Splitting an SSL connection between gateways
View Patent ↗A system for secure communication, including a first security computer communicatively coupled with a client computer via an SSL connection, including a certificate creator, for receiving certificate attributes of a server computer certificate and for creating a signed certificate therefrom, and an SSL connector, for performing an SSL handshake with the client computer using the signed certificate created by said certificate creator, and a second security computer communicatively coupled with a server computer via an SSL connection, and communicatively coupled with the first security computer via a non-SSL connection, including an SSL connector, for performing an SSL handshake with the server computer using a signed certificate provided by the server computer, and a protocol appender, for appending attributes of the signed certificate provided by the server computer within a message communicated to the first security computer. A method is also described and claimed.
1. A method for secure communication, comprising:
forwarding, from a first security computer to a second security computer, a request from a client computer to connect to a server computer;
establishing an SSL connection between the second security computer and the server computer, comprising performing, by the second security computer, an SSL handshake with the server computer using a signed certificate provided by the server computer;
appending, by the second security computer, attributes of the signed certificate provided by the server computer within a message communicated to the first security computer;
receiving, by the first security computer, certificate attributes of the server computer certificate;
creating, by the first security computer, a signed certificate from the received certificate attributes of the server computer certificate;
establishing an SSL connection between the first security computer and the client computer, comprising performing an SSL handshake with the client computer using the signed certificate created by said creating
managing, by the first security computer, a certificate cache for storing and retrieving attributes of at least one certificate;
deriving, by the first security computer, a hash value for cached attributes of a certificate;
appending, by the first security computer, the hash value for the cached attributes of the certificate within a message communicated to the second security computer;
deriving, by the second security computer, a hash value for attributes of the signed certificate provided by the server computer;
comparing, by the second security computer, the hash value for the cached attributes of the certificate with the hash value for attributes of the signed certificate provided by the server computer, to determine if the certificate attributes match, and
wherein the second security computer appends attributes of the signed certificate provided by the server computer, only when said comparing determines that the cached attributes of the certificate do not match the attributes of the signed certificate provided by the server computer.
2. The method of claim 1 further comprising:
establishing an unencrypted non-SSL connection between the first security computer and an intermediate computer; and
establishing an unencrypted non-SSL connection between the intermediate computer and the second security computer.
3. The method of claim 1 further comprising:
establishing an encrypted non-SSL connection between the first security computer and an intermediate computer; and
establishing an encrypted non-SSL connection between the intermediate computer and the second security computer.
4. The method of claim 1 further comprising:
establishing a permanent connection between the first security computer and an intermediate computer; and
establishing a permanent connection between the intermediate computer and the second security computer.
5. The method of claim 1 wherein certificate attributes include a domain name.
6. The method of claim 1 wherein certificate attributes include a validity date.