Strong SSL proxy authentication with forced SSL renegotiation against a target server
An encrypted session is established between a client device and a target server device when the client device initiates network connections through a proxy device. The client device initiates an encrypted session with the proxy device. Once the encrypted session is established, the client device communicates the address of the target server device to the proxy device. Then, the proxy device sends an encrypted session renegotiation message to the client device. The client device responds to the encrypted session renegotiation message by transmitting an encrypted session handshake message to the proxy device. The proxy device forwards the encrypted session handshake message to the target server device, and continues to forward handshake messages between the client device and the target server device, enabling the client device and the target server device to establish an encrypted session.
1. A proxy device interposed between a client device and a plurality of target server devices, comprising:
a transceiver to send and receive data over a network; and
a processor that is operative to perform actions comprising:
establishing a first encrypted session with the client device;
receiving a network identifier of a first target server device;
establishing an unencrypted network connection with the first target server device, wherein the proxy device enables communication in the first encrypted session between the client device and the first target server device:
sending an encrypted session renegotiation message to the client device in response to determining header information extracted from session communication between the client device and the first target server device includes criteria for a change from the first target server device,
decrypting and redirecting a handshake message received from the client device to a second target server device, wherein the handshake message was sent by the client device in response to the encrypted session renegotiation message;
replacing the first target server device in the first encrypted session for communication with the client device with a second target server device.
2. The proxy device of claim 1 , wherein the actions further comprise forwarding additional handshake messages sent by the client device to the target server device and from the target server device to the client device, to establish a second encrypted session between the client device and the second target server device.
3. The proxy device of claim 1 , wherein the actions further comprise:
forwarding additional handshake messages sent by the client device to the target server device and from the target server device to the client device, to establish a second encrypted session between the client device and the target server device; and
forwarding messages sent over the second encrypted session from the client device to the second target server device and from the second target server device to the client device.
4. The proxy device of claim 1 , wherein the proxy device comprises a SOCKS proxy device.
5. The proxy device of claim 1 , wherein the proxy device comprises an HTTP proxy device, and wherein the first encrypted session is created in response to receiving an HTTP request from the client device.
6. The proxy device of claim 1 , wherein the first encrypted session is created in response to a request received from the client device.
7. The proxy device of claim 1 , wherein the encrypted session renegotiation message includes an “SSL HELLO REQUEST” message and the handshake message received from the client device includes a “CLIENT HELLO” message.
8. A system comprising: a client device: a first target server device: a second target server device: and
a proxy device interposed between the client device and the first and the second target devices, wherein the proxy device is configured to perform actions including:
establishing a first encrypted session with the client device, wherein the prow device enables communication in the first encrypted session between the client device and the first target server device: receiving a network identifier of the first target server device;
establishing an unencrypted network connection with the first target server device;
sending an encrypted session renegotiation message to the client device in response to determining header information extracted from session communication between the client device and the first target server device includes criteria for a change from the first target server device,
decrypting and redirecting a handshake message received from the client device to a second target server device, wherein the handshake message was sent by the client device in response to the encrypted session renegotiation message;
replacing the first target server device in the first encrypted session for communication with the client device with a second target server device.
9. The system of claim 8 , wherein the actions further comprise:
forwarding, additional handshake messages sent by the client device to the second target server device and from the second target server device to the client device, to establish a second encrypted session between the client device and the second target server device; and
forwarding messages sent over the second encrypted session from the client device to the second target server device and from the second target server device to the client device.
10. The system of claim 8 , wherein the proxy device comprises a SOCKS proxy device.
11. The system of claim 8 , wherein the proxy device comprises an HTTP proxy device, and wherein the first encrypted session is created in response to receiving an HTTP request from the client device.
12. The system of claim 8 , wherein the first encrypted session is created in response to a request received from the client device.
13. The system of claim 8 , wherein the encrypted session renegotiation message includes an “SSL HELLO REQUEST” message and the handshake message received from the client device includes a “CLIENT HELLO” message.
14. A non-transitory processor readable storage medium storing processor readable instructions that when executed by a processor perform actions comprising: establishing a first encrypted session with a client device: receiving a network identifier of a first target server device;
establishing a first unencrypted network connection with the first target server device wherein the prow device enables communication in the first encrypted session between the client device and the first target server device:
sending an encrypted session renegotiation message to the client device
in response to determining header information extracted from session communication between the client device and the first target server device includes criteria for a change from the first target server device,
decrypting and redirecting a handshake message received from the client device to a second target server device, wherein the handshake message was sent by the client device in response to the encrypted session renegotiation message;
replacing the first target server device in the first encrypted session for communication with the client device with a second target server device.
15. The processor readable storage medium of claim 14 , wherein the actions further comprise forwarding additional handshake messages sent by the client device to the second target server device and from the second target server device to the client device, to establish a second encrypted session between the client device and the second target server device.
16. The processor readable storage medium of claim 14 , wherein the actions further comprise:
forwarding additional handshake messages sent by the client device to the second target server device and from the second target server device to the client device, to establish a second encrypted session between the client device and the second target server device; and
forwarding messages sent over the second encrypted session from the client device to the second target server device and from the target server device to the client device.
17. The processor readable storage medium of claim 14 , wherein the proxy device comprises a SOCKS proxy device.
18. The processor readable storage medium of claim 14 wherein the proxy device comprises an HTTP proxy device, and wherein the first encrypted session is created in response to receiving an HTTP request from the client device.
19. The processor readable storage medium of claim 14 , wherein the first encrypted session is created in response to a request received from the client device.
20. The system of claim 8 ,
wherein the proxy device is further configured to establish the first encrypted session between the client device and the first target server device such that the first target server device is an endpoint of the first encrypted session, and wherein the proxy device is configured to employ forwarding the handshake message received from the client device to the second target service device to replace the first target server device with the second target service device as the endpoint of the first encrypted session.
21. the proxy device of claim 1 , wherein the a criteria for a change from the first target server device comprises type of data requested by the client device, a periodic schedule, a system upgrade of the server device, network traffic type, network topology, capacity of a server device, and/or a request by an administrator.
22. the system of claim 8 , the a criteria for a change from the first target server device comprises type of data requested by the client device, a periodic schedule, a system upgrade of the server device, network traffic type, network topology, capacity of a server device, and/or a request by an administrator.
23. the non-transitory processor readable storage medium of claim 14 , the a criteria for a change from the first target server device comprises type of data requested by the client device, a periodic schedule, a system upgrade of the server device, network traffic type, network topology, capacity of a server device, and/or a request by an administrator.