Back to results
US 10,122,692 B2Granted
Handshake offload
AssigneeAmazon Technologies, Inc.
InventorColm MacCarthaigh
Life of this patent
Estimating the term…
Abstract
Cryptographically protected communications sessions are established using a distributed process. A server proxies handshake messages to another computer system that negotiates a cryptographically protected communications session with the client. When the client and other computer system complete negotiation of the session, the other computer system provides a set of session keys to the server. The server then uses the session keys to communicate with the client over the cryptographically protected communications session.
Claims24
A computer-implemented method, comprising:
- establishing, by a load balancer, a network connection with a client computer system;
- determining, by the load balancer and based at least in part on data associated with a first set of messages of a handshake protocol of a cryptographically protected communications protocol, a handshake server from a plurality of handshake servers;
- proxying, by the load balancer, over a first cryptographically protected communications session with the handshake server that uses a first symmetric cryptographic key, the first set of messages between the client computer system and the handshake server thereby facilitating negotiation of a second symmetric cryptographic key for a second cryptographically protected communications session using an asymmetric key pair comprising a private cryptographic key accessible to the handshake server;
- obtaining, by a server computer system, the second symmetric cryptographic key from the handshake server;
- for a second set of messages outside of the handshake protocol of the cryptographically protected communications protocol, using at least the second symmetric cryptographic key to cryptographically process the second set of messages;
- and
- as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server computer system includes data not encrypted in accordance with the cryptographically protected communications session;
- and
- as a result of the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.
6 more elements
A system, comprising:
- one or more processors;
- and
- memory storing instructions that, as a result of being executed by the one or more processors, cause the system to:
- receive, by a load balancer, a message from a client computer system;
- determine, by a load balancer, whether the message is for a handshake based at least in part on data associated with the message;
- if the message is for a handshake, provide the message to another computer system of a plurality of computer systems to perform the handshake and enable the other computer system to negotiate, with the client computer system, a cryptographically protected communications session;
- obtain, by a server, a cryptographic key from the other computer system;
- and
- use the cryptographic key to communicate to the client computer system over the cryptographically protected communications session;
- and
- as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server includes data not encrypted in accordance with the cryptographically protected communications session;
- and
- if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.
10 more elements
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a first computer system, cause the first computer system to at least:
- determine, by a load balancer, a second computer system from a plurality of computer systems based at least in part on data associated with handshake messages;
- proxy, by a load balancer, handshake messages of a protocol for cryptographically protected communications sessions between a client computer system and the second computer system;
- obtain, by a server, a set of cryptographic keys for a cryptographically protected communications session from the second computer system;
- and
- use the set of cryptographic keys to communicate with the client computer system over the cryptographically protected communications session;
- and
- as a result of the cryptographically protected communications session having been established, determine whether a message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session;
- and
- if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.
6 more elements
Dependencies are inferred from the claim text.