SYSTEMS AND METHODS FOR BULK ENCRYPTION AND DECRYPTION OF TRANSMITTED DATA

• US 20130145146A1
• Filed: 12/12/2012
• Published: 06/06/2013
• Est. Priority Date: 08/21/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Suganthi, Josephine, Kanekar, Tushar, Udupa, Sivaprasad
• Granted Patent: US 8,838,958 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two or more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.

Claims

1. A method for using an intermediary device to efficiently buffer and encrypt data for transmission between a client and a server, the method comprising:

(a) decrypting, by a cryptographic processor of a device intermediary to a plurality of clients and one or more servers, a plurality of encrypted messages from a plurality of Secure Socket Layer (SSL) records received from a client of the plurality of clients via a first transport layer connection between the client and the device;

(b) storing, by the device for later processing by the cryptographic processor, to a buffer each of the decrypted messages received from output of the cryptographic processor;

(c) communicating, by the device responsive to detecting that a predetermined transmittal condition has occurred for the first transport layer connection, the buffered decrypted messages to the cryptographic processor to produce an encrypted SSL record comprising at least a portion of the decrypted messages stored in the buffer; and

(d) transmitting, by the device via a second transport layer connection between the device and the server, the encrypted SSL record to the server.

2. The method of claim 1, wherein step (a) further comprising receiving the plurality of SSL records comprising a first SSL record and a second SSL record, the first SSL record comprising a first encrypted message and the second SSL record comprising a second encrypted message.

3. The method of claim 2, further comprising decrypting, by the cryptographic processor the first encrypted message to provide a first decrypted message and the second encrypted message to produce a second decrypted message.

4. The method of claim 3, wherein step (b) further comprising storing each of the first SSL record and the second SSL record to the buffer for later processing by the cryptographic processor.

5. The method of claim 1, wherein step (c) further comprises detecting, by the device, the predetermined transmittal condition comprising one of the following:

a length of the buffered messages exceeds a given threshold and a length of the buffered messages exceeds a maximum quantum size of the second transport layer connection.

6. The method of claim 1, wherein step (c) further comprises detecting, by the device, the predetermined transmittal condition comprising an indicator of an end of an application layer transaction.

7. The method of claim 1, wherein step (c) further comprises detecting, by the device, the predetermined transmittal condition comprising a transport control protocol (TCP) indicator.

8. The method of claim 1, wherein step (c) further comprises detecting, by the device, the predetermined transmittal condition comprising an expiration of a timer.

9. The method of claim 1, wherein step (c) further comprising instructing, by the device, the cryptographic card to combine stored decrypted messages to produce the SSL record.

10. The method of claim 1, wherein step (d) further comprises transmitting, by the device via the second transport layer connection, the encrypted SSL record to the server upon encryption by the cryptographic processor.

11. A system for efficiently buffering and encrypting data for transmission, the system comprising:

a device intermediary to a plurality of clients and one or more servers, the device configured to receive a plurality of Secure Socket Layer (SSL) records received from a client of the plurality of clients via a first transport layer connection between the client and the device;

a cryptographic processor of the device, the cryptographic processor configured to decrypt the plurality of Secure Socket Layer (SSL) records;

wherein the device is configured to store, for later processing by the cryptographic processor, to a buffer each of the decrypted messages received from output of the cryptographic processor;

wherein the device is configured to detect that a predetermined transmittal condition has occurred for the first transport layer connection, and to communicate the buffered decrypted messages to the cryptographic processor to produce an encrypted SSL record comprising at least a portion of the decrypted messages stored in the buffer; and

wherein the device is configured to transmit the encrypted SSL record to the server via a second transport layer connection between the device and the server.

12. The system of claim 11, wherein the plurality of SSL records comprises a first SSL record and a second SSL record, the first SSL record comprising a first encrypted message and the second SSL record comprising a second encrypted message.

13. The system of claim 12, wherein cryptographic processor is configured to decrypt the first encrypted message to provide a first decrypted message and to decrypt the second encrypted message to produce a second decrypted message.

14. The system of claim 13, wherein the device is configured to store each of the first SSL record and the second SSL record to the buffer for later processing by the cryptographic processor.

15. The system of claim 11, wherein the device is configured to detect the predetermined transmittal condition comprising one of the following:

a length of the buffered messages exceeds a given threshold and a length of the buffered messages exceeds a maximum quantum size of the second transport layer connection.

16. The system of claim 11, wherein the device is configured to detect the predetermined transmittal condition comprising an indicator of an end of an application layer transaction.

17. The system of claim 11, wherein the device is configured to detect the predetermined transmittal condition comprising a transport control protocol (TCP) indicator.

18. The system of claim 11, wherein the device is configured to detect the transmittal condition comprising an expiration of a timer.

19. The system of claim 11, wherein the device is configured to instruct the cryptographic card to combine stored decrypted messages to produce the SSL record.

20. The system of claim 11, wherein the device is configured to transmit, via the second transport layer connection, the encrypted SSL record to the server upon encryption by the cryptographic processor.