US 11,606,193 B2Granted

Distributed session resumption

AssigneeOracle International Corporation

InventorXuelei Fan

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for re-establishing secure application sessions using an abbreviated authentication process are disclosed. A plurality of servers each use a deterministic process to independently generate a symmetric key. A client initiates an application session with one of the servers using a full authentication process. Before the connection is terminated, the server generates a session ticket, including security parameters negotiated during the full authentication process, and encrypts the session ticket with the symmetric key. Another server receives the session ticket and decrypts the session ticket using the symmetric key to initiate an abbreviated authentication process that is less costly than the full authentication process. The client and the server establish a secure communication channel based on successful completion of the abbreviated authentication process.

Claims23

Dependent claims

A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:

executing, by each of a plurality of servers, a deterministic process to independently generate a first symmetric key for encryption and decryption of session tickets, wherein each of a first server and a second server of the plurality of servers independently generate the same first symmetric key using the deterministic process,
wherein the first server generates the first symmetric key based at least in part on applying a hash function to a first value, wherein the first value comprises at least one of a first clock value and a first counter value, and
wherein the second server generates the first symmetric key based at least in part on applying the hash function to a second value, different from the first value, wherein the second value comprises at least one of a second clock value and a second counter value;
executing, by the first server, a first authentication process to authenticate a client device;
based on the authentication of the client device using the first authentication process:
generating, by the first server, a session ticket that can be used for re-authenticating the client device using a second authentication process that is less computationally expensive than the first authentication process;
encrypting, by the first server, the session ticket using the first symmetric key to generate an encrypted session ticket;
and
transmitting, by the first server, the encrypted session ticket to the client device;
receiving, by the second server from the client device, an authentication request comprising the encrypted session ticket;
decrypting, by the second server, the encrypted session ticket using the first symmetric key generated by the second server to obtain the session ticket;
and
executing, by the second server, the second authentication process using the session ticket to re-authenticate the client device.

10 more elements

A method, comprising:

executing, by each of a plurality of servers, a deterministic process to independently generate a first symmetric key for encryption and decryption of session tickets, wherein each of a first server and a second server of the plurality of servers independently generate the same first symmetric key using the deterministic process,
wherein the first server generates the first symmetric key based at least in part on applying a hash function to a first value, wherein the first value comprises at least one of a first clock value and a first counter value, and
wherein the second server generates the first symmetric key based at least in part on applying the hash function to a second value, different from the first value, wherein the second value comprises at least one of a second clock value and a second counter value;
executing, by the first server, a first authentication process to authenticate a client device;
based on the authentication of the client device using the first authentication process:
generating, by the first server, a session ticket that can be used for re-authenticating the client device using a second authentication process that is less computationally expensive than the first authentication process;
encrypting, by the first server, the session ticket using the first symmetric key to generate an encrypted session ticket;
and
transmitting, by the first server, the encrypted session ticket to the client device;
receiving, by the second server from the client device, an authentication request comprising the encrypted session ticket;
decrypting, by the second server, the encrypted session ticket using the first symmetric key generated by the second server to obtain the session ticket;
and
executing, by the second server, the second authentication process using the session ticket to re-authenticate the client device.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/030,781Filed 24 Sep 2020 · us provisional application
Priority: 14 Sep 2020
Published: US 2022/0085976 A117 Mar 2022
Granted: 14 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 9/0643
The encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions;…
H04L 9/12
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: transmitting and receiving…
H04L 9/0861
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: generation of secret information…
H04L 9/0891
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: revocation or update of secret…