System and method for client-side authentication for secure internet communications
A system and method for client-side authentication for secure Internet communications is disclosed. In one embodiment, an intermediate device receives a web browser secure socket layer certificate from a web browser, authenticates the web browser using the secure socket layer certificate, and then re-signs the secure socket layer certificate with an intermediate device public key and an intermediate device certificate authority signature. The intermediate device sends the re-signed secure socket layer certificate to a web server and the web server authenticates the intermediate device using the re-signed secure socket layer certificate. In another embodiment, an intermediate device receives a web browser secure socket layer certificate from a web browser, inserts the web browser secure socket layer certificate into a HTTP header of a packet, and sends the packet to a web server.
1. A system for providing secure socket layer (SSL) communication between a client computer and a web server over at least one wide-area-network, the system comprising:
a client-side intermediate computer communicatively coupled to a client computer over at least one wide-area-network;
a server-side intermediate computer communicatively coupled to the client-side intermediate computer and to a web server over the at least one wide-area-network;
the client-side intermediate computer programmed to receive an SSL certificate from the client computer using a first communication protocol and send the SSL certificate to the server-side intermediate computer using a second communication protocol that provides higher performance as compared to the first communication protocol;
the server-side intermediate computer programmed to receive the SSL certificate from the first intermediate computer and to send the SSL certificate to the web server in a message header, using a third communication protocol;
wherein the second communication protocol also provides higher performance as compared to the third communication protocol.
2. The system of claim 1 , wherein the client-side intermediate computer is programmed to receive the SSL certificate from the client computer during an SSL handshake with the client computer.
3. The system of claim 1 , wherein the server-side intermediate computer is programmed to send the message header with the SSL certificate to the web server over an SSL connection, the SSL connection having been established with an SSL handshake in which the server-side intermediate computer sent its SSL certificate to the web server.
4. The system of claim 1 , wherein the web server is programmed to perform a client authentication or authorization routine using information from the SSL certificate.
5. The system of claim 1 , wherein the message header is an HTTP header.
6. The system of claim 1 , wherein the first and third communication protocols are the same.
7. The system of claim 1 , wherein the client-side intermediate computer is programmed to insert the SSL certificate into a second message header, and to send the SSL certificate to the server-side intermediate computer second by sending the second message header to the server-side intermediate computer using the second communication protocol.
8. The system of claim 1 , wherein each of the client-side intermediate computer and the server-side intermediate computers comprises a proxy server.
9. A method for providing secure socket layer (SSL) communication between a client computer and a web server over at least one wide-area-network, the method comprising:
at a client-side intermediate computer, receiving an SSL certificate from a client computer using a first communication protocol, and sending the SSL certificate to a server-side intermediate computer using a second communication protocol that provides higher performance as compared to the first communication protocol;
at the server-side intermediate computer, receiving the SSL certificate from the client-side intermediate computer, and sending the SSL certificate to a web server in a header, using a third communication protocol;
wherein the second communication protocol also provides higher performance as compared to the third communication protocol.
10. A system for providing secure socket layer (SSL) communication between a client computer and a web server over at least one wide-area-network, the system comprising:
a client-side intermediate computer communicatively coupled to a client computer over at least one wide-area-network;
a server-side intermediate computer communicatively coupled to the client-side intermediate computer and to a web server over the at least one wide-area-network;
the client-side intermediate computer programmed to receive an SSL certificate from the client computer using a first communication protocol, to remove information from the SSL certificate, and to send the information to the server-side intermediate computer using a second communication protocol that provides higher performance as compared to the first communication protocol;
the server-side intermediate computer programmed to receive the information from the client-side intermediate computer and to send the information to the web server in a message header, using a third communication protocol;
wherein the second communication protocol also provides higher performance as compared to the third communication protocol.
11. The system of claim 10 , wherein the information comprises an identifier associated with any of: (i) the client computer and (ii) a web browser executing on the client computer.
12. The system of claim 10 , wherein the client-side intermediate computer is programmed to receive the SSL certificate from the client computer during an SSL handshake with the client computer.
13. The system of claim 10 , wherein the server-side intermediate computer is programmed to send the message header with the information to the web server over an SSL connection, the SSL connection having been established with an SSL handshake in which the server-side intermediate computer sent its SSL certificate to the web server.
14. The system of claim 10 , wherein the web server is programmed to perform a client authentication or authorization routine using the information.
15. The system of claim 10 , wherein the message header is an HTTP header.
16. The system of claim 10 , wherein the first and third communication protocols are the same.
17. The system of claim 10 , wherein the client-side intermediate computer is programmed to insert the information into a second message header, and to send the information to the server-side intermediate computer by sending the second message header to the server-side intermediate computer using the second communication protocol.
18. The system of claim 10 , wherein each of the client-side intermediate computer and the server-side intermediate computers comprises a proxy server.
19. A method for providing secure socket layer (SSL) communication between a client computer and a web server over at least one wide-area-network, the method comprising:
at a client-side intermediate computer, receiving an SSL certificate from a client computer using a first communication protocol, removing information from the SSL certificate, and sending the information to a server-side intermediate computer using a second communication protocol that provides higher performance as compared to the first communication protocol;
at the server-side intermediate computer, receiving the information from the client-side intermediate computer, and sending the information to the web server in a message header, using a third communication protocol;
wherein the second communication protocol also provides higher performance as compared to the third communication protocol.
20. The method of claim 19 , wherein the information comprises an identifier associated with any of: (i) the client computer and (ii) a web browser executing on the client computer.