Methods and apparatus for establishing secure communications between client computing devices that use transport and security protocols
View Patent ↗Methods and apparatuses, including computer program products, are described for establishing secure communications sessions between computing devices located behind network security devices. The method includes receiving, from a first client computing device, a request for a secure connection with a second client computing device, the request including a first transport protocol role and a first security protocol role associated with the first device. The method includes transmitting the request to the second device. The method includes receiving, from the second device, a response to the request including a second transport protocol role and a second security protocol role associated with the second device, transmitting the response to the first device, and establishing the secure connection between the first device and the second device, where the first and second security protocol roles are determined independently from the first and second transport protocol roles.
1. A method for establishing secure communications sessions between client computing devices located behind network security devices, the method comprising:
(a) receiving, at a intermediary computing device from a first client computing device, a request for a secure connection with a second client computing device, the request including a first transport protocol role implemented by the first client computing device and a first security protocol role implemented by the first client computing device;
(b) transmitting, from the intermediary computing device, the request to the second client computing device;
(c) receiving, at the intermediary computing device from the second client computing device, a response to the request, the response including a second transport protocol role implemented by the second client computing device and a second security protocol role implemented by the second client computing device, the second security protocol role being different from the first security protocol role;
(d) transmitting, from the intermediary computing device, the response to the first client computing device;
(e) establishing the secure connection between the first client computing device and the second client computing device, wherein the first transport protocol role and the second transport protocol role are determined independently from the first security protocol role and the second security protocol role.
2. The method of claim 1 , further comprising:
establishing a transport connection between the first client computing device and the second client computing device via the intermediary computing device.
3. The method of claim 2 , further comprising establishing the transport connection using Transmission Control Protocol (TCP).
4. The method of claim 3 , further comprising establishing the transport connection using TCP stitching.
5. The method of claim 4 , wherein establishing the transport connection further comprises:
receiving, at the intermediary computing device from the first client computing device, a first synchronize (SYN) message including a first Internet Protocol (IP) address and a first port number corresponding to the first client computing device;
receiving, at the intermediary computing device from the second client computing device, a second SYN message including a second IP address and a second port number corresponding to the second client computing device;
modifying, at the intermediary computing device, (i) the first IP address and the first port number to include an IP address and a port number of the intermediary computing device and (ii) a destination IP address and the destination port number of the first SYN message to include the second IP address and the second port number; and
transmitting, from the intermediary computing device, the modified first SYN message to the second computing device.
6. The method of claim 2 , wherein establishing the transport connection further comprises:
assigning a client role to the first transport protocol role;
assigning a client role to the second transport protocol role; and
assigning a server role to a transport connection role implemented by the intermediary computing device.
7. The method of claim 2 , wherein establishing the transport connection further comprises:
receiving, at the intermediary computing device from the first client computing device, a request for a transport connection with the second client computing device;
transmitting, from the intermediary computing device, the request for a transport connection to the second client computing device;
receiving, at the intermediary computing device from the second client computing device, a response to the request for a transport connection; and
transmitting, from the intermediary computing device, the response to the request for a transport connection to the first client computing device.
8. The method of claim 1 , wherein the first security protocol role is a client/server role and the second security protocol role is one of a client role or a server role.
9. The method of claim 8 , further comprising assigning a client role to the first security protocol role if the second security protocol role is a server role.
10. The method of claim 8 , further comprising assigning a server role to the first security protocol role if the second security protocol role is a client role.
11. The method of claim 1 , wherein the first security protocol role is a client role and the second security protocol role is a server role.
12. The method of claim 1 , wherein the first security protocol role is a server role and the second security protocol role is a client role.
13. The method of claim 8 , further comprising determining the second security protocol role according to a preconfigured value.
14. The method of claim 1 , further comprising establishing the secure connection using Transport Layer Security (TLS).
15. The method of claim 1 , further comprising encoding at least one of the first transport protocol role or the second transport protocol role within a Session Description Protocol (SDP) attribute.
16. The method of claim 1 , further comprising encoding at least one of the first security protocol role or the second security protocol role within an SDP attribute.
17. The method of claim 1 , further comprising encoding the request for a secure connection within a Session Initiation Protocol (SIP) INVITE message.
18. The method of claim 1 , further comprising encoding the response to the request for a secure connection within a SIP 200 OK message or a SIP 18×response message.
19. A system for establishing secure communications sessions between client computing devices located behind network security devices, the system comprising:
a computing device configured to:
(a) receive, from a first client computing device, a request for a secure connection with a second client computing device, the request including a first transport protocol role implemented by the first client computing device and a first security protocol role implemented by the first client computing device;
(b) transmit the request to the second client computing device;
(c) receive, from the second client computing device, a response to the request, the response including a second transport protocol role implemented by the second client computing device and a second security protocol role implemented by the second client computing device, the second security protocol role being different from the first security protocol role;
(d) transmit the response to the first client computing device; and
(e) establish the secure connection between the first client computing device and the second client computing device, wherein the first transport protocol role and the second transport protocol role are determined independently from the first security protocol role and the second security protocol role.
20. A computer program product, tangibly embodied in a computer-readable storage medium, for establishing secure communications sessions between client computing devices located behind network security devices, the computer program product including instructions operable to cause a data processing apparatus to:
(a) receive, from a first client computing device, a request for a secure connection with a second client computing device, the request including a first transport protocol role implemented by the first client computing device and a first security protocol role implemented by the first client computing device;
(b) transmit the request to the second client computing device;
(c) receive, from the second client computing device, a response to the request, the response including a second transport protocol role implemented by the second client computing device and a second security protocol role implemented by the second client computing device, the second security protocol role being different from the first security protocol role;
(d) transmit the response to the first client computing device;
(e) establish the secure connection between the first client computing device and the second client computing device, wherein the first transport protocol role and the second transport protocol role are determined independently from the first security protocol role and the second security protocol role.