BACKGROUND

A middlebox is a network appliance that manipulates Internet traffic by optimizing data flow across the network. Middleboxes can be configured as wide area network (“WAN”) optimizers and can be deployed in pairs across two geographically separated locations to optimize data traffic between the two middleboxes. Middleboxes can be connected through a single link or multiple links such as a leased line link and a broadband link. Middleboxes, which may be called WAN optimizers, can work as a pair of devices with a primary job of optimizing the network traffic and providing better user experience.

For high availability networks, it is common to establish secure connections between two end point entities, for example between a client device and a web server. One or more middleboxes can be deployed between the two end point entities. A middlebox can establish secure session connections with a client device, a server, or another middlebox, for example, using secure session layer (SSL) or a transport layer security (TLS) handshake protocol. Middleboxes can act either passively or actively. For example, a middlebox can passively act by just receiving any data from client device, server, or another appliance, and forwarding them to the next destination (e.g., client device, server, or another appliance). In this scenario, a middlebox does not play a significant role in contributing system optimization. When active, however, the middlebox can perform more than just receiving and forwarding of data. For example, the middlebox can modify communications received from client device, server, or another appliance and send the modified communication to the next destination (e.g., client device, server, or another appliance).

SUMMARY

An appliance includes one or more network interfaces to facilitate secure communications between a client device and a server. The secure communications involve secure session connections between the client device and the appliance, and between the appliance and another appliance. A secure session connection processor is configured to determine, using information in a secure session connection request received from the client device, whether client authentication is required by the server. The secure connection request is provided to the other appliance if the information indicates that client authentication is required by the server. Communications received from the client device are decrypted using a key shared with the client device, and the decrypted communications sent to the other appliance are encrypted using a key shared with the other appliance.

The information in the received secure session connection request may be used to determine whether a lookup table includes information that client authentication is required by the server.

The secure session connection processor may be further configured to access the lookup table upon receipt of the secure session connection request.

The information that client authentication is not required indicates that the appliance is acting as a split proxy mode.

The information that client authentication is required indicates that the appliance is acting as a transparent mode.

The instruction indicates that the other appliance is to initiate a secure session handshake procedure between the other appliance and the server.

The secure session connections are established based on a secure session layer (SSL) or a transport layer security (TLS) handshake protocol.

The secure session connection may be further configured to determine, using information from the secure session connection request, whether the lookup table includes certificate information.

The determination that the lookup table does not include information on client authentication or failing to access the lookup table may further include the secure session connection processor configured to forward the secure session connection request to the other appliance.

The secure session connection processor may be further configured to add an entry in the lookup table, if the entry does not exist for the server, wherein the entry is allocated to store at least one of: mode information, certificate information, information that client authentication is not required by the server, and premaster secret information.

The determination whether the lookup table does not include information on client authentication may further include the secure session connection processor receiving, from the other appliance, information that client authentication is not required by the server. The information is stored in the lookup table that client authentication is not required by the server.

The determination whether the lookup table does not include information on client authentication may further include the secure session connection processor being configured to receive, from the other appliance, certificate Information. The first secure session connection is established using the certificate information in response to the secure connection request. The certificate information is stored in the lookup table.

The secure session connection processor may be further configured to determine whether the lookup table includes premaster secret information, when determining that the appliance is acting as the split proxy mode.

The secure session connection processor may be further configured to send the other appliance a request to decrypt client key exchange, based on determining that the lookup table does not include premaster secret information.

Yet another aspect is directed to a method that includes establishing secure communications between a client device and a server. The secure communications involve secure session connections between the client device and the appliance, and between the appliance and another appliance. A determination is made whether client authentication is required by the server based on using information in a secure session connection request received from the client device. The method may further include providing the secure connection request to the other appliance if the information indicates that client authentication is required by the server, and decrypting communications received from the client device using a key shared with the client device, and encrypting the decrypted communications to be sent to the other appliance using a key shared with the other appliance.

Yet another aspect is directed to a non-transitory computer readable medium for operating an appliance, with the non-transitory computer readable medium having a plurality of computer executable instructions for causing the appliance to perform steps as also described above.

