公开(公告)号：US20100325429A1

公开(公告)日：2010-12-23

申请号：US12489331

申请日：2009-06-22

申请人： Ashoke Saha ,  Christofer Edstrom ,  Tushar Kanekar

发明人： Ashoke Saha ,  Christofer Edstrom ,  Tushar Kanekar

IPC分类号： H04L9/00

CPC分类号： H04L63/0823 ,  H04L9/3268 ,  H04L63/166

摘要： The present invention is directed towards systems and methods for maintaining Certificate Revocation Lists (CRLs) for client access in a multi-core system. A first core may generate a secondary CRL corresponding to a master CRL maintained by the first core. The CRLs may identify certificates to revoke. The first core can store the secondary CRL to a memory element accessible by the cores. A second core may receive a request to validate a certificate. The second core can provisionally determine, via access to the secondary CRL, whether the certificate is revoked. The second core may also determine not to revoke the certificate. Responsive to the determination, the second core may request the first core to validate the certificate. The first core can determine whether to revoke the certificate based on the master CRL. The first core may send a message to the second core based on the determination.

摘要翻译： 本发明涉及用于在多核系统中维护用于客户端访问的证书吊销列表（CRL）的系统和方法。 第一核心可以产生对应于由第一核心维护的主CRL的次级CRL。 CRL可以识别要撤销的证书。 第一个核心可以将次级CRL存储到可由内核访问的内存元素。 第二个核心可能会收到验证证书的请求。 第二个核心可以通过访问次级CRL临时确定证书是否被撤销。 第二核心也可能决定不撤销证书。 响应确定，第二个核心可能要求第一个核心验证证书。 第一个核心可以确定是否根据主CRL撤销证书。 基于确定，第一核心可以向第二核心发送消息。

公开(公告)号：US09654505B2

公开(公告)日：2017-05-16

申请号：US12489325

申请日：2009-06-22

申请人： Tushar Kanekar

发明人： Tushar Kanekar

IPC分类号： H04L29/06 ,  H04L29/08 ,  H04L9/32

CPC分类号： H04L63/166 ,  H04L9/3268 ,  H04L9/3271 ,  H04L9/3297 ,  H04L63/0464 ,  H04L63/0471 ,  H04L63/0485 ,  H04L63/0823 ,  H04L63/0876 ,  H04L63/101 ,  H04L67/02 ,  H04L67/1002 ,  H04L67/1027 ,  H04L67/1036 ,  H04L67/146 ,  H04L69/162 ,  H04L2209/043 ,  H04L2209/30 ,  H04L2209/56 ,  H04L2209/60 ,  H04L2209/76 ,  H04L2209/80

摘要： The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.

公开(公告)号：US08566925B2

公开(公告)日：2013-10-22

申请号：US11462350

申请日：2006-08-03

申请人： Sivaprasad Udupa ,  Tushar Kanekar ,  Tejus Ag

发明人： Sivaprasad Udupa ,  Tushar Kanekar ,  Tejus Ag

IPC分类号： H04L29/00

CPC分类号： H04L63/10 ,  H04L63/0272 ,  H04L63/0428 ,  H04L63/0823 ,  H04L63/166 ,  H04L63/20 ,  H04L2463/144

摘要： Systems and methods are disclosed for an appliance to authenticate access of a client to a protected directory on a server via a connection, such as a secure SSL connection, established by the appliance. A method comprises the steps of: receiving, by an appliance, a first request from a client on a first network to access a server on a second network, the appliance providing the client a virtual private network connection from the first network to the second network; determining, by the appliance, the first request comprises access to a protected directory of the server; associating, by the appliance, an authentication policy with the protected directory, the authentication policy specifying an action to authenticate the client's access to the protected directory; and transmitting, by the appliance in response to the authentication policy, a second request to the client for an authentication certificate. Corresponding systems are also disclosed.

摘要翻译： 公开的系统和方法用于通过由设备建立的连接（例如安全SSL连接）来认证客户端访问服务器上的受保护目录的系统和方法。 一种方法包括以下步骤：由设备从第一网络的客户端接收访问第二网络上的服务器的第一请求，所述设备向客户端提供从第一网络到第二网络的虚拟专用网络连接 ; 由设备确定第一请求包括访问服务器的受保护目录; 该设备将认证策略与受保护目录相关联，认证策略指定用于认证客户端对受保护目录的访问的动作; 以及响应于所述认证策略，所述设备向所述客户端发送用于认证证书的第二请求。 还公开了相应的系统。

公开(公告)号：US08312308B2

公开(公告)日：2012-11-13

申请号：US12489320

申请日：2009-06-22

申请人： Tushar Kanekar

发明人： Tushar Kanekar

IPC分类号： H04L29/06 ,  G06F1/04 ,  G06F7/04

CPC分类号： H04L63/0823 ,  H04L63/101 ,  H04L63/166 ,  H04L67/02 ,  H04L67/1002

摘要： The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.

摘要翻译： 本发明涉及用于在多核系统中管理SSL会话持久性和重用的系统和方法。 第一核心可以指示由第一核心建立的SSL会话是不可恢复的。 响应于指示，核心可以在由多核系统的每个核心访问的存储器中的位置处设置指示符，该指示符指示SSL会话不可恢复。 多核系统的第二核心可以接收重新使用SSL会话的请求。 请求可以包括SSL会话的会话标识符。 此外，会话标识符可以将第一核心识别为SSL会话的建立者。 第二核心可以从会话标识符的编码中识别第二核心是否不是SSL会话的建立者。 响应于识别，第二个核心可能决定是否恢复SSL会话。

公开(公告)号：US08095787B2

公开(公告)日：2012-01-10

申请号：US11466030

申请日：2006-08-21

申请人： Tushar Kanekar ,  Sivaprasad Udupa

发明人： Tushar Kanekar ,  Sivaprasad Udupa

IPC分类号： H04L29/00

CPC分类号： H04L63/166

摘要： A method for buffering SSL handshake messages prior to computing a message digest for the SSL handshake includes: conducting, by an appliance with a client, an SSL handshake, the SSL handshake comprising a plurality of SSL handshake messages; storing, by the appliance, the plurality of SSL handshake messages; providing, by the appliance to a message digest computing device in response to receiving a client finish message corresponding to the SSL handshake, the plurality of SSL handshake messages; receiving, by the appliance from the message digest computing device, a message digest corresponding to the provided messages; determining by the appliance, the message digest matches a message digest included in the SSL client finish message; and completing, by the appliance with the client, the SSL handshake. Corresponding systems are also described.

摘要翻译： 用于在计算用于SSL握手的消息摘要之前缓存SSL握手消息的方法包括：由具有客户端的设备进行SSL握手，所述SSL握手包括多个SSL握手消息; 由设备存储多个SSL握手消息; 响应于接收到与所述SSL握手相对应的客户端完成消息，所述设备向消息摘要计算设备提供所述多个SSL握手消息; 由所述设备从所述消息摘要计算设备接收与所提供的消息相对应的消息摘要; 由设备确定消息摘要与SSL客户端完成消息中包含的消息摘要相匹配; 并由用户与客户端完成SSL握手。 还描述了相应的系统。

公开(公告)号：US20110154017A1

公开(公告)日：2011-06-23

申请号：US12645664

申请日：2009-12-23

申请人： Christofer Edstrom ,  Tushar Kanekar

发明人： Christofer Edstrom ,  Tushar Kanekar

IPC分类号： H04L29/06

CPC分类号： H04L9/3268 ,  H04L63/0823 ,  H04L63/0884 ,  H04L63/166 ,  H04L67/2819 ,  H04L2209/38

摘要： The present invention is directed towards systems and methods for determining a status of a client certificate from a plurality of responses for an Online Certificate Status Protocol (OCSP) request. An intermediary device between a plurality of clients and one or more servers identifies a plurality of OCSP responders for determining a status of a client certificate responsive to receiving the client certificate from a client during a Secure Socket Layer (SSL) handshake. Each of the plurality of OCSP responders may transmit a request for the status of the client certificate to a uniform resource locator corresponding to each OCSP responder. The intermediary device may determine a single status for the client certificate from a plurality of statuses of the client certificate received via responses from each uniform resource locator.

摘要翻译： 本发明涉及用于根据在线证书状态协议（OCSP）请求的多个响应来确定客户端证书的状态的系统和方法。 多个客户端和一个或多个服务器之间的中间设备在安全套接层（SSL）握手期间，响应于从客户端接收到客户端证书，识别多个OCSP应答器，用于确定客户端证书的状态。 多个OCSP应答器中的每一个可以向与每个OCSP响应器对应的统一资源定位符发送客户端证书的状态请求。 中介设备可以根据从每个统一资源定位符的响应接收到的客户端证书的多个状态来确定客户端证书的单一状态。

公开(公告)号：US08838958B2

公开(公告)日：2014-09-16

申请号：US13712658

申请日：2012-12-12

申请人： Josephine Suganthi ,  Tushar Kanekar ,  Sivaprasad Udupa

发明人： Josephine Suganthi ,  Tushar Kanekar ,  Sivaprasad Udupa

IPC分类号： H04L29/06

CPC分类号： H04L63/0428

摘要： A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two or more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.

摘要翻译： 一种使用网络设备有效地缓冲和加密用于传输的数据的方法包括：由设备经由连接接收包括加密消息的两个或更多个SSL记录; 解密两个或多个消息; 由设备缓冲两个或更多个解密的消息; 由设备确定已经满足传送条件; 所述设备响应于所述确定，加密所述第一解密消息和所述第二解密消息的一部分以产生第三SSL记录; 以及由所述器具经由第二连接发送所述第三记录。 还描述了相应的系统。

公开(公告)号：US20130145146A1

公开(公告)日：2013-06-06

申请号：US13712658

申请日：2012-12-12

申请人： Josephine Suganthi ,  Tushar Kanekar ,  Sivaprasad Udupa

发明人： Josephine Suganthi ,  Tushar Kanekar ,  Sivaprasad Udupa

IPC分类号： H04L29/06

CPC分类号： H04L63/0428

摘要： A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two or more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.

摘要翻译： 一种使用网络设备有效地缓冲和加密用于传输的数据的方法包括：由设备经由连接接收包括加密消息的两个或更多个SSL记录; 解密两个或多个消息; 由设备缓冲两个或更多个解密的消息; 由设备确定已经满足传送条件; 所述设备响应于所述确定，加密所述第一解密消息和所述第二解密消息的一部分以产生第三SSL记录; 以及由所述器具经由第二连接发送所述第三记录。 还描述了相应的系统。

公开(公告)号：US20110154026A1

公开(公告)日：2011-06-23

申请号：US12645893

申请日：2009-12-23

申请人： Christofer Edstrom ,  Tushar Kanekar

发明人： Christofer Edstrom ,  Tushar Kanekar

IPC分类号： H04L29/06 ,  H04L9/32

CPC分类号： H04L9/3268 ,  H04L63/0823 ,  H04L63/166 ,  H04L67/2833 ,  H04L67/2842 ,  H04L2209/043 ,  H04L2209/30 ,  H04L2209/60 ,  H04L2209/76 ,  H04L2209/80

摘要： The present invention is directed towards systems and methods for processing an Online Certificate Status Protocol (OCSP) request in parallel to processing a Secure Socket Layer (SSL) handshake. The method includes transmitting, by an OCSP responder of an intermediary device between a plurality of clients and one or more servers, an OCSP request to a OCSP server for a status of a client certificate responsive to receiving the client certificate from a client during a SSL handshake. The intermediary device may continue to perform remaining portions of the SSL handshake while the OCSP request to the OCSP server is outstanding. The intermediary device may establish an SSL connection for the SSL handshake. The intermediary device may determine whether to terminate or maintain the established SSL connection based on the status of the client certificate received via a response from the OCSP server.

摘要翻译： 本发明涉及用于处理在线证书状态协议（OCSP）请求并行处理安全套接层（SSL）握手的系统和方法。 该方法包括在多个客户端和一个或多个服务器之间由中间设备的OCSP应答器向OCSP服务器发送响应于在SSL期间从客户端接收客户端证书的客户端证书的状态的OCSP请求 握手 当向OCSP服务器的OCSP请求未完成时，中间设备可以继续执行SSL握手的剩余部分。 中间设备可以建立用于SSL握手的SSL连接。 中介设备可以基于经由OCSP服务器的响应接收到的客户端证书的状态来确定是否终止或维护已建立的SSL连接。

公开(公告)号：US20100325418A1

公开(公告)日：2010-12-23

申请号：US12489320

申请日：2009-06-22

申请人： Tushar Kanekar

发明人： Tushar Kanekar

IPC分类号： H04L29/06

CPC分类号： H04L63/0823 ,  H04L63/101 ,  H04L63/166 ,  H04L67/02 ,  H04L67/1002

摘要： The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.

摘要翻译： 本发明涉及用于在多核系统中管理SSL会话持久性和重用的系统和方法。 第一核心可以指示由第一核心建立的SSL会话是不可恢复的。 响应于指示，核心可以在由多核系统的每个核心访问的存储器中的位置处设置指示符，该指示符指示SSL会话不可恢复。 多核系统的第二核心可以接收重新使用SSL会话的请求。 请求可以包括SSL会话的会话标识符。 此外，会话标识符可以将第一核心识别为SSL会话的建立者。 第二核心可以从会话标识符的编码中识别第二核心是否不是SSL会话的建立者。 响应于识别，第二个核心可能决定是否恢复SSL会话。