# US 10,320,842 B1 · Securely sharing a transport layer security session with one or more trusted devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,842 B1
- Document ID: US10320842B1
- Status: Granted
- Kind: B1
- Application number: 15/468,895
- Filed: 2017-03-24
- Granted: 2019-06-11
- Earliest claimed: 2017-03-24
- Assignees: Symantec Corporation
- Applicants: Symantec Corporation
- Inventors: Roelof N. Du Toit; Noah Z. Robbin; David Wells
- Web page: https://patentgrep.com/patent/US10320842B1

## CPC

- H04L 63/166: {at the transport layer}
- H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70)
- H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
- H04L 69/326: in the transport layer [OSI layer 4] (H04L69/16 takes precedence)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Securely sharing a Transport Layer Security (TLS) session with one or more trusted devices. In one embodiment, a method may include establishing a TLS session between a client device and a server device, communicating encrypted messages that are encrypted using encryption keys between the client device and the server device, and intercepting and decrypting one or more of the encrypted messages at a trusted device using the encryption keys. In this embodiment, the establishing of the TLS session may include negotiating a master secret, establishing a secure channel between the trusted device and the client device or the server device, sending, from the client device or the server device, the master secret to the trusted device over the secure channel, and employing the master secret at the client device, at the server device, and at the trusted device to generate, for the TLS session, the encryption keys.

## Claims

### Claim 1

A computer-implemented method for securely sharing a Transport Layer Security (TLS) session with a chain of trusted devices, the method comprising:
establishing a TLS session between a client device and a server device, the establishing of the TLS session comprising:
negotiating a master secret for the TLS session that is known to both the client device and the server device,
establishing a chain of secure channels between a chain of trusted devices and the client device or the server device, the chain of trusted devices being communicatively positioned between the client device and the server device,
sending, from the client device or the server device, the master secret to the chain of trusted devices over the chain of secure channels, and
employing the master secret at the client device, at the server device, and at the chain of trusted devices to generate, for the TLS session, encryption keys;
after establishment of the TLS session, communicating encrypted messages, that are encrypted using the encryption keys, between the client device and the server device; and
during the communicating of the encrypted messages, intercepting and decrypting one or more of the encrypted messages at one or more of the trusted devices in the chain of trusted devices using the encryption keys.

### Claim 2 (depends on 1)

The method of claim 1, wherein either the client device or the server device is a Man in the Middle (MITM) device acting as the client device or acting as the server device and is communicatively positioned between the client device and another server device or communicatively positioned between the server device and another client device.

### Claim 3 (depends on 1)

The method of claim 1, wherein each of the secure channels in the chain of secure channels is a TLS session-specific channel that only exists during the establishment of the TLS session.

### Claim 4 (depends on 3)

The method of claim 3, wherein each of the secure channels in the chain of secure channels is a Perfect Forward Secrecy (PFS) channel.

### Claim 5 (depends on 4)

The method of claim 4, wherein the establishing of each of the secure channels in the chain of secure channels is accomplished using a Diffie-Hellman key exchange.

### Claim 6 (depends on 4)

The method of claim 4, wherein the establishing of each of the secure channels in the chain of secure channels is accomplished using a One Round Trip Time (1-RTT) TLS 1.3 handshake.

### Claim 7 (depends on 1)

The method of claim 1, wherein the intercepting and the decrypting of the one or more of the encrypted messages at the one or more of the trusted devices in the chain of trusted devices is accomplished without interrupting the communicating of the one or more of the encrypted messages between the client device and the server device, without modifying the one or more of the encrypted messages, and without re-encrypting the one or more of the encrypted messages.

### Claim 8

One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to:
establish a Transport Layer Security (TLS) session between a client device and a server device, the establishing of the TLS session comprising:
negotiating a master secret for the TLS session that is known to both the client device and the server device,
establishing a chain of secure channels between a chain of trusted devices and the client device or the server device, the chain of trusted devices being communicatively positioned between the client device and the server device,
sending, from the client device or the server device, the master secret to the chain of trusted devices over the chain of secure channels, and
employing the master secret at the client device, at the server device, and at the chain of trusted devices to generate, for the TLS session, encryption keys;
after establishment of the TLS session, communicate encrypted messages, that are encrypted using the encryption keys, between the client device and the server device; and
during the communicating of the encrypted messages, intercept and decrypt one or more of the encrypted messages at one or more of the trusted devices in the chain of trusted devices using the encryption keys.

### Claim 9 (depends on 8)

The one or more non-transitory computer-readable media of claim 8, wherein either the client device or the server device is a Man in the Middle (MITM) device acting as the client device or acting as the server device and is communicatively positioned between the client device and another server device or communicatively positioned between the server device and another client device.

### Claim 10 (depends on 8)

The one or more non-transitory computer-readable media of claim 8, wherein each of the secure channels in the chain of secure channels is a TLS session-specific channel that only exists during the establishment of the TLS session.

### Claim 11 (depends on 10)

The one or more non-transitory computer-readable media of claim 10, wherein each of the secure channels in the chain of secure channels is a Perfect Forward Secrecy (PFS) channel.

### Claim 12 (depends on 11)

The one or more non-transitory computer-readable media of claim 11, wherein the establishing of each of the secure channels in the chain of secure channels is accomplished using a Diffie-Hellman key exchange or is accomplished using a One Round Trip Time (1-RTT) TLS 1.3 handshake.

### Claim 13 (depends on 8)

The one or more non-transitory computer-readable media of claim 8, wherein the intercepting and the decrypting of the one or more of the encrypted messages at the one or more of the trusted devices in the chain of trusted devices is accomplished without interrupting the communicating of the one or more of the encrypted messages between the client device and the server device, without modifying the one or more of the encrypted messages, and without re-encrypting the one or more of the encrypted messages.