Methods for client certificate delegation and devices thereof

Patent metadata

Field	Value
Publication number	US-9800568-B1
Application number	US-201615199807-A
Country	US
Kind code	B1
Filing date	Jun 30, 2016
Priority date	Mar 16, 2016
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

Methods, non-transitory computer readable media, and network traffic management apparatuses that receive a request from a client device to access an application. The request comprises an original certificate. A determination is made when the certificate is valid. Data is extracted from one or more fields of the certificate, when the determining indicates that the user certificate is valid. A delegate certificate comprising the data and signed by a certificate authority trusted by a server device hosting the application is generated. The delegate certificate is sent to the server device. With this technology, network traffic management apparatuses can secure SSL connections using PFS-capable ciphers, while also inspecting payload data in network traffic exchanged between client and server devices in order to provide intelligent services in the network.

First claim

What is claimed is:

1. A method for client certificate delegation implemented by a network traffic management system comprising one or more network traffic management apparatuses, server devices, or client devices, the method comprising:
receiving a request from a client to access an application identified in the request and hosted by a server, the request including an identifying certificate;
executing one or more instructions stored in non-transitory memory that results in one or more actions being performed involving the identifying certificate to generate a delegate certificate, the actions comprising:
extracting data from one or more fields of the identifying certificate when the identifying certificate is valid,
inserting at least a portion of the extracted data into the delegate certificate,
annotating the delegate certificate to include an indication of the application hosted by the server and identified in the request received from the client, and
signing the delegate certificate using a certificate authority that is trusted by the server hosting the application identified in the request; and

sending the delegate certificate to the server along with the request received from the client.

2. The method of claim 1 , further comprising:
receiving an indication from the server that the delegate certificate was successfully validated by the server; and
sending another indication to the client that the delegate certificate was successfully validated.

3. The method of claim 1 , further comprising generating the delegate certificate to have an established lifetime.

4. The method of claim 1 , wherein the annotating further comprises inserting the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate.

5. The method of claim 1 , further comprising:
decrypting one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and
encrypting another one or more communications to be sent to the server using PFS encryption.

6. The method of claim 1 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a local delegate certificate authority having a trust relationship with the trusted issuer certificate authority.

7. A network traffic management apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
receive a request from a client to access an application identified in the request and hosted by a server, the request including an identifying certificate;
perform one or more actions involving the identifying certificate to generate a delegate certificate, the actions comprising:
extracting data from one or more fields of the identifying certificate when the identifying certificate is valid,
inserting at least a portion of the extracted data into the delegate certificate,
annotating the delegate certificate to include an indication of the application hosted by the server and identified in the request received from the client, and
signing the delegate certificate using a certificate authority that is trusted by the server hosting the application identified in the request; and

send the delegate certificate to the server along with the request received from the client.

8. The network traffic management apparatus of claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to:
receive an indication from the server that the delegate certificate was successfully validated by the server; and
send another indication to the client that the delegate certificate was successfully validated.

9. The network traffic management apparatus of claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to generate the delegate certificate to have an established lifetime.

10. The network traffic management apparatus of claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to insert the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate.

11. The network traffic management apparatus of claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to:
decrypt one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and
encrypt another one or more communications to be sent to the server using PFS encryption.

12. The network traffic management apparatus of claim 7 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a local delegate certificate authority having a trust relationship with the trusted issuer certificate authority.

13. A non-transitory computer readable medium having stored thereon instructions for client certificate delegation comprising executable code which when executed by one or more processors, causes the processors to:
receive a request from a client to access an application identified in the request and hosted by a server, the request including an identifying certificate;
perform one or more actions involving the identifying certificate to generate a delegate certificate, the actions comprising:
extracting data from one or more fields of the identifying certificate when the identifying certificate is valid,
insert at least a portion of the extracted data into the delegate certificate,
annotate the delegate certificate to include an indication of the application hosted by the server and identified in the request received from the client, and
sign the delegate certificate using a certificate authority that is trusted by the server hosting the application identified in the request; and

send the delegate certificate to the server along with the request received from the client.

14. The non-transitory computer readable medium of claim 13 , wherein the executable code when executed by the processors further causes the processor to:
receive an indication from the server that the delegate certificate was successfully validated by the server; and
send another indication to the client that the delegate certificate was successfully validated.

15. The non-transitory computer readable medium of claim 13 , wherein the executable code when executed by the processors further causes the processor to generate the delegate certificate to have an established lifetime.

16. The non-transitory computer readable medium of claim 13 , wherein the executable code when executed by the processors further causes the processor to insert the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate.

17. The non-transitory computer readable medium of claim 13 , wherein the executable code when executed by the processors further causes the processor to:
decrypt one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and
encrypt another one or more communications to be sent to the server using PFS encryption.

18. The non-transitory computer readable medium of claim 13 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a

Assignees

• F5 Networks Inc

Inventors

• Moses Joel
• Stewart Kevin
• Church William

Classifications

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title

• H04L63/0464

  using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it · CPC title