Patent ID: 8707043

Claim:
A method of facilitating split-termination of a secure communication connection between a client computing device and a server computing device that perform mutual authentication, the method comprising, at a first intermediate network device situated in a communication path between the client and the server: intercepting a client digital certificate transmitted toward the server by the client; generating a substitute digital certificate in a name of the client, wherein said generating comprises: constructing a substitute client private key and a substitute client public key; and signing the substitute digital certificate with a private key of a certificate authority recognized by the server; transmitting the substitute digital certificate to the server; intercepting a message addressed to the client and issued by the server after the server receives the substitute digital certificate; decrypting the message with a key associated with the substitute digital certificate; extracting a ticket from the message; re-encrypting the message with a key associated with the client digital certificate; forwarding the re-encrypted message toward the client; extracting a temporary key from the ticket; and using the temporary key to retrieve a session key from a subsequent message issued by the server and addressed to the client.