Patent ID: 7506368
Filing Date: 2009-03-17
Classification: H04L

Abstract:
1. A method, comprising: engaging in a first authentication process to establish a first secure connection between a client and a data communications device, the first secure connection existing in an untrusted public access network and imposing a first relatively high level of endpoint security overhead onto the data communications device, the first authentication process being engaged in according to a first predetermined handshaking operation of a first protocol for establishing the first secure connection and including authenticating the client to the data communications device based on a client certificate from the client, the client certificate including (a) client information identifying the client and (b) a first digital signature of a certificate authority, the client information including (i) a client public key, (ii) a client distinguished name, and (iii) a certificate authority distinguished name, the client distinguished name including (iv) organization information identifying a client organization, and (v) address information identifying an address of the client organization; engaging in a second authentication process to establish a second secure connection between the data communications device and a server, the server being part of a server farm disposed in a intranet configured to receive concurrent data traffic messages from a plurality of clients, the intranet being a trusted network, the second secure connection corresponding to a security level of the intranet and imposing a second relatively low level of endpoint security overhead onto the data communications device less than the first level of endpoint security overhead, the second authentication process being engaged in according to a second predetermined handshaking operation of a second protocol for establishing the second secure connection and including authenticating the data communications device to the server based on a pseudo credential generated by the data communications device and sent to the server, the pseudo credential including (a) the client information from the client certificate, and (b) a second digital signature of the data communications device, such that from the perspective of the server the second secure connection is a connection to the client and not to the data communications device, the second digital signature being generated using a key pair that is known privately between the data communications device and the server; and combining the first secure connection with the second secure connection to form a secure end-to-end connection between the client and the server, the secure end-to-end connection being utilized to exchange data traffic messages between the client and the server device such that the server views data traffic messages generated by the data communications device as trusted data traffic messages from the client.