Method for generating actions based on TLS parameters and apparatus therefor

Abstract

Methods, non-transitory computer-readable media, network traffic manager devices, and systems to assist in generating insights with TLS parameters include receiving a request from a client to establish a TLS connection to a server. In some examples, the request includes parameters for the TLS connection. Next, the network traffic manager device determines an identity of the client based on the TLS parameter unique to the client in the request, and performs an action to alter handling of the request based on the TLS parameter.

Description

Technical Field

[0001] The present technology relates to methods and systems for generating actions for handling network traffic based on parameters in TLS messages. Background Art

[0002] Network systems typically manage encrypted network traffic. Unfortunately, some of this encrypted traffic may pose risks, yet the encrypted data makes assessment opaque. As a result, necessary security actions and / or network traffic management actions (such as adjustments to traffic paths) cannot be effectively performed or otherwise managed. Summary of the invention

[0003] A method for generating an action through TLS parameters, implemented in cooperation with a network traffic management system including one or more network traffic management modules, server modules or client modules, the method comprising receiving a request from a client to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection. The identity of the client is determined based on the TLS parameters unique to the client in the request. Based on the identity of the client determined from the TLS parameters, an action is performed for the request.

[0004] A network traffic management device includes: a memory having programmed instructions stored thereon; and one or more processors configured to be capable of executing the stored programmed instructions to receive a request from a client to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection. The identity of the client is determined based on the TLS parameters unique to the client in the request. An action is performed for the request based on the identity of the client determined from the TLS parameters.

[0005] A non-transitory computer readable medium having stored thereon instructions for including executable code, which, when executed by one or more processors, causes the processor to receive a request from a client to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection. The identity of the client is determined based on the TLS parameters unique to the client in the request. Based on the identity of the client determined from the TLS parameters, an action is performed with respect to the request.

[0006] A network traffic management system includes one or more traffic management modules, a server module or a client module, a memory having programmed instructions stored thereon, and one or more processors, the one or more processors being configured to be able to execute the stored programmed instructions to receive a request from a client to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection. The identity of the client is determined based on the TLS parameters unique to the client in the request. An action is performed on the request based on the identity of the client determined from the TLS parameters.

[0007] The present technology provides several advantages including providing methods, non-transitory computer-readable media, network traffic management devices, and network traffic management systems, which help improve the performance and security of the network by managing encrypted traffic. An example of the present technology is able to identify a client based on parameters of a TLS handshake message, and then any necessary actions can be determined and performed based on that identification of the client. Therefore, an example of the present technology is able to manage encrypted traffic more quickly and more efficiently. In addition, taking the present technology as an example, if the identified client is identified as a suspicious source, the technology can help effectively review and direct traffic from this suspicious client through different service chains to manage security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 is a block diagram of an exemplary network traffic management system having a network traffic management device;

[0009] Figure 2 is a flow chart of an exemplary method for performing an action based on a TLS parameter;

[0010] Figure 3 is a diagram of an exemplary TLS or SSL connection process; and

[0011] Figure 4 is an exemplary sequence flow diagram illustrating a method for performing actions based on TLS parameters. DETAILED DESCRIPTION

[0012] Figure 1 An example of a network environment 10 is shown that incorporates a Figure 1 The network traffic manager device 14 shown in FIG. 1 generates an action for a network traffic management system. The exemplary environment includes a plurality of client computing devices 12(1) to 12(n), a network traffic manager device 14, and a plurality of servers 16(1) to 16(n) coupled together via a communication network 30, although the environment may include other types and numbers of systems, devices, components and / or elements and other topologies and deployments.

[0013] More specifically, refer to Figure 1 , a network traffic manager device 14 of the network traffic management system is coupled to a plurality of client computing devices 12(1) to 12(n) via a communication network 30, although the plurality of client computing devices 12(1) to 12(n) and the network traffic manager device 14 may also be coupled together via other topologies. In addition, the network traffic manager device 14 is coupled to a plurality of servers 16(1) to 16(n) via the communication network 30, although the plurality of servers 16(1) to 16(n) and the network traffic manager device 14 may also be coupled together via other topologies. Although not shown, the exemplary environment may include additional network components, such as routers, switches, and other devices, which are well known to those of ordinary skill in the art and are therefore not described in detail herein. The communication network 30 may be a wide area network (WAN) or a local area network (LAN). Other network devices configured to generate, send, and receive network communications may be used.

[0014] In one such example, at least one network traffic management device 14 is disposed on the client side of a WAN associated with a LAN connecting a number of client computing devices 12(1) to 12(n). Although network traffic management devices 14 are shown in this example, the environment may be coupled in other configurations.

[0015] The network traffic manager device 14 assists in generating the actions shown and described herein by way of example, although the network traffic manager device 14 may perform other types and / or numbers of functions. As an example, the network traffic manager device 14 may perform directing, optimizing, securing, and accelerating network traffic between client computing devices 12(1) to 12(n) and a plurality of servers 16(1) to 16(n). Figure 1 As shown, the network traffic manager device 14 includes at least one processor or central processing unit (CPU) 18, memory 20, and a communication system 24 coupled together by a bus arrangement, but in other configurations, the network traffic manager device 14 may include other types and numbers of elements. In this example, the bus is a PCI Express bus, although other bus types and links may also be used.

[0016] Each of the client computing devices 12(1) to 12(n) and each of the plurality of servers 16(1) to 16(n) includes a central processing unit (CPU) or processor 18, memory 22, interface devices, and I / O systems coupled together by a bus or other link, although other numbers and types of network devices may be used. The client computing devices 12(1) to 12(n) may run an interface application (such as a web browser) that may provide an interface to request and send content and / or data to applications or services provided by the server computing devices 20(1) to 20(n) via the communication network 30, LAN, and / or WAN using the network traffic manager device 14.

[0017] In some examples, the network traffic manager device 14 can be a proxy that sits between the plurality of servers 16(1) to 16(n) and the plurality of client computing devices 12(1) to 12(n). In one example, the proxy can be a third party interposed between one of the plurality of client computing devices 12(1) to 12(n) and one of the plurality of servers 16(1) to 16(n) (or the network traffic manager device 14). Generally speaking, the plurality of servers 16(1) to 16(n) process requests received from the network traffic manager device 14 and send the requests from the client computing devices 12(1) to 12(n) to the network traffic manager device 14 via a communication network 30 (such as a LAN and / or WAN) according to an HTTP-based application RFC protocol or a CIFS or NFS protocol. Various network processing applications (such as CIFS applications, NFS applications, HTTP Web server computing device applications and / or FTP applications) may operate on multiple servers 16(1) to 16(n) and transmit data (e.g., files, Web pages) to the network traffic manager device 14 in response to requests from the network traffic manager device 14.

[0018] The processor 18 within the network traffic manager device 14 may execute one or more computer-executable instructions stored in the memory 20 for use in the methods shown and described with reference to the examples herein, although the processor 18 may execute other types and numbers of instructions and perform other types and numbers of operations. The processor 18 may include one or more central processing units ("CPUs") or general-purpose processors having one or more processing cores, such as a processor 18. processor, although other types of processors may also be used (e.g. ).

[0019] The memory 20 within the network traffic manager device 14 may include one or more tangible storage media, such as RAM, ROM, flash memory, CD-ROM, floppy disk, hard drive, solid-state memory, DVD, or any other memory storage type or device known to those skilled in the art (including combinations thereof). The memory 20 may store one or more non-transitory computer-readable instructions of the present technology, which may be executed by the processor 18 as shown and described with reference to the examples herein. Figure 2 and 4 The exemplary flow shown in represents example steps or actions of the present technology, which may be embodied or expressed as one or more non-transitory computer or machine-readable instructions stored in the memory 20 and executable by the processor 18.

[0020] Thus, the memory 20 of the network traffic manager device 14 may store one or more application programs that may include computer executable instructions that, when executed by the network traffic manager device 14, cause the network traffic manager device 14 to perform actions, such as transmitting, receiving, or otherwise processing messages, for example, and perform the following references to Figure 2 and 4 Other actions described and shown. An application may be implemented as a module or component of another application. Furthermore, an application may be implemented as an operating system extension, module, plug-in, and the like. An application may be implemented as a module or component of another application. Furthermore, an application may be implemented as an operating system extension, module, plug-in, and the like. Even further, an application may operate in a cloud-based computing environment. An application may be executed in a virtual machine or virtual server that can be managed in a cloud-based computing environment. Moreover, applications including the network traffic manager device 14 itself may be located in a virtual server that runs in a cloud-based computing environment rather than being bound to one or more specific physical network computing devices. Moreover, an application may run in one or more virtual machines (VMs) executing on the network traffic manager device 14. In addition, in at least one of the various examples, the virtual machines running on the network traffic manager device 14 may be managed or supervised by a hypervisor.

[0021] The communication system in the network traffic manager device 14 is used to operatively couple and communicate between the network traffic manager device 14, multiple client computing devices 12(1) to 12(n), and multiple servers 16(1) to 16(n), all of which are coupled together through a communication network 30 (e.g., one or more local area networks (LANs) and / or wide area networks (WANs)), although other types and numbers of communication networks 30 or systems with other types and numbers of connections and configurations with other devices and elements may also be used. By way of example only, the communication networks 30, such as local area networks (LANs) and wide area networks (WANs), may use TCP / IP over Ethernet and industry standard protocols including NFS, CIFS, SOAP, XML, LDAP, and SNMP, although other types and numbers of communication networks may also be used. In this example, the bus is a PCI Express bus, although other bus types and links may also be used. In this example, the LAN may employ any suitable interface mechanism and network communication technology, including, for example, any suitable form of telecommunication service (e.g., voice, modem, etc.), a public switched telephone network (PSTN), an Ethernet-based packet data network (PDN), combinations thereof, etc. The WAN may include any wide area network (e.g., the Internet), although any other type of traffic network topology may also be used.

[0022] Each of the plurality of client computing devices 12(1) to 12(n) of the network traffic management system 10 includes a central processing unit (CPU) or processor 18, memory, input / display device interface, and input / output system or I / O system coupled together by a bus or other link. In this example, the plurality of client computing devices 12(1) to 12(n) can run an interface application that can provide an interface to make requests to and send data to and / or receive data from a plurality of servers 16(1) to 16(n) via the network traffic manager device 14. In addition, the plurality of client computing devices 12(1) to 12(n) can include any type of computing device capable of receiving, presenting, and facilitating user interaction, such as a client computer, a network computer, a mobile computer, a mobile phone, a virtual machine (including a cloud-based computer), and the like. Each of the plurality of client computing devices 12(1) to 12(n) utilizes the network traffic manager device 14 to perform one or more operations with the plurality of servers 16(1) to 16(n).

[0023] Each of the plurality of servers 16(1) to 16(n) of the network traffic management system includes a central processing unit (CPU) or processor 18, a memory, and a communication system 24 coupled together by a bus or other link, but other numbers and / or types of network devices may also be used. In general, the plurality of servers 16(1) to 16(n) may include any computing device capable of communicating packets to another network device. Each packet may convey a piece of information. Packets may be sent for handshaking, such as to establish a connection or to acknowledge receipt of data. Packets may include information such as requests, responses, and the like. In general, packets received by the plurality of servers 16(1) to 16(n) may be formatted according to TCP / IP, but the packets may also be formatted using other protocols such as SCTP, X.25, NetBEUI, IPX / SPX, Token Ring, similar IPv4 / 6 protocols, and the like. Furthermore, packets may be communicated between the plurality of servers 16(1) to 16(n), the plurality of client computing devices 12(1) to 12(n), and the network traffic management system 10 using HTTP, HTTPS, and the like. It should be understood that the multiple servers 16(1) to 16(n) can be hardware or software, or can represent a system with multiple external resource servers, which can include an internal network or an external network. In one example, the multiple servers 16(1) to 16(n) are configured to operate as website servers. However, the multiple servers 16(1) to 16(n) are not limited to web server devices, and can also operate as messaging servers, file transfer protocol (FTP) servers, database servers, content servers, etc. In addition, each of the multiple servers 16(1) to 16(n) can be configured to perform different operations. Thus, for example, server 16(1) can be configured as a messaging server, while server 16(n) can be configured as a database server. Moreover, although the multiple servers 16(1) to 16(n) can operate in other ways other than as a website, the servers are still able to receive HTTP communications or TLS communications. Devices that may operate as the plurality of servers 16(1) through 16(n) include personal computers, desktop computers, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, server devices, and the like.

[0024] Although the plurality of servers 16(1) to 16(n) are shown as a single server, each of the plurality of servers 16(1) to 6(n) may be distributed across one or more different network computing devices. Moreover, the plurality of servers 16(1) to 16(n) are not limited to a particular configuration. Thus, the plurality of servers 16(1) to 16(n) may include a plurality of network computing devices that operate using a master / slave approach, whereby one of the network computing devices of the plurality of servers 16(1) to 16(n) operates to manage and / or otherwise coordinate the operation of another network computing device. The plurality of servers 16(1) to 16(n) may operate as a plurality of network computing devices within a cluster architecture, a peer-to-peer architecture, within a virtual machine, or within a cloud architecture. The plurality of servers 16(1) to 16(n) may include processing units, video display adapters, and mass storage that all communicate with each other via a bus. The mass storage typically includes RAM, ROM, and one or more permanent mass storage devices, such as a hard drive, a tape drive, a CD-ROM / DVD-ROM drive, and / or a floppy disk drive. The mass storage may store an operating system for controlling the operation of the plurality of servers 16(1) to 16(n). Any general purpose operating system may be employed. A basic input / output system ("BIOS") may also be provided to control low-level operations of the plurality of servers 16(1) to 16(n). The plurality of servers 16(1) to 16(n) may also communicate with the Internet or some other communications network via a network interface unit 310, which may be configured for use with a variety of communications protocols, including the TCP / IP protocol.

[0025] Therefore, the technology disclosed herein should not be construed as limited to a single environment, and other configurations and architectures are also contemplated. Figure 1 One or more of the plurality of servers 16(1) to 16(n) depicted in FIG. 1 may operate within the network traffic manager device 14 rather than as a stand-alone server that communicates with the network traffic manager device 14 via the communication network 30. In this example, the plurality of servers 16(1) to 16(n) operate within the memory 20 of the network traffic manager device 14. In addition, as shown in FIG. Figure 4 As shown, one of a plurality of servers 16(1)-16(n) may be used to implement the techniques disclosed herein.

[0026] Although in this example, the network traffic manager device 14 is shown as comprising a single device, in other examples, the network traffic manager device 14 may include multiple devices or blades, each device or blade having one or more processors 18 that implement one or more steps of the present technology, each processor 18 having one or more processing cores. In these examples, one or more of the devices may have a dedicated communication interface or memory. Alternatively, one or more of the devices may utilize memory, communication interfaces, or other hardware or software components of one or more other communicatively coupled devices. In addition, in other examples, one or more of the devices that collectively include the network traffic manager device 14 may be a stand-alone device, or integrated with one or more other devices or applications, multiple servers 16(1) to 16(n), or the network traffic manager device 14 or an application coupled to the communication network 30. Moreover, in these examples, one or more of the devices of the network traffic manager device 14 may be located in the same or different communication networks 30, including, for example, one or more public, private, or cloud networks.

[0027] Although an exemplary network traffic management system 10 having multiple client computing devices 12(1) to 12(n), a network traffic manager device 14 and multiple servers 16(1) to 16(n), a communication network 30, a LAN, a WAN is described and shown herein, other types and numbers of systems, devices, blades, components and elements in other topologies may also be used. It should be understood that the example systems described herein are for exemplary purposes, as many variations of the specific hardware and software used to implement the examples are possible, as will be appreciated by those skilled in the relevant art.

[0028] Furthermore, each of the example systems may be conveniently implemented using one or more general purpose computer systems, microprocessors, digital signal processors, and microcontrollers programmed in accordance with the teachings of the examples, as described and illustrated herein, and as will be appreciated by those of ordinary skill in the art.

[0029] One or more of the components depicted in the network traffic management system (such as the network traffic manager device 14, the plurality of client computing devices 12(1)-12(n), the plurality of servers 16(1)-16(n)) may be configured to operate as a virtual instance on the same physical machine. In other words, Figure 1 The network traffic manager device 14, the plurality of client computing devices 12(1) to 12(n), or one or more of the plurality of servers 16(1) to 16(n) shown in FIG. 1 may operate on the same physical device, rather than on a single physical device as in FIG. Figure 1 As described in the , it operates as a single device communicating over a network. Figure 1More or fewer client computing devices 12(1) to 12(n), a network traffic manager device 14, or multiple servers 16(1) to 16(n) as depicted in FIG. Multiple client computing devices 12(1) to 12(n), multiple servers 16(1) to 16(n) may be implemented as applications on the network traffic manager device 14.

[0030] In addition, two or more computing systems or devices can replace any one of the systems or devices in any example. Therefore, the principles and advantages of distributed processing, such as redundancy and replication, can also be implemented as needed to improve the robustness and performance of the devices and systems of the examples. The examples can also be implemented on a computer system that extends across any suitable network using any suitable interface mechanism and traffic technology, which includes, by way of example only, telecommunications services in any suitable form (e.g., voice and modem), wireless traffic media, wireless traffic networks, cellular traffic networks, G3 traffic networks, public switched telephone networks (PSTN), packet data networks (PDN), the Internet, intranets, and combinations thereof.

[0031] The examples may also be embodied as a non-transitory computer-readable medium having stored thereon instructions for one or more aspects of the techniques described and illustrated by way of example herein, which, when executed by a processor (or configurable hardware), cause the processor to perform the steps necessary to implement the methods of the examples described and illustrated herein.

[0032] Now refer to Figures 2 to 4An example of a method for generating and performing actions based on TLS parameters is described. First, in step 205, the network traffic manager device 14 receives a request to establish a connection from one of the client computing devices 12(1) to 12(n). In some examples, the request can be a security handshake from one of the client computing devices 12(1) to 12(n). In some examples, a security handshake can be received for establishing a connection to a server. In some examples, the security handshake can be a transport layer security (TLS) handshake or a secure socket layer (SSL) handshake used to establish a current SSL connection to the server. The SSL protocol is described in Secure Sockets Layer Version 3 (November 1996) by Netscape Communications Corp, while the TLS protocol is derived from SSL and is described in Dierks, T. and Allen, C., "TLS Protocol Version 1.0" RFC 2246 (January 1999), available from the IETF. The DTLS protocol is based on the TLS protocol and is described in "Datagram Transport Layer Security" RFC 4347 (April 2006) by Rescorla, E. and Modadugu, N., which is available from the IETF. Each of these files is incorporated herein by reference in its entirety. A TLS / SSL connection is a connection protected by encrypted information derived from the TLS / SSL protocol. The SSL protocol operates between an application layer (such as one or more of OSI layers 5 to 7) and a transport layer (such as OSI layer 4). The SSL protocol can provide security for application layer protocols such as the Hypertext Transport Protocol (HTTP), the Lightweight Directory Access Protocol (LDAP), and the Internet Messaging Access Protocol (IMAP). For example, HTTP (HTTPS) over SSL utilizes the SSL protocol to protect HTTP data. The SSL protocol can utilize the Transport Control Protocol / Internet Protocol (TCP / IP) on behalf of an application layer protocol to deliver secure data.

[0033] A TLS / SSL session refers to a secure session between two endpoints, wherein the session is protected using the TLS / SSL protocol. Although a TLS / SSL session is generally described herein as being established between one of the client computing devices 12(1) to 12(n) and one of the servers 16(1) to 16(n) via a communications network 30, it should be understood that a TLS or SSL session can be established between almost any type of network device capable of employing the TLS / SSL protocol. The TLS protocol initiates a TLS session using a series of TLS handshakes (i.e., the TLS handshake protocol). The SSL protocol initiates an SSL session through a series of SSL handshakes (i.e., the SSL handshake protocol). An SSL session is associated with a master key (also referred to as a session key) generated by the SSL handshake. An SSL session is also associated with additional secret data that enables an SSL session (e.g., a pre-master key, random data, a server's public key and a private key, and / or a client's public key and a private key). The TLS / SSL protocol also includes a TLS / SSL re-handshake procedure for renegotiating a TLS / SSL session. A renegotiated TLS / SSL session may be associated with a current session. A TLS / SSL session may be associated with another TLS / SSL session. A TLS / SSL session may employ one or more underlying network connections.

[0034] In some examples, a TLS / SSL connection can be established between one of the client computing devices 12(1) to 12(n) and a network traffic manager device 14 operating on behalf of a plurality of servers 16(1) to 16(n). In some examples, the network traffic manager device 14 can be a proxy located between the plurality of servers 16(1) to 16(n) and the plurality of client computing devices 12(1) to 12(n). In one example, the proxy can be a third party interposed between one of the client computing devices 12(1) to 12(n) and one of the servers 16(1) to 16(n) (or the network traffic manager device 14). An SSL handshake message or a TLS handshake message is sent between one of the client computing devices 12(1) to 12(n) and the network traffic manager device 14 and then sent from the network traffic manager device 14 to the server 16(1) to establish the SSL / TLS connection. When the handshake message is forwarded through the proxy, the proxy can extract data such as parameters from at least one of the TLS handshake messages.

[0035] In step 210, the network traffic manager device 14 determines the identity of the client at one of the client computing devices 12(1) to 12(n) based on TLS parameters in the request that are unique to the client at one of the client computing devices 12(1) to 12(n). Some examples of TLS parameters in the art that can be used to identify a client at one of the client computing devices 12(1) to 12(n) are described in the Internet Assigned Numbers Authority's "Transport Layer Security (TLS) Parameters" (September 2023) (https: / / www.iana.org / assignments / tls-parameters / tls-parameters.xhtml). This document is incorporated herein by reference in its entirety. The parameters used for the TLS connection can be a unique combination used by the client at one of the client computing devices 12(1) to 12(n) and can help serve as a fingerprint of the client at one of the client computing devices 12(1) to 12(n) to determine the identity of the client. The network traffic manager device 14 can access a database of known clients that maps to a parameter combination unique to each known client to determine the identity of the client at one of the client computing devices 12(1) to 12(n), although other methods may be used. If the network traffic manager device 14 is unable to determine the identity of the client at one of the client computing devices 12(1) to 12(n) based on the TLS parameters in the request, the "no" branch is taken to step 215.

[0036] In step 215, if the identity of the client at one of the client computing devices 12(1)-12(n) is not determined, the network traffic manager device 14 identifies the client at one of the client computing devices 12(1)-12(n) as an unknown identity and generates an action based on the client at one of the client computing devices 12(1)-12(n) being identified as an unknown identity. By way of example, the action may be a security action to increase the security of the network, although other types of actions may also be performed. Examples of security actions that may be taken to increase the security of the network are described below.

[0037] In some examples, the security action may be to perform additional checks on the request, perform additional checks on subsequent requests from the client at one of the client computing devices 12(1) to 12(n), drop the request, or drop subsequent requests from the client at one of the client computing devices 12(1) to 12(n). In other examples, the security action may be to adjust the handling of the request or redirect the request through a different traffic path. Adjusting the handling of the request by the network traffic manager device 14 may include causing the network traffic manager device 14 to search for data leaks or to inspect the request for proprietary information. The network traffic manager device 14 may direct the request or subsequent requests through a different service path. In some examples, the network traffic manager device 14 may direct the request or subsequent requests through specific hardware or servers. The network traffic manager device 14 may change the quality of service for unknown clients by reducing the bandwidth, throughput, latency, or jitter of the request or subsequent requests from the client. The network traffic manager device 14 may change the encryption policy or encryption algorithm of the client. The network traffic manager device 14 may apply firewall rules to prohibit certain transactions or block the transaction. The network traffic manager device 14 may limit the request rate to a predetermined amount of requests within a set time period, such as one request per minute. The network traffic manager device 14 may notify other systems to temporarily block traffic from the client.

[0038] In other examples, the identification of a client at one of the client computing devices 12(1) to 12(n) as an unknown client can be classified into a predetermined category, and multiple subsequent requests from the unknown client can be processed based on the predetermined category. As a non-limiting example, the predetermined category of unknown client can be a category based on the ID in the request, and the processing of multiple subsequent requests from the client at one of the client computing devices 12(1) to 12(n) can be a threshold that sets a minimum version of the TLS handshake required to proceed with the request. In other examples, other types of thresholds can be set. If the number of encryption algorithms is less than the set threshold, the network traffic manager device 14 can change the handling of the request and multiple subsequent requests from the client at one of the client computing devices 12(1) to 12(n).

[0039] If, returning to step 210, the network traffic manager device 14 is able to determine the identity of the client at one of the client computing devices 12(1) to 12(n), the "yes" branch is taken to step 220. In step 220, if the identity of the client at one of the client computing devices 12(1) to 12(n) is determined, the network traffic manager device 14 can retrieve historical activity associated with the identified client from the database. The historical activity can include historical requests or historical transactions for the identified client, although other types of historical data can also be used. The historical requests and historical transactions can include system information for the client at one of the client computing devices 12(1) to 12(n).

[0040] In step 225, the network traffic manager device 14 may determine whether the identified client at one of the client computing devices 12(1) to 12(n) is a suspicious client based on historical activity associated with the identified client. The network traffic manager device 14 may examine the historical activity associated with the identified client to determine a level of scrutiny for the request or subsequent requests from the client by analyzing system information in historical requests and historical transactions. In some embodiments, when the network traffic manager device 14 determines that the level of scrutiny should be high, the network traffic manager device 14 may classify the client at one of the client computing devices 12(1) to 12(n) as a suspicious client. When the client at one of the client computing devices 12(1) to 12(n) is a suspicious client or the level of scrutiny is set to high, the network traffic manager device 14 may take the security actions described above.

[0041] In step 230, the network traffic manager device 14 generates an action based on the identity of the client at one of the client computing devices 12(1) to 12(n). When the network traffic manager device 14 accesses a database of known clients and identifies the client, the network traffic manager device 14 can determine a level of scrutiny for the request or can use the client's historical activity to determine whether the client is suspicious. When the network traffic manager device 14 accesses the database and the client is not in the database of known clients, the network traffic manager device 14 can use parameters of the request to determine a level of scrutiny for the request or can determine whether the client at one of the client computing devices 12(1) to 12(n) is suspicious. When the network traffic manager device 14 determines that the client at one of the client computing devices 12(1) to 12(n) is not a suspicious client or has not set the level of scrutiny too high, the network traffic manager device 14 can take action to improve the quality of service for the request, as described below.

[0042] In some examples, when the identified client at one of the client computing devices 12(1) to 12(n) is identified as not suspicious, the network traffic manager device 14 may send the request to the server without additional inspection. In some examples, the network traffic manager device 14 may direct the request or subsequent requests through specific hardware or servers based on the identification of the client at one of the client computing devices 12(1) to 12(n) and specific storage traffic management rules for the identified client. The network traffic manager device 14 may change the quality of service of the client at one of the client computing devices 12(1) to 12(n) based on the identification by increasing the bandwidth, throughput, latency, or jitter of the request or subsequent requests from the client, for example, the identified client may have a rule that allows for increased bandwidth or, in other examples, bandwidth restrictions. The network traffic manager device 14 may change the encryption policy or encryption algorithm of the client at one of the client computing devices 12(1) to 12(n) based on the identification. Network traffic manager device 14 may alter firewall rules to allow certain transactions based on the identity of the client at one of client computing devices 12(1)-12(n). Network traffic manager device 14 may increase the request rate to a predetermined amount of requests within a set time period.

[0043] In step 235, the network traffic manager device 14 performs the action and the exemplary process ends at step 240. When the action does not involve discarding the request or subsequent request, the network traffic manager device may send the request or subsequent request to one of the servers 16(1) to 16(n) after performing the action. In some examples, after sending the request to the server, the network traffic manager device 14 may receive a message from one of the servers 16(1) to 16(n) indicating that the transaction or handshake has been completed. The network traffic manager device 14 may then receive additional messages from one of the client computing devices 12(1) to 12(n) and send the received additional messages to one of the servers 16(1) to 16(n). The network traffic manager device 14 may also receive additional messages from one of the servers 16(1) to 16(n) and send the received additional messages to the client computing device 12(1).

[0044] Having thus described the basic concepts of the present technology, it will be quite apparent to those skilled in the art that the foregoing detailed disclosure is intended to be presented by way of example only and is not restrictive. Although not expressly stated herein, various changes, improvements, and modifications will occur and are intended to be used by those skilled in the art. These changes, improvements, and modifications are intended to be proposed accordingly and are within the spirit and scope of the present technology. In addition, except as may be specified in the claims, the order of the listed processing elements or sequences or the use of numbers, letters, or other names is therefore not intended to limit the claimed process to any order. Therefore, the present technology is limited only by the following claims and their equivalents.

Claims

1. A method for generating a customized action for an identified client, the method being implemented by a network traffic management system including one or more network traffic devices, client devices, or server devices, the method comprising: receiving, from a client, a request to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection; determining the identity of the client based on the TLS parameters unique to the client in the request; and An action is performed on the request based on the identity of the client determined from the TLS parameters.

2. The method according to claim 1, further comprising: retrieving historical activity from a database associated with the identified client, wherein the historical activity includes historical requests or historical transactions of the identified client; and determining whether the identified client is a suspicious client based on the historical activity associated with the identified client; wherein when the identified client is a suspicious client, the action is a security action; The security action performed is to perform additional checks on the request, perform additional checks on subsequent requests from the client, discard the request, or discard the subsequent requests from the client.

3. The method of claim 2, wherein the action comprises redirecting the request through a different traffic path.

4. The method of claim 2, wherein the actions include: changing the encryption policy or encryption algorithm of the client for the request or the subsequent request from the client; or A quality of service for the identified client is adjusted, and wherein adjusting the quality of service comprises selecting a corresponding bandwidth, throughput, latency, or jitter for the request or the subsequent request from the client.

5. The method of claim 2, wherein the actions include: categorizing the identified clients into predetermined categories; and The handling of a plurality of subsequent requests from the identified client is modified based on the predetermined classification.

6. A non-transitory computer-readable medium having stored thereon instructions for establishing a connection to a server using a credential comprising executable code that, when executed by one or more processors, causes the processor to: receiving, from a client, a request to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection; determining the identity of the client based on the TLS parameters unique to the client in the request; and An action is performed on the request based on the identity of the client determined from the TLS parameters.

7. The medium of claim 6, wherein when executed by the processor, the executable code further causes the processor to: retrieving historical activity from a database associated with the identified client, wherein the historical activity includes historical requests or historical transactions of the identified client; and determining whether the identified client is a suspicious client based on the historical activity associated with the identified client; wherein when the identified client is a suspicious client, the action is a security action; and The security action performed is to perform additional checks on the request, perform additional checks on subsequent requests from the client, discard the request, or discard the subsequent requests from the client.

8. The medium of claim 6, wherein the action comprises redirecting the request through a different traffic path.

9. The medium of claim 6, wherein the actions comprise: changing the encryption policy or encryption algorithm of the client for the request or the subsequent request from the client; or A quality of service for the identified client is adjusted, and wherein adjusting the quality of service comprises selecting a corresponding bandwidth, throughput, latency, or jitter for the request or the subsequent request from the client.

10. The medium of claim 6, wherein the actions comprise: categorizing the identified client into a predetermined category; and modifying handling of a plurality of subsequent requests from the identified client based on the predetermined category.

11. A network traffic manager device, comprising: Memory, It includes programmed instructions stored in said memory; and one or more processors configured to execute the programmed instructions stored in the memory to: receiving, from a client, a request to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection; determining the identity of the client based on the TLS parameters unique to the client in the request; and An action is performed on the request based on the identity of the client determined from the TLS parameters.

12. The device of claim 11, wherein the one or more processors are further configured to be capable of executing the programmed instructions stored in the memory to: retrieving historical activity from a database associated with the identified client, wherein the historical activity includes historical requests or historical transactions of the identified client; and determining whether the identified client is a suspicious client based on the historical activity associated with the identified client; wherein when the identified client is a suspicious client, the action is a security action; and The security action performed is to perform additional checks on the request, perform additional checks on subsequent requests from the client, discard the request, or discard the subsequent requests from the client.

13. The apparatus of claim 11, wherein the action comprises redirecting the request through a different traffic path.

14. The apparatus of claim 11, wherein the actions comprise: changing the encryption policy or encryption algorithm of the client for the request or the subsequent request from the client; or A quality of service for the identified client is adjusted, and wherein adjusting the quality of service comprises selecting a corresponding bandwidth, throughput, latency, or jitter for the request or the subsequent request from the client.

15. The apparatus of claim 11, wherein the actions comprise: categorizing the identified client into a predetermined category; and modifying handling of a plurality of subsequent requests from the identified client based on the predetermined category.

16. A network traffic management system, comprising one or more traffic management devices, client devices or server devices, the network traffic management system comprising: a memory including programmed instructions stored thereon; and one or more processors configured to execute the stored programmed instructions to: receiving, from a client, a request to establish a TLS connection to a server, wherein the request includes TLS parameters for the TLS connection; determining the identity of the client based on the TLS parameters unique to the client in the request; and An action is performed on the request based on the identity of the client determined from the TLS parameters.

17. The network traffic management system of claim 16, wherein the one or more processors are further configured to be capable of executing the programmed instructions stored in the memory to: retrieving historical activity from a database associated with the identified client, wherein the historical activity includes historical requests or historical transactions of the identified client; and determining whether the identified client is a suspicious client based on the historical activity associated with the identified client; wherein when the identified client is a suspicious client, the action is a security action; and The security action performed is to perform additional checks on the request, perform additional checks on subsequent requests from the client, discard the request, or discard the subsequent requests from the client.

18. The network traffic management system of claim 16, wherein the action comprises redirecting the request through a different traffic path.

19. The network traffic management system of claim 16, wherein the actions include: changing the encryption policy or encryption algorithm of the client for the request or the subsequent request from the client; or A quality of service for the identified client is adjusted, and wherein adjusting the quality of service comprises selecting a corresponding bandwidth, throughput, latency, or jitter for the request or the subsequent request from the client.

20. The network traffic management system of claim 16, wherein the actions include: categorizing the identified client into a predetermined category; and modifying handling of a plurality of subsequent requests from the identified client based on the predetermined category.

Images