Stateless session synchronization between secure communication interceptors
AssigneeInternational Business Machines Corporation
InventorsKuo-Chun Chen, Wei-Hsiang Hsiung, Cheng-ta Lee, Wei-Shiau Suen, Ming Hsun Wu
Life of this patent
Estimating the term…
Abstract
Embodiments provide a system and method for stateless session synchronization between inspectors for high availability deployments. Man in the Middle inspectors of a communication session between a client and server exchange a shared key that is used as a common seed value in a mapping function algorithm. Each inspector generates identical key-pairs using the common mapping function algorithm, and the inspectors generate the session keys from the key-pairs. Inspectors use the session keys to decrypt and either actively or passively inspect data transferred in a session between a client and server.
Claims16
A computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for providing stateless synchronization, the method comprising:
- receiving, by a first inspector device, a first set of key parameters while in a communication session;
- generating, by the first inspector device, a first key-pair using the first set of key parameters and a shared key;
- receiving, by the first inspector device, a second set of key parameters while in the communication session;
- generating, by the first inspector device, a second key-pair using the second set of key parameters and the shared key;
- exchanging the shared key between the first inspector device and a second inspector device;
- receiving, by the second inspector device, the first set of key parameters;
- generating, by the second inspector device, a third key-pair using the first set of key parameters and the shared key, wherein the first key-pair and the third key-pair are identical;
- receiving, by the second inspector device, the second set of key parameters;
- and
- generating, by the second inspector device, a fourth key-pair using the second set of key parameters and the shared key, wherein the second key-pair and the fourth key-pair are identical.
A computer program product for providing stateless synchronization, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
- receive, by a first inspector device, a first set of key parameters while in a communication session;
- cause the first inspector device to generate a first key-pair using the first set of key parameters and a shared key;
- receive, by the first inspector device, a second set of key parameters while in the communication session;
- cause the first inspector device to generate a second key-pair using the second set of key parameters and the shared key;
- exchange the shared key between the first inspector device and a second inspector device;
- receive, by the second inspector device, the first set of key parameters;
- cause the second inspector device to generate a third key-pair using the first set of key parameters and the shared key, wherein the first key-pair and the third key-pair are identical;
- receive, by the second inspector device, the second set of key parameters;
- and
- cause the second inspector device to generate a fourth key-pair using the second set of key parameters and the shared key, wherein the second key-pair and the fourth key-pair are identical.
A system for providing stateless synchronization, comprising:
- a first inspector device including memory configured to:
- receive a first set of key parameters while in a communication session,
- generate a first key-pair using the first set of key parameters and a shared key,
- receive a second set of key parameters while in the communication session,
- generate a second key-pair using the second set of key parameters and the shared key, and
- exchange the shared key with a second inspector device including memory;
- and
- the second inspector device including memory configured to:
- receive the first set of key parameters,
- generate a third key-pair using the first set of key parameters and the shared key wherein the first key-pair and the third key-pair are identical,
- receive the second set of key parameters, and
- generate a fourth key-pair using the second set of key parameters and the shared key wherein the second key-pair and the fourth key-pair are identical.
Dependencies are inferred from the claim text.