SECURE DISTRIBUTION OF SESSION CREDENTIALS FROM CLIENT-SIDE TO SERVER-SIDE TRAFFIC MANAGEMENT DEVICES
A traffic management device (TMD), system, and processor-readable storage medium are directed to securely transferring session credentials from a client-side traffic management device (TMD) to a second server-side TMD that replaces a first server-side TMD. In one embodiment, a client-side TMD and the first server-side TMD have copies of secret data associated with an encrypted session between a client device and a server device, including a session key. For any of a variety of reasons, the first server-side TMD is replaced with the second server-side TMD, which may not have the secret data. In response to a request to create an encrypted connection associated with the encrypted session, the client-side TMD encrypts the secret data using the server device's public key and transmits the encrypted secret data to the second server-side TMD. If the second server-side TMD has a copy of the server device's private key, and is therefore considered to be an authentic and trusted TMD, the second sever-side TMD decrypts the secret data and participates in the encrypted connection.
1 . A traffic management device (TMD) for managing network traffic between a client device and a server device, comprising:
a transceiver to send and receive data over a network; and
a processor, in communication with the transceiver, that performs actions, including:
intercepting a request to initiate an encrypted connection associated with an established encrypted session, wherein the established encrypted session includes a client device and a first server-side TMD in communication with the TMD, and wherein the first server-side TMD is in communication with a server device;
encrypting a set of cryptographic primitives associated with the established encrypted session using a public key associated with the server device; and
transmitting the encrypted set of cryptographic primitives to a second server-side TMD, wherein the second server-side TMD replaces the first server-side TMD and the second server-side TMD is enabled to decrypt data associated with the encrypted session.