SECURE CONNECTIONS AND MUTUAL AUTHENTICATIONS BETWEEN AN INTERMEDIARY DEVICE, A CUSTOMER DEVICE AND A SERVER SYSTEM

Abstract

In some examples, a switching device includes a memory for storing mapping information correlating a public key of the switching server with a private key of the switching server of the switching device, and correlating a public key of the switching client with a private key of the switching client of the switching device. The switching device establishes a first secure connection between the switching device and the client device using the public key of the switching server and the private key of the switching server, wherein establishing the first secure connection includes mutual authentication between the switching device and the client device.The switching device establishes a second secure connection between the switching device and the server system using the public key of the switching client and the private key of the switching client, wherein the establishment of the second secure connection comprises mutual authentication between the switching device and the server system.

Claims

[1] An intermediate device provided between a client device and a server system, the intermediate device comprising: a memory for storing mapping information correlating a public key of the mediation server with a private key of the mediation server of the mediation device, and correlating a public key of the mediation client with a private key of the mediation client of the mediation device; and a hardware processor for Establishing a first secure connection between the intermediary device and the client device using the intermediary server's public key and the intermediary server's private key correlated by the mapping information, wherein in the first secure connection the intermediary device acts as a server for the client device and establishing the first secure connection comprises mutual authentication between the intermediary device and the client device; and Establishing a second secure connection between the intermediate device and the server system using the intermediate client's public key and the intermediate client's private key correlated by the mapping information, wherein in the second secure connection the intermediate device acts as a client for the server system and establishing the second secure connection comprises mutual authentication between the intermediate device and the server system. [2] An intermediate device according to claim 1, wherein the intermediate device serves to: Sending the intermediate server’s public key to the client device for use by the client device; and send the mediation client's public key to the server system for use by the server system. [3] The intermediate device of claim 2, wherein the hardware processor is to: Generating a new public key of the mediation server as part of a key rotation performed on the mediation device; generate a new private key of the mediation server of the mediation device based on the generation of the new public key of the mediation server; and update the mapping information to correlate the new mediation server public key with the new mediation server private key. [4] The intermediate device of claim 1, wherein the intermediate device is to receive a client device public key from the client device, and wherein the hardware processor is to: as part of the mutual authentication between the switching device and the client device, encrypt a message using the client device's public key to generate an encrypted message; and initiate the sending of the encrypted message to the customer device. [5] The intermediate device of claim 1, wherein the intermediate device is to receive a server system public key of the server system from the server system, and wherein the hardware processor is to: as part of the mutual authentication between the switching device and the server system, encrypt a message using the public key of the server system to generate an encrypted message; and initiate the sending of the encrypted message to the server system. [6] The intermediate device of claim 1, wherein the establishment of the first secure connection comprising mutual authentication between the intermediate device and the client device is based on the use of the public key of the intermediate server to encrypt a first message from the client device to the intermediate device and on the use of the private key of the intermediate server to decrypt the encrypted first message at the intermediate device, and wherein the establishment of the second secure connection comprising mutual authentication between the intermediate device and the server system is based on the use of the public key of the intermediate client to encrypt a second message from the server system to the intermediate device and the use of the private key of the intermediate client to decrypt the encrypted second message at the intermediate device. [7] The intermediate device according to claim 6, wherein the mutual authentication between the client device and the intermediate device and the mutual authentication between the server system and the intermediate device are performed according to a Secure Shell (SSH) protocol. [8] The intermediate device of claim 1, wherein the mapping information correlates a plurality of public keys of the mediation server with corresponding private keys of the mediation server of the mediation device, the hardware processor being operable to: initiate the sending of the intermediate server's multiple public keys to the respective client devices. [9] The intermediary device of claim 1, wherein the mapping information correlates a plurality of public keys of switching customers with corresponding private keys of switching customers of the switching device, the hardware processor being operable to: initiate the sending of the multiple public keys of the intermediate clients to the respective server systems. [10] The intermediate device of claim 1, wherein the hardware processor is to: Sending the mediation server's public key from the mediation device to the customer device for validation on the customer device; Receiving a client public key of the client device at the switching device from the client device; and Validation of the customer's public key on the intermediary device. [11] The intermediate device of claim 1, wherein the hardware processor is to: Sending the mediation client's public key from the mediation device to the server system for validation in the server system; Receiving a public server key of the server system at the switching device; and Validation of the server's public key on the intermediate device. [12] A non-transitory, machine-readable storage medium containing instructions which, when executed, cause an intermediate device to: Sending a mediation server public key from the mediation device to a customer device; send a client public key from the switching device to a server system; Decrypting first encrypted data received from the client device using a private key of the intermediate server retrieved from an entry of mapping information correlating the public key of the intermediate server and the private key of the intermediate server; Authenticating the client device using first decrypted data generated by decrypting the first encrypted data, wherein the authentication of the client device by the switching device is part of the mutual authentication between the switching device and the client device to establish a first secure connection between the switching device and the client device; Decrypting second encrypted data received from the server system using a private key of the intermediate client retrieved from an entry of the mapping information correlating the public key of the intermediate client and the private key of the intermediate client; and Authenticating the server system using second decrypted data generated by decrypting the second encrypted data, wherein the authentication of the server system by the switching device is part of the mutual authentication between the switching device and the server system to establish a second secure connection between the switching device and the server system. [13] The non-transitory machine-readable storage medium of claim 12, wherein the mutual authentication between the intermediary device and the client device is part of establishing a first cryptographic session between the intermediary device and the client device, and wherein the mutual authentication between the intermediary device and the server system is part of establishing a second cryptographic session between the intermediary device and the server system. [14] The non-transitory machine-readable storage medium of claim 12, wherein the intermediate device acts as a server for the client device and as a client for the server system. [15] The non-transitory machine-readable storage medium of claim 12, wherein the instructions, when executed, cause the intermediate device to: Sending third encrypted data encrypted using a client public key of the client device from the switching device to the client device, wherein the third encrypted data is to be used by the client device in authenticating the switching device as part of the mutual authentication between the switching device and the client device; and Sending fourth encrypted data encrypted using a public server key of the server system from the intermediate device to the server system, wherein the fourth encrypted data is to be used by the server system in authenticating the intermediate device as part of the mutual authentication between the intermediate device and the server system. [16] The non-transitory machine-readable storage medium of claim 15, wherein the instructions, when executed, cause the intermediate device to: Receiving the customer’s public key from the customer device at the switching device; and Receiving the server's public key from the server system on the intermediate device. [17] The non-transitory machine-readable storage medium of claim 12, wherein the instructions, when executed, cause the intermediate device to: Performing a key rotation on the intermediate device, the key rotation comprising: Generating a new mediation server public key to replace the mediation server public key; based on the generation of the new public key of the mediation server, generation of a new private key of the mediation server of the mediation device; Generation of a new public key for the brokerage customer, which replaces the brokerage customer’s public key; based on the generation of the new public key of the switching customer, generating a new private key of the switching customer of the switching device; and Updating the mapping information to correlate the new mediation server public key with the new mediation server private key, and to correlate the new mediation client public key with the new mediation client private key. [18] The non-transitory machine-readable storage medium of claim 12, wherein the mapping information correlates a plurality of public keys of the mediation server with corresponding private keys of the mediation server of the mediation device, and the mapping information correlates a plurality of public keys of the mediation client with corresponding private keys of the mediation client of the mediation device. [19] A procedure comprising: Coupling an intermediate device between a client device and a server system, wherein the intermediate device behaves as a server towards the client device and as a client towards the server system; Storing mapping information in a memory correlating a plurality of public keys of the mediation server with corresponding private keys of the mediation server of the mediation device, and correlating a plurality of public keys of the mediation client with corresponding private keys of the mediation client of the mediation device; as part of a first secure session establishment including mutual authentication between the mediating device and the client device, authentication of the client device by the mediating device based on first encrypted data encrypted by the client device using a first public key of the mediating server; and as part of a second secure session establishment involving mutual authentication between the intermediate device and the server system, authentication of the server system by the intermediate device based on second encrypted data encrypted by the server system using a first public key of the intermediate client or the public key of the intermediate client. [20] The method of claim 19, wherein: the mutual authentication between the mediating device and the client device further comprises sending the first public key of the mediating server from the mediating device to the client device and receiving encrypted data at the mediating device that has been encrypted by the client device using the first public key of the mediating server; and the mutual authentication between the intermediate device and the server system comprises sending the intermediate client's first public key from the intermediate device to the server system and receiving encrypted data at the intermediate device encrypted by the server system using the intermediate client's first public key.

Images