# US 10,122,692 B2 · Handshake offload > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,692 B2 - Document ID: US10122692B2 - Status: Granted - Kind: B2 - Application number: 14/741,384 - Filed: 2015-06-16 - Published: 2016-12-22 - Granted: 2018-11-06 - Earliest claimed: 2015-06-16 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Colm MacCarthaigh - Web page: https://patentgrep.com/patent/US10122692B2 ## CPC - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0281: {Proxies} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 67/1004: Server selection for load balancing - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Cryptographically protected communications sessions are established using a distributed process. A server proxies handshake messages to another computer system that negotiates a cryptographically protected communications session with the client. When the client and other computer system complete negotiation of the session, the other computer system provides a set of session keys to the server. The server then uses the session keys to communicate with the client over the cryptographically protected communications session. ## Claims ### Claim 1 A computer-implemented method, comprising: establishing, by a load balancer, a network connection with a client computer system; determining, by the load balancer and based at least in part on data associated with a first set of messages of a handshake protocol of a cryptographically protected communications protocol, a handshake server from a plurality of handshake servers; proxying, by the load balancer, over a first cryptographically protected communications session with the handshake server that uses a first symmetric cryptographic key, the first set of messages between the client computer system and the handshake server thereby facilitating negotiation of a second symmetric cryptographic key for a second cryptographically protected communications session using an asymmetric key pair comprising a private cryptographic key accessible to the handshake server; obtaining, by a server computer system, the second symmetric cryptographic key from the handshake server; for a second set of messages outside of the handshake protocol of the cryptographically protected communications protocol, using at least the second symmetric cryptographic key to cryptographically process the second set of messages; and as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server computer system includes data not encrypted in accordance with the cryptographically protected communications session; and as a result of the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein each message of the first set of messages is addressed to the handshake server. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the cryptographically protected communications protocol is a Secure Sockets Layer/Transport Layer Security protocol or Internet Protocol Security. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the server computer system and the handshake server are implemented on separate physical computing devices. ### Claim 5 A system, comprising: one or more processors; and memory storing instructions that, as a result of being executed by the one or more processors, cause the system to: receive, by a load balancer, a message from a client computer system; determine, by a load balancer, whether the message is for a handshake based at least in part on data associated with the message; if the message is for a handshake, provide the message to another computer system of a plurality of computer systems to perform the handshake and enable the other computer system to negotiate, with the client computer system, a cryptographically protected communications session; obtain, by a server, a cryptographic key from the other computer system; and use the cryptographic key to communicate to the client computer system over the cryptographically protected communications session; and as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server includes data not encrypted in accordance with the cryptographically protected communications session; and if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action. ### Claim 6 (depends on 5) The system of claim 5, wherein the cryptographically protected communications session is a Sockets Layer Security or Transport Layer Security session. ### Claim 7 (depends on 5) The system of claim 5, wherein the instructions further include instructions that, as a result of being executed by the one or more processors, cause the system to: if the message is not a handshake message, perform a set of tests on the message to determine whether the message comprises potentially malicious data; and perform a mitigating action if determined that the message comprises potentially malicious data. ### Claim 8 (depends on 5) The system of claim 5, wherein the instructions that cause the system uses the cryptographic key to communicate to the client computer system, as a result of being executed by the one or more processors, cause the system to encrypt data using the cryptographic key. ### Claim 9 (depends on 5) The system of claim 5, wherein the system comprises the other computer system. ### Claim 10 (depends on 9) The system of claim 9, wherein the other computer system is configured to apply a policy to determine whether to perform the handshake. ### Claim 11 (depends on 5) The system of claim 5, wherein the handshake involves use of a private cryptographic key to which the system lacks access. ### Claim 12 (depends on 5) The system of claim 5, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors cause the system to: receive a third message from the other computer system, the third message being part of the handshake; and provide the third message to the client computer system. ### Claim 13 (depends on 5) The system of claim 5, wherein: the system comprises the other computer system; and the other computer system is inaccessible via any public Internet Protocol address. ### Claim 14 A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a first computer system, cause the first computer system to at least: determine, by a load balancer, a second computer system from a plurality of computer systems based at least in part on data associated with handshake messages; proxy, by a load balancer, handshake messages of a protocol for cryptographically protected communications sessions between a client computer system and the second computer system; obtain, by a server, a set of cryptographic keys for a cryptographically protected communications session from the second computer system; and use the set of cryptographic keys to communicate with the client computer system over the cryptographically protected communications session; and as a result of the cryptographically protected communications session having been established, determine whether a message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session; and if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein: the cryptographically protected communications session utilizes encryption. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein: the first computer system is a web server of a web site having a corresponding digital certificate with a corresponding private cryptographic key; and the first computer system lacks access to the corresponding private cryptographic key. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the cryptographically protected communications session is a transport layer security session. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the executable instructions that cause the first computer system to proxy the message between the client computer system and the second computer system, as a result of being executed by the one or more processors, cause the first computer system to digitally sign message to the second computer system to enable the second computer system to authenticate the message. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the set of cryptographic keys comprises an encryption key, a decryption key, and two data integrity keys. ### Claim 20 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the executable instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the first computer system to: determine one or more characteristics of the client computer system; and select, based at least in part on the one or more characteristics of the client computer system, the second computer system from a plurality of computer systems configured to perform handshakes. ### Claim 21 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein: the executable instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the system to: determine one or more characteristics of the client computer system; and apply a policy to the one or more characteristics to determine whether to proxy the handshake messages. ### Claim 22 (depends on 1) The computer-implemented method of claim 1, wherein data associated with the first set of messages include at least one of: internet protocol (IP) address, time of day, and geolocation of the client computer system. ### Claim 23 (depends on 5) The system of claim 5, wherein data associated with the message include at least one of: internet protocol (IP) address, time of day, and geolocation of the client computer system. ### Claim 24 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein data associated with the handshake messages include at least one of: internet protocol (IP) address, time of day, and geolocation of the client computer system.