Riverbed Technology, Inc.

Citrix Systems, Inc.

Paras Suresh Shah

Case Larsen

Shashidhar Merugu

Nitin Gupta

Charles Fraleigh

Yongsub Nam

Eric Ogren

Oleg Smolsky

An appliance includes one or more network interfaces To facilitate secure communications between a client device and a server. The secure communications involve secure session connections between the client device and the appliance, and between the appliance and another appliance. A secure session connection processor is configured to determine, using information in a secure session connection request received from the client device, whether client authentication is required by the server. The secure connection request is provided to the other appliance if the information indicates that client authentication is required by the server. Communications received from the client device are decrypted using a key shared with the client device, and the decrypted communications sent to the other appliance are encrypted using a key shared with the other appliance.

System and method for providing improved optimization for secure session connections

A system for optimizing network traffic is described. The system includes a plurality of appliances. An appliance comprises one or more network interfaces and a secure session connection optimizer module. The one or more network interfaces are configured to facilitate secure communications between a client device and a server, wherein the secure communications involve a plurality of secure session connections comprising a first secure session connection between the client device and the appliance and a second secure session connection between the appliance and another appliance. The secure session connection optimizer module is configured to receive a secure session connection request from the client device, determine, using information from the secure session connection request, whether a lookup table includes information that client authentication is required by the server, if the information indicates that client authentication is not required by the server, provide an instruction to the other appliance, and if the information indicates that client authentication is required by the server, provide the secure connection request to the other appliance over the second secure connection.

Systems and techniques are described for optimizing secure communications. Specifically, a first intermediary and a second intermediary can split-terminate a secure connection handshake or a handshake renegotiation between two computing devices. The first and second intermediaries can then optimize secure communications between the two computing devices.

Optimizing secure communications between a client authenticating server and a mobile client

A method and apparatus are provided for split-terminating a secure client-server communication connection, with client authentication. During handshaking between the client and the server, cooperating network intermediaries relay the handshaking messages, without altering the messages. At least one of the intermediaries possesses a private key of the server, and extracts a set of data fields from the handshaking messages, including a Client-Key-Exchange message that can be decrypted with the private key. The intermediary uses the extracted data to compute the client-server session key separate from the client's and the server's similar computation, and may transmit the key to the other intermediary via a secure communication channel. The client and the server thus establish the end-to-end client-server connection, and may authenticate each other, after which the network intermediaries may intercept and optimize the client-server communications transparently to the client and the server.

Method and apparatus for split-terminating a secure network connection, with client authentication

A local network traffic processor and an application are resident on a common computer system. The application is configured to trust a server certificate issued by a local network traffic processor, the local network traffic processor operatively being paired with a remote network traffic processor. A proxy server certificate, generated using identification information of a server associated with the remote network traffic processor and signed by the local certification authority, is used to establish a secure session between a local network traffic processor and the application.

Growing community of inventors

Sunnyvale, CA, United States of America

Paras Suresh Shah