Reducing latency of split-terminated secure communication protocol sessions
View Patent ↗A method is provided for establishing a split-terminated secure communication connection between a client and a server. A first network intermediary intercepts a secure communication connection request directed from the client to the server. A second intermediary having a digital certificate in the name of the server (and a corresponding private key) acts in place of the server to establish a first secure communication session with the client, during which it receives a secret from the client for generating the session key. The second intermediary supplies the secret and/or the session key to the first intermediary, which allows the first intermediary to establish follow-on secure communication sessions in which the secret is reused. The second intermediary may also supply the first intermediary with a copy of its certificate so that it can respond to new secure communication requests and, yet further, may also supply a copy of the private key.
1. A method of establishing a split-terminated secure communication connection between a client computing device and a server computing device, the method comprising:
at a client-side intermediary interposed in a communication path between the client and a network coupling the client to the server;
receiving from a server-side intermediary a certificate issued in a name of the server;
intercepting a request from the client for a secure communication connection with the server;
forwarding to the server-side intermediary a client-key exchange message received from the client; and
establishing a secure client-side communication session between the client and the client-side intermediary; and
at the server-side intermediary, interposed between the network and the server:
receiving the forwarded client-key-exchange message;
calculating the master secret from a client secret extracted from the client-key exchange message;
transmitting the master secret to the client-side intermediary; and
establishing a secure server-side communication session with the server;
wherein the split-terminated secure communication connection comprises the secure client-side communication session, the secure server-side communication session and a communication connection between the client-side intermediary and the server-side intermediary; and
wherein the split-terminated secure communication connection is established with no more than three communications exchanged across the network, the three communications including:
the certificate transmitted from the server-side intermediary to the client-side intermediary;
the client-key exchange message transmitted from the client-side intermediary to the server-side intermediary; and
the master secret transmitted from the server-side intermediary to the client-side intermediary.
2. The method of claim 1 , further comprising:
at the client-side intermediary:
receiving a secure data request from the client;
decrypting the secure data request with a first key associated with the secure client-side communication session;
encrypting the data request with a second key associated with the communication connection between the client-side intermediary and the server-side intermediary; and
forwarding the data request to the server-side intermediary; and
at the server-side intermediary:
decrypting the data request with the second key; and
submitting the data request to the server.
3. The method of claim 2 , wherein said submitting the data request to the server comprises:
encrypting the data request with a third key associated with the secure server-side communication session.
4. The method of claim 1 , wherein:
the client and the client-side intermediary are coupled by a first local communication link;
the server and the server-side intermediary are coupled by a second local communication link; and
the client-side intermediary and the server-side intermediary are coupled by the network.
5. The method of claim 1 , further comprising, after termination of the secure client-side communication session:
intercepting a reuse connection request from the client at the client-side intermediary, wherein the reuse connection request attempts to reuse the master secret; and
establishing a second secure client-side communication session between the client and the client-side intermediary.
6. The method of claim 5 , wherein the second secure client-side communication session is established without participation by the server-side intermediary and without participation by the server.
7. A non-transitory computer-readable medium storing instructions that, when executed by a computer, interposed in a communication path between a client computing device and a network coupling the client computing device to a server computing device, cause the computer to perform a method of establishing a split-terminated secure communication connection between the client computing device and the server computing device, the method comprising:
receiving from a server-side intermediary a certificate issued in a name of the server;
intercepting a request from the client for a secure communication connection with the server;
forwarding to the server-side intermediary a client-key-exchange message received from the client;
receiving from the server-side intermediary a master secret calculated from a client secret extracted from the client-key-exchange message; and
establishing a secure client-side communication session between the client and the computer; and
wherein the split-terminated secure communication connection comprises the secure client-side communication session, a secure server-side communication session established between the server-side intermediary and the server, and a communication connection between the computer and the server-side intermediary; and
wherein the split-terminated secure communication connection is established with no more than three communications exchanged across the network, the three communications including:
the certificate transmitted from the server-side intermediary to the computer;
the client-key-exchange message transmitted from the computer to the server-side intermediary; and
the master secret transmitted from the server-side intermediary to the computer.
8. A method of establishing a secure communication channel between a client computing device and a server computing device, the method comprising:
at a client-side intermediary interposed in a communication path between the client and a network separating the client and the server:
receiving from a server-side intermediary a certificate issued in a name of the server, and a corresponding private cryptographic key;
intercepting a request for a secure communication connection directed to the server;
notifying the server-side intermediary of the intercepted request;
during a secure protocol handshaking process with the client, accepting a client-key-exchange message comprising a client secret for generating a key;
decrypting the client secret with the private cryptographic key;
calculating a master secret from the client secret; and
establishing a secure client-side communication session with the client; and
at the server-side intermediary, interposed between the network and the server;
receiving the notification of the intercepted request; and
establishing a secure server-side communication session with the server;
wherein the secure communication channel between the client and the server comprises the secure client-side communication session, the secure server-side communication session and a communication connection between the client-side intermediary and the server-side intermediary; and
wherein the secure communication channel between the client and the server is established with only one round-trip of communications transiting the network, the round-trip of communications including:
the transmission of the certificate and the private cryptographic key from the server-side intermediary to the client-side intermediary; and
said notifying of the server-side intermediary, by the client-side intermediary, of the intercepted request.
9. The method of claim 8 , further comprising, after termination of the secure client-side communication session:
at the client-side intermediary, intercepting a reuse connection request directed to the server from the client, wherein the reuse connection request attempts to reuse the master secret; and
establishing a second secure client-side communication session between the client and the client-side intermediary.
10. A non-transitory computer-readable medium storing instructions that, when executed by a computer interposed in a communication path between a client computing device and a network separating the client computing device and a server computing device, cause the computer to perform a method of facilitating establishment of a secure communication channel between the client computing device and the server computing device, the method comprising:
receiving from a server-side intermediary a certificate issued in a name of the server, and a corresponding private cryptographic key;
intercepting a request for a secure communication connection directed to the server;
notifying the server-side intermediary of the intercepted request;
during a secure protocol handshaking process with the client, accepting a client-key-exchange message comprising a client secret for generating a key;
decrypting the client secret with the private cryptographic key;
calculating a master secret from the client secret; and
establishing a secure client-side communication session with the client;
wherein the secure communication channel between the client and the server comprises the secure client-side communication session, a secure server-side communication session established between the server-side intermediary and the server, and a communication connection between the computer and the server-side intermediary; and
wherein the secure communication channel between the client and the server is established with only one round-trip of communications across the network, the round-trip of communication including:
the transmission of the certificate and the private cryptographic key from the server-side intermediary to the computer; and
said notifying of the server-side intermediary, by the computer, of the intercepted request.
11. A system for facilitating a split-terminated secure communication connection between a client computing device and a server computing device, the system comprising:
a server-side intermediary interposed between the server and a network coupling the client and the server, the server-side intermediary comprising:
a certificate issued in a name of the server;
a first processor; and
a first storage medium storing instructions that, when executed by the first processor, cause the server-side intermediary to perform a method comprising:
transmitting the certificate to a client-side intermediary interposed between the client and the network;
decrypting a client-key-exchange message received from the client-side intermediary, with a private cryptographic key corresponding to the certificate;
calculating a master secret from a client secret extracted from the decrypted client-key-exchange message;
transmitting the master secret to the client-side intermediary; and
establishing a first secure communication with the server; and
the client-side intermediary, comprising:
a second processor; and
a second storage medium storing instructions that, when executed by the second processor, cause the client-side intermediary to perform a method comprising:
intercepting a request from the client for a secure communication connection with the server;
forwarding to the server-side intermediary the client-key-exchange message received from the client; and
establishing a second secure communication session with the client;
wherein the split-terminated secure communication connection comprises the first communication session, the second secure communication session and a communication connection between the server-side intermediary and the client-side intermediary; and
wherein the split-terminated secure communication connection is established with no more than three communications exchange across the network, the three communications including:
the certificate transmitted from the server-side intermediary to the client-side intermediary;
the client-key-exchange message transmitted form the client-side intermediary to the server-side intermediary; and
the master secret transmitted from the server-side intermediary to the client-side intermediary.
12. A system for facilitating a secure communication channel between a client computing device and a server computing device, the system comprising:
a server-side intermediary interposed between the server and a network separating the client and the server, the server-side intermediary comprising:
a certificate issued in a name of the server;
a first processor; and
a first storage medium storing instructions that, when executed by the first processor, cause the server-side intermediary to perform a method comprising:
transmitting the certificate and a corresponding private cryptographic key to a client-side intermediary interposed between the client and the network; and
establishing a first secure communication session with the server in response to a notification from the client-side intermediary; and
the client-side intermediary, comprising:
a second processor; and
a second storage medium storing instructions that, when executed by the second processor, cause the client-side intermediary to perform a method comprising:
intercepting a request for a secure client-server communication connection, directed from the client toward the server;
notifying the server-side intermediary of the intercepted request;
decrypting, with the private cryptographic key, a client secret received from the client;
calculating master secret from the client secret; and
establishing a second secure communication session with the client;
wherein the secure communication channel comprises the first secure communication session, the second secure communication session and a communication connection between the server-side intermediary and the client-side intermediary; and
wherein the secure communication channel is established with only one round-trip of communications across the network, the round-trip of communications including:
said transmission of the certificate and the private cryptographic key from the server-side intermediary to the client-side intermediary; and
said notifying of the server-side intermediary, by the client-side intermediary, of the intercepted request.