Granted Patent B2

US 8,225,085 · App. 11/758,487 · Granted Jul 17, 2012

Abstract

Claims (31)

1. A method, comprising:

intercepting a secure communication protocol transaction request from a client to a server at a client-side proxy logically deployed between the client and the server and communicatively coupled to the client, the server communicatively coupled to a server-side proxy logically deployed between the client and the server;

initiating, from the client-side proxy, a secure connection with the server, wherein the initiating of the secure connection with the server includes the client-side proxy participating in a handshake with the server and the server-side proxy only tunneling the handshake between the client-side proxy and the server, and wherein the secure connection is associated with at least one attribute enabling secure communication of data with the server;

thereafter forwarding the at least one attribute from the client-side proxy to the server-side proxy, enabling the server-side proxy to engage in secure communications with the server;

receiving, at the server-side proxy, an encrypted secure socket layer (SSL) record from the server and decrypting the encrypted SSL record using the at least one attribute to produce an unencrypted SSL record; and

transferring the unencrypted SSL record from the server-side proxy to the client-side proxy, wherein the unencrypted SSL record remains unencrypted during the transferring.

2. The method of claim 1 , wherein the secure communication protocol transaction request comprises a secure socket layer (SSL) transaction request.

3. The method of claim 1 , wherein the at least one attribute is forwarded from the client-side proxy to the server-side proxy over a secure communication channel between the client-side proxy to the server-side proxy.

4. The method of claim 1 , wherein the at least one attribute is forwarded from the client-side proxy to the server-side proxy over a secure communication channel between the client-side proxy and the server-side proxy, and the secure communication channel is established prior to the forwarding.

5. The method of claim 1 , further comprising:

prior to forwarding the at least one attribute, initiating an additional secure connection between the client-side proxy and the server-side proxy.

6. The method of claim 1 , wherein the at least one attribute includes one or more of: a cryptographic key, cipher algorithm and initialization vector to be used to encrypt data for the secure communications between the server-side proxy and the server.

7. The method of claim 1 , further comprising:

intercepting data from the client at the client-side proxy and assembling a secure socket layer (SSL) record including at least a portion of the data.

8. The method of claim 7 , further comprising:

transferring the SSL record from the client-side proxy to the server-side proxy.

9. The method of claim 8 , further comprising:

using the at least one attribute to encrypt the SSL record at the server-side proxy to produce an encrypted SSL record and transmitting the encrypted SSL record from the server-side proxy to the server.

10. The method of claim 1 , wherein transferring the unencrypted SSL record from the server-side proxy to the client-side proxy comprises transmitting the unencrypted SSL record over a secure inter-proxy communication link.

11. The method of claim 10 , further comprising:

securing the inter-proxy communication link prior to forwarding the at least one attribute.

12. The method of claim 10 , wherein transmitting the unencrypted SSL record over the secure inter-proxy communication link comprises optimizing the unencrypted SSL record for said transmittal via the secure inter-proxy communication link.

13. The method of claim 12 , wherein optimizing the unencrypted SSL record comprises subjecting the unencrypted SSL record to byte caching at the server-side proxy.

14. The method of claim 1 , further comprising:

scanning the unencrypted SSL records transferred between the server-side proxy and the client-side proxy with at least one of: an intrusion detection, intrusion prevention system, and other application-level content scan.

15. A method, comprising:

intercepting a secure communication protocol transaction request from a client to a server at a client-side proxy logically deployed between the client and the server and communicatively coupled to the client, the server communicatively coupled to multiple server-side proxies arranged in a chain and each logically deployed between the client and the server;

initiating, from the client-side proxy, a secure connection with the server, wherein the initiating of the secure connection with the server includes the client-side proxy participating in a handshake with the server and the server-side proxies only tunneling the handshake between the client-side proxy and the server, and wherein the secure connection is associated with at least one attribute enabling secure communication of data with the server;

thereafter forwarding the at least one attribute from the client-side proxy to the server-side proxies, enabling secure communications between the server-side proxies and the server;

receiving, at the server-side proxies, an encrypted secure socket layer (SSL) record from the server and decrypting the encrypted SSL record using the at least one attribute to produce an unencrypted SSL record; and

transferring the unencrypted SSL record from the server-side proxies to the client-side proxy, wherein the unencrypted SSL record remains unencrypted during the transferring.

Assignments (8)