Transparent proxy of encrypted sessions

1. A method, comprising:

intercepting a client-server security session request sent from a client to a server at a proxy device;

initiating, with the server, a proxy-server security session from the proxy device;

obtaining, from the server, server security information at the proxy device;

initiating, with the client, a client-proxy security session from the proxy device using a trusted proxy certificate of the proxy device;

obtaining, from the client, client security information at the proxy device, the client security information having at least a subject name of the client;

creating a dynamic certificate using the obtained subject name of the client and the trusted proxy certificate;

establishing the initiated proxy-server security session with the dynamic certificate; and

establishing the initiated client-proxy security session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.

2. The method as in claim 1 , further comprising:

configuring the server to trust the proxy certificate by installing the proxy certificate on the server.

3. The method as in claim 2 , further comprising:

configuring the client to trust the proxy certificate by pushing the trusted proxy certificate from the server to the client.

4. The method as in claim 1 , wherein the trusted proxy certificate is a proxy Certificate Authority (CA) certificate.

5. The method as in claim 1 , further comprising:

configuring the client to initiate the client-server security session to the server disregarding the existence of the proxy device.

6. The method as in claim 1 , further comprising:

receiving encrypted traffic at the proxy from either the client, over the client-proxy security session, or the server, over the proxy-server security session;

decrypting the encrypted traffic at the proxy;

re-encrypting the decrypted traffic at the proxy for the corresponding proxy-server security session and client-proxy security session; and

transmitting the re-encrypted traffic from the proxy correspondingly to the server over the proxy-server security session and to the client over the client-proxy security session.

7. The method as in claim 6 , wherein the proxy device is a firewall, the method further comprising:

inspecting the decrypted traffic at the firewall.

8. The method as in claim 1 , wherein the client-proxy and proxy-server security sessions are selected from a group consisting of: an authentication session, an encryption session, a Transport Layer Security (TLS) session, a Secure Socket Layer (SSL) session, and an Internet Protocol Security (IPSec) session.

9. The method as in claim 1 , further comprising:

creating a dynamic server certificate using the obtained server security information and the trusted proxy certificate; and

initiating, with the client, the client-proxy security session from the proxy device using the dynamic server certificate.

10. The method as in claim 1 , wherein the trusted proxy certificate is shared to represent one or more servers for each of one or more client-proxy security sessions.

11. The method as in claim 1 , wherein the dynamic certificate for the client is a new certificate created at the proxy device having at least one of a corresponding client subject name, signature algorithm, or certificate extension.

12. The method as in claim 1 , wherein each of the dynamic certificates created by the proxy have a distinct public and private key pair.

13. The method as in claim 1 , wherein all dynamic certificates created by the proxy share a single public and private key pair.

14. The method as in claim 1 , further comprising:

receiving a security session tear-down request at the proxy device; and, in response,

tearing down the client-proxy security session and proxy-server security session.

15. The method as in claim 1 , wherein the dynamic certificate is valid only for a duration of the client-proxy or proxy-server security sessions.

16. The method as in claim 1 , wherein the client-proxy security session is established prior to initiating the proxy-server security session.

17. A node, comprising:

one or more network interfaces adapted to communicate with at least one server and at least one client, wherein the server and the client are configured to trust a proxy certificate of the node;

one or more processors coupled to the network interfaces and adapted to execute one or more processes; and

a memory adapted to store a proxy security process executable by each processor, the proxy security process when executed operable to: i) intercept a client-server security session request sent from the client to the server, ii) initiate, with the server, a proxy-server security session, iii) obtain, from the server, server security information, iv) initiate, with the client, a client-proxy security session using the trusted proxy certificate, v) obtain, from the client, client security information, the client security information having at least a subject name of the client, vi) create a dynamic certificate using the obtained subject name of the client and the trusted proxy certificate, vii) establish the initiated proxy-server security session with the dynamic certificate, and vii) establish the initiated client-proxy security session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.

18. The node as in claim 17 , wherein the proxy security process is further operable to: i) receive encrypted traffic from either the client, over the client-proxy security session, or the server, over the proxy-server security session; ii) decrypt the encrypted traffic; iii) re-encrypt the decrypted traffic for the corresponding proxy-server security session and client-proxy security session; and iv) transmit the re-encrypted traffic correspondingly to the server over the proxy-server security session and to the client over the client-proxy security session.

19. The node as in claim 18 , wherein the memory is further adapted to store a firewall process executable by each processor, the firewall process when executed operable to inspect the decrypted traffic.

20. An apparatus, comprising:

means for intercepting a client-server security session request sent from a client to a server;

means for initiating, with the server, a proxy-server security session;

means for obtaining, from the server, server security information;

means for initiating, with the client, a client-proxy security session using a trusted proxy certificate;

means for obtaining, from the client, client security information, the client security information having at least a subject name of the client;

means for creating a dynamic certificate using the obtained subject name of the client and the trusted proxy certificate;

means for establishing the initiated proxy-server security session with the dynamic certificate; and

means for establishing the initiated client-proxy security session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.

21. A method, comprising:

intercepting, at a proxy device, a client-server security session request from a client to a server;

establishing a client-proxy security session between the client and the proxy device using a trusted proxy certificate of the proxy device and a client certificate having a client subject name of the client;

extracting, by the proxy device, the client subject name of the client from the client certificate using a public key of the client;

generating, by the proxy device, a dynamic client certificate using the client subject name and a private key of the proxy device; and

establishing a proxy-server security session between the proxy device and the server using the dynamic client certificate, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.

22. The method as in claim 21 , further comprising:

receiving encrypted traffic at the proxy device from either the client, over the client-proxy security session, or the server, over the proxy-server security session;

decrypting the encrypted traffic at the proxy device;

re-encrypting the decrypted traffic at the proxy device for the corresponding proxy-server security session or client-proxy security session; and

transmitting the re-encrypted traffic from the proxy device correspondingly to the server over the proxy-server security session or to the client over the client-proxy security session.

23. The method as in claim 22 , further comprising:

processing the decrypted traffic at the proxy device prior to re-encrypting the decrypted traffic.

24. The method as in claim 21 , further comprising:

initiating the client-proxy security session between the client and the proxy device to obtain the client certificate having the client subject name of the client; and

establishing the client-proxy security session between the client and the proxy device in response to establishing the proxy-server security session between the proxy device and the server.

25. The method as in claim 24 , further comprising:

initiating the proxy-server security session between the proxy device and the server prior to initiating the client-proxy security session between the client and the proxy device; and

establishing the proxy-server security session between the proxy device and the server in response to initiating the client-proxy security session between the client and the proxy device and generating the dynamic client certificate from the obtained client certificate.

26. The method as in claim 21 , wherein each dynamic client certificate generated by the proxy device has a distinct public and private key pair.

27. An apparatus, comprising:

one or more network interfaces adapted to communicate with at least one server and at least one client, wherein the server and the client are configured to trust a proxy certificate of the apparatus;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory adapted to store a proxy security process executable by the processor, the proxy security process when executed operable to:

intercept a client-server security session request from a client to a server;

establish a client-proxy security session between the client and the apparatus using the trusted proxy certificate and a client certificate having a client subject name of the client;

extract the client subject name of the client from the client certificate using a public key of the client;

generate a dynamic client certificate using the client subject name and a private key of the apparatus; and

establish a proxy-server security session between the apparatus and the server using the dynamic client certificate, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.

28. The apparatus as in claim 27 , wherein the proxy security process is further operable to:

receive encrypted traffic from either the client, over the client-proxy security session, or the server, over the proxy-server security session;

decrypt the encrypted traffic;

re-encrypt the decrypted traffic for the corresponding proxy-server security session or client-proxy security session; and

transmit the re-encrypted traffic correspondingly to the server over the proxy-server security session or to the client over the client-proxy security session.

29. The apparatus as in claim 28 , wherein the proxy security process is further operable to process the decrypted traffic prior to re-encrypting the decrypted traffic.

30. The apparatus as in claim 29 , wherein the apparatus is a firewall.

31. The apparatus as in claim 27 , wherein the proxy security process is further operable to establish the proxy-server security session between the proxy device and the server prior to establishment of the client-proxy security session between the client and the proxy device, and in response to establishment of the client-proxy security session between the client and the proxy device and generation of the dynamic client certificate.