Systems and methods for optimizing SSL handshake processing

• US 8,230,214 B2
• Filed: 08/21/2006
• Issued: 07/24/2012
• Est. Priority Date: 08/21/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Kanekar, Tushar, Udupa, Sivaprasad
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US11/466,014
• Publication Number:
  US 20080046717A1
• Time in Patent Office: 2,164 Days
• Field of Search: 713152-156, 380/277
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method for enabling efficient SSL handshakes through precomputing of handshake messages, the method includes: receiving, by an appliance, a server certificate identifying a server; generating, by the appliance, at least one of: (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message; storing, by the appliance, the generated messages; receiving, by the appliance from a client, an SSL client hello message identifying the server; and transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages. Corresponding systems are also described.

Claims

1. A method for enabling efficient SSL handshakes through precomputing of handshake messages, the method comprising:

(a) receiving, by a device intermediary to a client and a server, a server certificate of the server;

(b) generating, by the device , one or more of;

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message;

(c) storing, by the device , the one or more generated messages prior to receiving an SSL client hello message identifying the server;

(d) receiving, by the device from the client, an SSL client hello message identifying the server; and

(e) transmitting, by the device to the client, an SSL server hello message and at least one of the one or more stored messages.

2. The method of claim 1, wherein step (a) comprises receiving, by the device intermediary to the client and the server and providing access to the server, a server certificate identifying the server.

3. The method of claim 1, wherein step (a) comprises receiving, by a device providing access to a plurality of servers, a plurality of server certificates, each identifying one of the plurality of servers.

4. The method of claim 1, wherein step (b) comprises generating, by the device , (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

5. The method of claim 1, wherein step (b) comprises generating, by the device for each of a plurality of received server certificates, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

6. The method of claim 1, wherein step (b) comprises generating, by the device prior to receiving an SSL client hello message, at least one of:

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

7. The method of claim 1, wherein step (b) comprises generating, by the device prior to receiving an SSL client hello message, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

8. The method of claim 1, wherein step (b) comprises generating, by the device prior to receiving an SSL client hello message identifying the server, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

9. The method of claim 1, wherein step (e) comprises transmitting, by the device to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single transport layer packet.

10. The method of claim 1, wherein step (e) comprises transmitting, by the device to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single network layer packet.

11. A computer implemented system for enabling efficient SSL handshakes through precomputing of handshake messages, the system comprising:

a network device intermediary to a client and a server which

receives a server certificate of the server;

generates one or more of;

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message;

stores the one or more generated messages prior to receiving an SSL client hello message identifying the server;

receives, from a client, an SSL client hello message identifying the server; and

transmits, to the client, an SSL server hello message and at least one of the one or more stored messages.

12. The system of claim 11 wherein the device provides access to the server.

13. The system of claim 11 wherein the device provides access to a plurality of servers, and receives a plurality of server certificates, each identifying one of the plurality of servers.

14. The system of claim 11 wherein the device generates (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

15. The system of claim 11 wherein the device generates, for each of a plurality of received server certificates, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

16. The system of claim 11 wherein the device generates, prior to receiving an SSL client hello message, at least one of:

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

17. The system of claim 11 wherein the device generates, prior to receiving an SSL client hello message, (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

18. The system of claim 11 wherein the device generates, prior to receiving an SSL client hello message identifying the server, at least one of:

(i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message.

19. The system of claim 11 wherein the device transmits, to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single transport layer packet.

20. The system of claim 11 wherein the device transmits, to the client, an SSL server hello message and at least two of the stored messages, wherein at least two of the stored messages are transmitted in a single network layer packet.