Optimizing secure communications between a client authenticating server and a mobile client
View Patent ↗Systems and techniques are described for optimizing secure communications. Specifically, a first intermediary and a second intermediary can split-terminate a secure connection handshake or a handshake renegotiation between two computing devices. The first and second intermediaries can then optimize secure communications between the two computing devices.
1. A method for optimizing secure communications between a client and a server, wherein messages between the client and the server pass through a client-side intermediary and a server-side intermediary, the method comprising:
adding the client-side intermediary to a group of certificate authorities that are trusted by the client;
split-terminating a secure connection handshake between the client and the server, wherein said split-terminating comprises:
the client-side intermediary creating a second digital certificate for the server based on a first digital certificate issued to the server by a certificate authority other than the client-side intermediary;
the client-side intermediary completing a first secure connection handshake between the client and the client-side intermediary;
the client-side intermediary determining a first session key based on information obtained during the first secure connection handshake;
the client-side intermediary creating a certificate verification message that is encrypted using a private key associated with the client;
the client side intermediary sending the certificate verification message to the server-side intermediary, thereby enabling the server-side intermediary to complete a second secure connection handshake between the server-side intermediary and the server; and
the server-side intermediary determining a second session key based on information obtained during the second secure connection handshake;
the client-side intermediary using the first session key to securely communicate with the client; and
the server-side intermediary using the second session key to securely communicate with the server.
2. The method of claim 1 , wherein said adding the client-side intermediary to the group of certificate authorities that are trusted by the client is performed by the client-side intermediary.
3. The method of claim 1 , wherein the client-side intermediary has access to the private key associated with the client.
4. The method of claim 1 , further comprising:
establishing a secure connection between the client-side intermediary and the server-side intermediary.
5. The method of claim 1 , wherein said split-terminating further comprises:
receiving a set of security protocols supported by the client;
modifying the set of security protocols by adding and/or removing one or more security protocols; and
sending the modified set of security protocols to the server.
6. A method for optimizing secure communications between a client and a server, wherein messages between the client and the server pass through a client-side intermediary and a server-side intermediary, the method comprising:
adding the client-side intermediary to a group of certificate authorities that are trusted by the client;
split-terminating a secure connection handshake between the client and the server, wherein the secure connection handshake does not require client authentication, and wherein said split-terminating the secure connection handshake comprises creating a second digital certificate for the server based on a first digital certificate issued to the server by a certificate authority other than the client-side intermediary;
split-terminating a handshake renegotiation between the client and the server, wherein the handshake renegotiation requires client authentication, and wherein said split-terminating the handshake renegotiation comprises:
the client-side intermediary completing a first handshake renegotiation between the client and the client-side intermediary;
the client-side intermediary determining a first session key based on information obtained during the first handshake renegotiation;
the client-side intermediary creating a certificate verification message that is encrypted using a private key associated with the client;
the client side intermediary sending the certificate verification message to the server-side intermediary, thereby enabling the server-side intermediary to complete a second handshake renegotiation between the server-side intermediary and the server; and
the server-side intermediary determining a second session key based on information obtained during the second handshake renegotiation;
the client-side intermediary using the first session key to securely communicate with the client; and
the server-side intermediary using the second session key to securely communicate with the server.
7. The method of claim 6 , wherein said adding the client-side intermediary to the group of certificate authorities that are trusted by the client is performed by the client-side intermediary.
8. The method of claim 6 , wherein the client-side intermediary has access to the private key associated with the client.
9. The method of claim 6 , further comprising:
establishing a secure connection between the client-side intermediary and the server-side intermediary.
10. A non-transitory computer-readable storage medium storing instructions that, when executed by a client-side intermediary, cause the client-side intermediary to perform a method for optimizing secure communications between a client and a server, wherein messages between the client and the server pass through the client-side intermediary and a server-side intermediary, the method comprising:
adding the client-side intermediary to a group of certificate authorities that are trusted by the client;
split-terminating a secure connection handshake between the client and the server, wherein said split-terminating comprises:
creating a second digital certificate for the server based on a first digital certificate issued to the server by a certificate authority other than the client-side intermediary;
completing a first secure connection handshake between the client and the client-side intermediary;
determining a first session key based on information obtained during the first secure connection handshake;
creating a certificate verification message that is encrypted using a private key associated with the client; and
sending the certificate verification message to the server-side intermediary, thereby: (1) enabling the server-side intermediary to complete a second secure connection handshake between the server-side intermediary and the server, (2) enabling the server-side intermediary to determine a second session key based on information obtained during the second handshake renegotiation, and (3) enabling the server-side intermediary to use the second session key to securely communicate with the server; and
using the first session key to securely communicate with the client.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the client-side intermediary has access to the private key associated with the client.
12. The non-transitory computer-readable storage medium of claim 10 , wherein the method further comprising establishing a secure connection with the server-side intermediary.
13. The non-transitory computer-readable storage medium of claim 10 , wherein said split-terminating further comprises:
receiving a set of security protocols supported by the client;
modifying the set of security protocols by adding and/or removing one or more security protocols; and
sending the modified set of security protocols to the server.