Citrix Systems, Inc.

Other

Netscaler, Inc.

Sivaprasad R Udupa

Tushar Kanekar

Anil N Shetty

Sergey Verzunov

Rajiv Sinha

Wanqun Bao

Jose Kolencheril Raphel

Venugopal Botlaguduru

Vamsimohan Korrapati

Josephine Suganthi

Michel K Susai

Tejus Ag

Michael K Susai

Systems and methods are disclosed for an appliance to authenticate access of a client to a protected directory on a server via a connection, such as a secure SSL connection, established by the appliance. A method comprises the steps of: receiving, by an appliance, a first request from a client on a first network to access a server on a second network, the appliance providing the client a virtual private network connection from the first network to the second network; determining, by the appliance, the first request comprises access to a protected directory of the server; associating, by the appliance, an authentication policy with the protected directory, the authentication policy specifying an action to authenticate the client's access to the protected directory; and transmitting, by the appliance in response to the authentication policy, a second request to the client for an authentication certificate. Corresponding systems are also disclosed.

Systems and methods for policy based triggering of client-authentication at directory level granularity

A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two or more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.

Systems and methods for bulk encryption and decryption of transmitted data

An apparatus, method and computer program product for guaranteeing network client-server response time while providing a way of putting the client on-hold when the response time temporarily prohibits access to the requested server. The apparatus is implemented within an interface unit connecting a plurality of servers and an on-hold server to the Internet, which is connected to a plurality of clients. According to one aspect of the invention, the method includes the steps of opening a connection between a client and the interface unit; determining which server the client desires a page from; determining the current response time of the requested server; if the response time is acceptable then opening a connection between the interface unit and the requested server if no free connection is open between the interface unit and the requested server; allowing the client to access information on the requested server-via the connections; and closing the connection between the client and the interface unit while keeping open the connection between the interface unit and the requested server. Alternatively, if the response time is not acceptable, then putting the client on-hold by redirecting the client to an on-hold server until the response time of the requested server becomes acceptable. According to a 'on-hold distribution' aspect of the invention, the interface unit determines the on-hold preference of the client and selects the server hosting that on-hold preference. According to another aspect of the invention, instead of utilizing the interface unit, each server has the intelligence to put the client on-hold when applicable.

Apparatus, method and computer program product for guaranteed content delivery incorporating putting a client on-hold based on response time

A method for buffering SSL handshake messages prior to computing a message digest for the SSL handshake includes: conducting, by an appliance with a client, an SSL handshake, the SSL handshake comprising a plurality of SSL handshake messages; storing, by the appliance, the plurality of SSL handshake messages; providing, by the appliance to a message digest computing device in response to receiving a client finish message corresponding to the SSL handshake, the plurality of SSL handshake messages; receiving, by the appliance from the message digest computing device, a message digest corresponding to the provided messages; determining by the appliance, the message digest matches a message digest included in the SSL client finish message; and completing, by the appliance with the client, the SSL handshake. Corresponding systems are also described.

Systems and methods for optimizing SSL handshake processing

A method for enabling efficient SSL handshakes through pre-computing of handshake messages, the method includes: receiving, by an appliance, a server certificate identifying a server; generating, by the appliance, at least one of: (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message; storing, by the appliance, the generated messages; receiving, by the appliance from a client, an SSL client hello message identifying the server; and transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages. Corresponding systems are also described.

A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two ore more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.

A method for enabling efficient SSL handshakes through precomputing of handshake messages, the method includes: receiving, by an appliance, a server certificate identifying a server; generating, by the appliance, at least one of: (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message; storing, by the appliance, the generated messages; receiving, by the appliance from a client, an SSL client hello message identifying the server; and transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages. Corresponding systems are also described.

An apparatus, method and computer program product for guaranteeing network client-server response time while providing a way of putting the client on-hold when the response time temporarily prohibits access to the requested server. The apparatus is implemented within an interface unit connecting a plurality of servers and an on-hold server to the Internet, which is connected to a plurality of clients. According to one aspect of the invention, the method includes the steps of opening a connection between a client and the interface unit; determining which server the client desires a page from; determining the current response time of the requested server; if the response time is acceptable then opening a connection between the interface unit and the requested server if no free connection is open between the interface unit and the requested server; allowing the client to access information on the requested server via the connections; and closing the connection between the client and the interface unit while keeping open the connection between the interface unit and the requested server. Alternatively, if the response time is not acceptable, then putting the client on-hold by redirecting the client to an on-hold server until the response time of the requested server becomes acceptable. According to a 'on-hold distribution' aspect of the invention, the interface unit determines the on-hold preference of the client and selects the server hosting that on-hold preference. According to another aspect of the invention, instead of utilizing the interface unit, each server has the intelligence to put the client on-hold when applicable.

An apparatus, method and computer program product for guaranteeing network client-server response time while providing a way of putting the client on-hold when the response time temporarily prohibits, access to the requested server. The apparatus is implemented within an interface unit connecting a plurality of servers and an on-hold server to the Internet, which is connected to a plurality of clients. According to one aspect of the invention, the method includes the steps of opening a connection between a client and the interface unit; determining which server the client desires a page from; determining the current response time of the requested server; if the response time is acceptable then opening a connection between the interface unit and the requested server if no free connection is open between the interface unit and the requested server; allowing the client to access information on the requested server via the connections; and closing the connection between the client and the interface unit while keeping open the connection between the interface unit and the requested server. Alternatively, if the response time is not acceptable, then putting the client on-hold by redirecting the client to an on-hold server until the response time of the requested server becomes acceptable. According to a &ldquo;on-hold distribution&rdquo; aspect of the invention, the interface unit determines the on-hold preference of the client and selects the server hosting that on-hold preference. According to another aspect of the invention, instead of utilizing the interface unit, each server has the intelligence to put the client on-hold when applicable.

Growing community of inventors

Sunnyvale, CA, United States of America

Sivaprasad R Udupa