proxy secure session comprises the acts of:

said proxy replying to said client request with a response affirming said request to establish said client-server secure session, said response including a server certificate identifying the proxy as said server.

52. A computer implemented method as recited in claim 51, wherein said establishing a client-proxy secure session further comprises the acts of:

generating a Certificate Authority (CA) public/private key pair held by said proxy;

obtaining a session public/private key pair held by said proxy;

wherein said server certificate includes said session public key and the identification of said server, and is signed using said CA private key.

53. A computer implemented method as recited in claim 52, wherein said server identification is determined from the destination address of said intercepted request.

54. A computer implemented method as recited in claim 53, wherein the destination address is the IP address and said determining includes a reverse DNS lookup.

55. A computer implemented method as recited in claim 51, wherein said establishing a client-proxy secure session further comprises the acts of:

providing for said client computer to accept said server certificate as valid.

56. A computer implemented method as recited in claim 55, wherein said providing includes installing said CA public key on said client.

57. A computer implemented method as recited in claim 55, wherein said providing includes allowing said client to access said CA public key.

58. A computer implemented method as recited in claim 46, wherein said establishing a proxy-server secure session comprises the acts of:

said proxy generating a proxy request to establish a proxy-server secure session with said server;

receiving from said server a second server certificate identifying said server; and

verifying that said second server certificate is validly signed.

59. A computer implemented method as recited in claim 58, further comprising the acts of:

in response to a server request for authentication, issuing a proxy certificate signed by a certificate authority recognized by said server.

67. A computer implemented method as recited in claim 52, wherein said obtaining includes generating a session public/private key pair.

68. A computer implemented method as recited in claim 52, wherein said obtaining includes retrieving a commonly used session public/private key pair held by said proxy.

60. A computer system comprising:

a data communications bus;

a central processing unit bi-directionally coupled to said data communications bus;

transient memory bi-directionally coupled to said data communications bus;

persistent memory bi-directionally coupled to said data communications bus;

a network i/o device bi-directionally coupled to said data communications bus; and

a caching process executing on said computer system;

a content transformation process executing on said computer system;

a encryption/decryption process executing on said computer system;

a proxy manager process executing on said computer system, wherein said manager process utilizes said caching, content transformation, and encryption/decryption processes to transparently process messages intercepted over a secure session link established between a client computer and a server computer via said computer system.

61. A data structure for use in the inspection and processing of secure content by a proxy coupled between a web browser and a web server, said data structure comprising:

the identification of said server;

a session public key held by said proxy;

a digital signature signed by a Certificate Authority private key held by said proxy.

62. A web browser for use in the client-side inspection and processing of secure content transmitted between said browser and a web server by a proxy, wherein:

said browser is adapted to accept a server certificate identifying said proxy as said server.