公开(公告)号：US10520110B2

公开(公告)日：2019-12-31

申请号：US15289472

申请日：2016-10-10

Applicant: Citrix Systems, Inc.

Inventor： Abhishek Chauhan ,  Tushar Kanekar ,  Ritesh Patani ,  Robert Kidd ,  Sergey Golubev ,  Harpreet Singh

IPC: H04L29/06 ,  F16K37/00 ,  G06F21/60 ,  F15B5/00 ,  F15B19/00 ,  F15B20/00

Abstract: The present disclosure is directed towards systems and methods for executing cryptographic operations across different types of processing hardware. An intermediary device may identify a cryptographic function to be performed at the device, according to a message from a client or a server. The device may identify a sequence of cryptographic operations to be executed for performing the cryptographic function. The device may determine subsets of the cryptographic operations to be executed on across different types of processing hardware. The different types of processing hardware may reside on the device. Each of the types of processing hardware may execute, responsive to the determination, the respective subset of the cryptographic operations, according to the sequence of the cryptographic operations.

公开(公告)号：US09769205B2

公开(公告)日：2017-09-19

申请号：US14245528

申请日：2014-04-04

Applicant: Citrix Systems, Inc.

Inventor： Sikha Gopinath ,  Ashoke Saha ,  Tushar Kanekar

IPC: H04L29/06 ,  H04L29/08

CPC classification number: H04L63/168 ,  H04L63/166 ,  H04L67/1002 ,  H04L67/14 ,  H04L69/30

Abstract: The present invention is directed towards systems and methods for managing one or more SSL sessions. A first node from a cluster of nodes intermediary between a client and a server may receive a first request from the client to use a first session established with the server. The first request may include a session identifier of the first session. The first node may determine that the first session is not identified in a cache of the first node. The first node may identify, via a hash table responsive to the determination, an owner node of the first session from the cluster using a key. The key may be determined based on the session identifier. The first node may send a second request to the identified owner node for session data of the first session. The session data may be for establishing a second session with the server.

公开(公告)号：US20140181531A1

公开(公告)日：2014-06-26

申请号：US14161417

申请日：2014-01-22

Applicant: Citrix Systems, Inc.

Inventor： Ashoke Saha ,  Rajesh Joshi ,  Tushar Kanekar

IPC: G06F21/60

CPC classification number: G06F21/602 ,  H04L63/0485 ,  H04L63/166 ,  H04L69/12

Abstract: The present invention is directed towards systems and methods for distributed operation of a plurality of cryptographic cards in a multi-core system. In various embodiments, a plurality of cryptographic cards providing encryption/decryption resources are assigned to a plurality of packet processing engines in operation on a multi-core processing system. One or more cryptographic cards can be configured with a plurality of hardware or software queues. The plurality of queues can be assigned to plural packet processing engines so that the plural packet processing engines share cryptographic services of a cryptographic card having multiple queues. In some embodiments, all cryptographic cards are configured with multiple queues which are assigned to the plurality of packet processing engines configured for encryption operation.

Abstract translation: 本发明涉及用于在多核系统中分布式操作多个加密卡的系统和方法。 在各种实施例中，向多核处理系统运行的多个分组处理引擎分配了提供加密/解密资源的多个密码卡。 一个或多个加密卡可以配置有多个硬件或软件队列。 可以将多个队列分配给多个分组处理引擎，使得多个分组处理引擎共享具有多个队列的加密卡的加密服务。 在一些实施例中，所有加密卡配置有分配给配置用于加密操作的多个分组处理引擎的多个队列。

公开(公告)号：US09906556B2

公开(公告)日：2018-02-27

申请号：US15486967

申请日：2017-04-13

Applicant: Citrix Systems, Inc.

Inventor： Tushar Kanekar

IPC: H04L29/06 ,  H04L29/08

CPC classification number: H04L63/166 ,  H04L9/3268 ,  H04L9/3271 ,  H04L9/3297 ,  H04L63/0464 ,  H04L63/0471 ,  H04L63/0485 ,  H04L63/0823 ,  H04L63/0876 ,  H04L63/101 ,  H04L67/02 ,  H04L67/1002 ,  H04L67/1027 ,  H04L67/1036 ,  H04L67/146 ,  H04L69/162 ,  H04L2209/043 ,  H04L2209/30 ,  H04L2209/56 ,  H04L2209/60 ,  H04L2209/76 ,  H04L2209/80

Abstract: The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.

公开(公告)号：US09203627B2

公开(公告)日：2015-12-01

申请号：US14100867

申请日：2013-12-09

Applicant: Citrix Systems, Inc.

Inventor： Christofer Edstrom ,  Tushar Kanekar

IPC: H04L9/32 ,  H04L29/06 ,  H04L29/08

CPC classification number: H04L9/3268 ,  H04L63/0823 ,  H04L63/0884 ,  H04L63/166 ,  H04L67/2833 ,  H04L67/2842 ,  H04L67/2852 ,  H04L2209/38

Abstract: The present invention is directed towards systems and methods for batching OCSP requests and caching corresponding responses. An intermediary between a plurality of clients and one or more servers receives a first client certificate during a first SSL handshake with a first client and a second client certificate during a second SSL handshake with a second client. The intermediary may identify that the statuses of the client certificates are not in a cache of the intermediary. An OCSP responder of the intermediary may transmit a single request to an OCSP server to determine the statuses. The intermediary may determine, from a single response received from the OCSP server, whether to establish SSL connections with the clients based on the statuses. The intermediary may store the statuses to the cache for determining whether to establish a SSL connection in response to receiving a client certificate from the first client.

Abstract translation: 本发明涉及用于批量OCSP请求和缓存相应响应的系统和方法。 在与第二客户端的第二次SSL握手期间，在多个客户端和一个或多个服务器之间的中介在与第一客户端的第一次SSL握手和第二客户端证书期间接收第一客户端证书。 中间人可能会识别客户端证书的状态不在中介缓存中。 中间人的OCSP响应者可以向OCSP服务器发送单个请求以确定状态。 中介可以从OCSP服务器收到的单一响应中确定是否根据状态与客户端建立SSL连接。 响应于从第一客户端接收到客户端证书，中介可以将状态存储到高速缓存以确定是否建立SSL连接。

公开(公告)号：US20140304499A1

公开(公告)日：2014-10-09

申请号：US14245528

申请日：2014-04-04

Applicant: Citrix Systems, Inc.

Inventor： Sikha Gopinath ,  Ashoke Saha ,  Tushar Kanekar

IPC: H04L29/06

CPC classification number: H04L63/168 ,  H04L63/166 ,  H04L67/1002 ,  H04L67/14 ,  H04L69/30

Abstract: The present invention is directed towards systems and methods for managing one or more SSL sessions. A first node from a cluster of nodes intermediary between a client and a server may receive a first request from the client to use a first session established with the server. The first request may include a session identifier of the first session. The first node may determine that the first session is not identified in a cache of the first node. The first node may identify, via a hash table responsive to the determination, an owner node of the first session from the cluster using a key. The key may be determined based on the session identifier. The first node may send a second request to the identified owner node for session data of the first session. The session data may be for establishing a second session with the server.

Abstract translation: 本发明涉及用于管理一个或多个SSL会话的系统和方法。 来自客户端和服务器之间的中继节点的第一节点可以从客户端接收使用与服务器建立的第一会话的第一请求。 第一请求可以包括第一会话的会话标识符。 第一节点可以确定在第一节点的高速缓存中没有识别出第一会话。 第一节点可以经由响应于确定的散列表，使用密钥从集群中识别第一会话的所有者节点。 密钥可以基于会话标识符来确定。 第一节点可以向所识别的所有者节点发送第二请求以用于第一会话的会话数据。 会话数据可以用于与服务器建立第二会话。

公开(公告)号：US20140304498A1

公开(公告)日：2014-10-09

申请号：US13858011

申请日：2013-04-06

Applicant: CITRIX SYSTEMS, INC.

Inventor： Swarupa Gonuguntla ,  Ashoke Saha ,  Tushar Kanekar

IPC: H04L29/06

CPC classification number: H04L63/168 ,  H04L63/0281

Abstract: This disclosure is directed to systems and methods for handling the processing of a next protocol negotiation extension for a transport layer security (TLS) session. A device, intermediary to a client and a server, may receive a client hello message from the client in a handshake to establish a transport layer security (TLS) session with the server. The client hello message may include a next protocol negotiation extension. The device may include a first TLS processor that is software based and a second TLS processor that is hardware based. The device may determine that the client hello message includes the next protocol negotiation extension. The device may establish, responsive to the determination, the TLS session using the first TLS processor. The device may process, upon establishment of the TLS session using the first TLS processor, encrypted data for the TLS session using the second TLS processor.

Abstract translation: 本公开涉及用于处理传输层安全（TLS）会话的下一个协议协商扩展的处理的系统和方法。 客户机和服务器的中间设备可以在握手中从客户端接收客户端请求消息，以建立与服务器的传输层安全（TLS）会话。 客户端hello消息可以包括下一个协议协商扩展。 该设备可以包括基于软件的第一TLS处理器和基于硬件的第二TLS处理器。 设备可以确定客户端hello消息包括下一个协议协商扩展。 响应于确定，设备可以使用第一TLS处理器来建立TLS会话。 在使用第一TLS处理器建立TLS会话时，设备可以处理使用第二TLS处理器的TLS会话的加密数据。

公开(公告)号：US20140304354A1

公开(公告)日：2014-10-09

申请号：US14244949

申请日：2014-04-04

Applicant: Citrix Systems, Inc.

Inventor： Abhishek Chauhan ,  Sandhya Gopinath ,  Sandeep Kamath ,  Mahesh Arumugam ,  Tushar Kanekar

IPC: H04L29/08

CPC classification number: H04L67/1097 ,  H04L67/1095

Abstract: The present application is directed towards using a distributed hash table to track the use of resources and/or maintain the persistency of resources across the plurality of nodes in the multi-node system. More specifically, the systems and methods can maintain the persistency of resources across the plurality of nodes by the use of a global table. A global table may be maintained on each node. Each node's global table enables efficient storage and retrieval of distributed hash table entries. Each global table may contain a linked list of the cached distributed hash table entries that are currently stored on a node.

Abstract translation: 本申请涉及使用分布式哈希表来跟踪资源的使用和/或维护多节点系统中的多个节点之间的资源的持续性。 更具体地，系统和方法可以通过使用全局表来维护跨越多个节点的资源的持久性。 可以在每个节点上维护全局表。 每个节点的全局表可以有效地存储和检索分布式哈希表项。 每个全局表可以包含当前存储在节点上的高速缓存的分布式散列表条目的链接列表。