# US 11,122,019 B2 · Systems and methods for client collaborated migration of live TLS connection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,019 B2 - Document ID: US11122019B2 - Status: Granted - Kind: B2 - Application number: 16/570,364 - Filed: 2019-09-13 - Published: 2021-03-18 - Granted: 2021-09-14 - Earliest claimed: 2019-09-13 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Abhishek Dadhich; Kant C. Patel; Feroz Alam Khan; Bhaskar Mathur; Srinivas Pamu - Web page: https://patentgrep.com/patent/US11122019B2 ## CPC - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0281: {Proxies} - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/166: {at the transport layer} - H04L 67/2895: Intermediate processing functionally located close to the data provider application, e.g. reverse proxies - H04L 67/562: Brokering proxy services - H04L 69/162: {involving adaptations of sockets based mechanisms (secure socket layer H04L63/168)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Described is an improved approach to ensure high availability for established sessions (e.g., application layer sessions) over network connections that negotiates and renegotiates encryption keys (e.g., TLS/SSL) at clean boundaries to ensure in-transit data are properly handled during migration of an application (e.g., a reverse proxy server instance). Connected TCP sessions may be handed off to another application (e.g., from existing proxy server to new/upgraded proxy server) and after establishing a new TLS session with a new encryption key, data transfer may be resumed between a client and a server using the new/upgraded application in a client-server architecture. ## Claims ### Claim 1 A method comprising: maintaining a client-server architecture, the client-server architecture comprising a client, a server, and an intermediate server running a first application for handling messages transmitted between the client and the server, wherein the messages transmitted between the client and the intermediate server are secured using an encryption key over a first TCP connection and the messages transmitted between the intermediate server and the server are over a second TCP connection; initiating a move from the first application to a second application; transferring a TCP socket handle used by the first application to the second application by at least detecting a negotiation message sent from the client to the first application; negotiating a new encryption key between the client and the second application; and processing the messages between the client and the second application using the new encryption key by having the second application receive messages using the TCP socket handle transferred from the first application. ### Claim 2 (depends on 1) The method of claim 1, wherein the negotiation message is detected using a TCP message peek function. ### Claim 3 (depends on 1) The method of claim 1, wherein the move from the first application to the second application is a migration from a first version of an application to a second version of the application, the first version and the second version being different versions. ### Claim 4 (depends on 1) The method of claim 1, wherein the first application and the second application are reverse proxy servers. ### Claim 5 (depends on 1) The method of claim 1, further comprising stopping acknowledgement receipts from being sent to the server in response to the move being initiated, wherein the acknowledgement receipts correspond to messages that are sent from the server to the first application. ### Claim 6 (depends on 5) The method of claim 5, further comprising sending a control message to the client in response to the move being initiated, wherein the control message informs the client that the first application is undergoing the move. ### Claim 7 (depends on 6) The method of claim 6, wherein the negotiation message initiates the negotiation of the new encryption key between the client and the second application. ### Claim 8 A system comprising: a processor; and a memory to hold a set of program code instructions, in which the set of program code instructions comprises program code to perform: maintaining a client-server architecture, the client-server architecture comprising a client, a server, and an intermediate server running a first application for handling messages transmitted between the client and the server, wherein the messages transmitted between the client and the intermediate server are secured using an encryption key over a first TCP connection and the messages transmitted between the intermediate server and the server are over a second TCP connection, initiating a move from the first application to a second application, transferring a TCP socket handle used by the first application to the second application by at least detecting a negotiation message sent from the client to the first application, negotiating a new encryption key between the client and the second application, and processing the messages between the client and the second application using the new encryption key by having the second application receive messages using the TCP socket handle transferred from the first application. ### Claim 9 (depends on 8) The system of claim 8, wherein the negotiation message is detected using a TCP message peek function. ### Claim 10 (depends on 8) The system of claim 8, wherein the move from the first application to the second application is a migration from a first version of an application to a second version of the application, the first version and the second version being different versions. ### Claim 11 (depends on 8) The system of claim 8, wherein the first application and the second application are reverse proxy servers. ### Claim 12 (depends on 8) The system of claim 8, wherein the set of program code instructions further comprises program code to stop acknowledgement receipts from being sent to the server in response to the move being initiated, wherein the acknowledgement receipts correspond to messages that are sent from the server to the first application. ### Claim 13 (depends on 12) The system of claim 12, wherein the set of program code instructions further comprises program code to send a control message to the client in response to the move being initiated, wherein the control message informs the client that the first application is undergoing the move. ### Claim 14 (depends on 13) The system of claim 13, wherein the negotiation message initiates the negotiation of the new encryption key between the client and the second application. ### Claim 15 A computer program product including a non-transitory computer readable medium having instructions which, when executed by a processor, causes the processor to perform a process, the process comprising: maintaining a client-server architecture, the client-server architecture comprising a client, a server, and an intermediate server running a first application for handling messages transmitted between the client and the server, wherein the messages transmitted between the client and the intermediate server are secured using an encryption key over a first TCP connection and the messages transmitted between the intermediate server and the server are over a second TCP connection; initiating a move from the first application to a second application; transferring a TCP socket handle used by the first application to the second application by at least detecting a negotiation message sent from the client to the first application; negotiating a new encryption key between the client and the second application; and processing the messages between the client and the second application using the new encryption key by having the second application receive messages using the TCP socket handle transferred from the first application. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the negotiation message is detected using a TCP message peek function. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the move from the first application to the second application is a migration from a first version of an application to a second version of the application, the first version and the second version being different versions. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the first application and the second application are reverse proxy servers. ### Claim 19 (depends on 15) The computer program product of claim 15, further comprising instructions to cause the processor to stop acknowledgement receipts from being sent to the server in response to the move being initiated, wherein the acknowledgement receipts correspond to messages that are sent from the server to the first application. ### Claim 20 (depends on 19) The computer program product of claim 19, further comprising instructions to cause the processor to send a control message to the client in response to the move being initiated, wherein the control message informs the client that the first application is undergoing the move. ### Claim 21 (depends on 20) The computer program product of claim 20, wherein the negotiation message initiates the negotiation of the new encryption key between the client and the second application.