F5 Networks, Inc.

Fs Networks, Inc.

John Robert Hughes

Richard Roderick Masters

David Dean Schmitt

Robert George Gilde

Keith R Reynolds

Jesse Abraham Rothstein

Arindum Mukerji

Amit Jain

Peter Michael Thornewell

Eric Joseph Hammerle

Dennis Zhou

A method, system, and apparatus are directed towards enabling access to payload by a third -party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the SSL handshake messages are routed through the proxy, the proxy may extract data. In addition, one of the client or the server may send another message within, or out-of-band to, the series of SSL handshake message directly to the proxy. The other SSL message may include secret data that the proxy may use to generate a session key the SSL connection. With the session key, the proxy may receive SSL messages over the SSL connection, modify and/or transpose the payload within the received SSL messages, and/or terminate the SSL connection at the proxy.

Accessing SSL connection data by a third-party

A system and method for providing persistence in a secure network access by using a client certificate sent by a client device to maintain the identity of a target. A security handshake is performed with a client device to establish a secure session. A target is determined. A client certificate is associated with the target. During subsequent secure sessions, the client certificate is used to maintain persistent communications between the client and a target. A session ID can be used in combination with the client certificate, by identifying the target based on the session ID or the client certificate, depending on which one is available in a client message.

Method and system for providing persistence in a secure network access

A system, apparatus, and method are directed to managing access to a resource using rule-based deep packet extractions of a credential. A network device, such as a traffic management device, is situated between a client device and a server device. When the client device sends a request for a resource, the request is intercepted by the network device. The network device may employ a multi-layer deep packet extraction of the credential from the request. The network device may then use the credential to determine whether the request enabled to access the resource. Based, in part, on a variety of rules, the network device may deny access, enable access, route the request to a different server, or the like. In one embodiment, the network device may receive a rule from another device that directs the network device to request a different credential.

Rule based extensible authentication

Methods and systems are directed to dynamically mirroring a connection between network devices. Mirroring is managed by forwarding a packet between a first network device and a second network device. In one method, the first network device receives the packet from a client and communicates the packet to the second network device. A forwarding device, pre-determined from the first and second network devices, forwards the packet to a server. The first network device receives a response from the server, and communicates it to the second network device. The forwarding device forwards the response packet to the client. In one configuration, the first network device and forwarding device is an active device, and the second network device is a standby device. In another configuration, the first network device is a standby device, and the second network device and forwarding device is an active device.

Dynamic mirroring of a network connection

A system and method for optimizing use of idle server connections comprises receiving, at a first network traffic management device of a cluster, a request from a client device to access a server. The first network traffic management device reserve an idle flow connection from an idle connection pool previously established between at least a second network traffic management device and the server. A flow cookie is retrieved from the second network traffic management device. The flow cookie comprises routing information associated with the retrieved idle flow connection, whereby the flow cookie is modified to represent the connection between the server and the first network traffic management device. The updated flow cookie is incorporated into the received request and forwarded to the server, wherein a server response contains the updated flow cookie such that the response is received by the first network traffic management device.

Dynamic cloning and reservation of detached idle connections

A method, non-transitory computer readable medium and application manager computing device comprises obtaining at least one cryptographic key from a request by a client computing device for a user session. User information corresponding to a user is encrypted or decrypted using the cryptographic key. The request is authenticated based on encryption or decryption of the user information. The cryptographic key is deleted after the completion or termination of the user session.

Methods for managing user information and devices thereof

A method, system, and apparatus are directed towards enabling access to payload by a third-party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the SSL handshake messages are routed through the proxy, the proxy may extract data. In addition, one of the client or the server may send another message within, or out-of-band to, the series of SSL handshake message directly to the proxy. The other SSL message may include secret data that the proxy may use to generate a session key for the SSL connection. With the session key, the proxy may receive SSL messages over the SSL connection, modify and/or transpose the payload within the received SSL messages, and/or terminate the SSL connection at the proxy.

A traffic manager system comprises communications servers, including one or more active and backup servers. At least one of the communications servers mirrors the communications of the other server involving one or more other network devices, including the encrypted communications. At least one backup server obtains a security value associated with the encrypted communications of at least one active server to independently derive the same key. The backup servers use the keys to engage in the encrypted communications when the active servers become unavailable, for example, without requiring the backup server to reinitiate the encrypted communications.

Secure sockets layer protocol handshake mirroring

A system and method for performing asynchronous cryptographic operations. A cryptographic toolkit receives requests for cryptographic operations, and initiates the cryptographic operations within a thread of execution. The toolkit detects when the cryptographic operations are complete, retrieves the results, and returns the results to a calling program. The cryptographic operations are performed in an asynchronous manner, without blocking a calling program. The calling program can specify whether the requested operations are to be performed without blocking.

Growing community of inventors

Seattle, WA, United States of America

John Robert Hughes