# US 12,003,540 B1 · Communication session resumption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,540 B1 - Document ID: US12003540B1 - Status: Granted - Kind: B1 - Application number: 17/196,875 - Filed: 2021-03-09 - Granted: 2024-06-04 - Earliest claimed: 2016-01-21 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Nima Sharifi Mehr - Web page: https://patentgrep.com/patent/US12003540B1 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 63/166: {at the transport layer} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/164: {at the network layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present document describes a communication session resumption mechanism. A client computer system establishes a communication session to a server computer that is a member of a set of related server computers. As a result of establishing the communication session, the server computer identifies the set of related server computers to the client computer system. The set of related server computers share communication session information with each other, allowing the client computer system to resume the communication session with another server computer belonging to the set of related server computers. The communication session may be specified to the other server computer by the client computer system by providing a session identifier or a session ticket. ## Claims ### Claim 1 A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors, cause the one or more processors to at least: as a result of a cryptographically protected communication session being initiated between a first server and a client computer, obtain at the client computer from the first server a list of servers that indicates a plurality of servers with which a cryptographically protected communication session may be established, wherein the list of servers is associated with session parameters that comprise at least a cryptographic key or a cipher suite; determine that a second server is in the list of servers; as a result of information that identifies a session associated with the session parameters, retrieve, from a database, the session parameters; and resume a cryptographically protected communication session between the second server and the client computer based at least in part on the session parameters such that data is securely communicated using at least the cryptographic key or the cipher suite of the session parameters. ### Claim 2 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the one or more processors to: determine a session identifier associated with the cryptographically protected communication session; store the session identifier in association with the session parameters; and obtain, by the second server, the session identifier, wherein the information includes the session identifier. ### Claim 3 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the one or more processors to: obtain a session ticket including the session parameters; and store the session ticket in association with the list of servers. ### Claim 4 (depends on 3) The non-transitory computer-readable storage medium of claim 3, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the one or more processors to: subsequent to the cryptographically protected communication session being resumed, establish new session parameters for the cryptographically protected communication session; and obtain a refreshed session ticket, the refreshed session ticket based at least in part on the new session parameters. ### Claim 5 A system that at least: as a result of receiving, at a first server, from a client computer, a request to establish a cryptographically protecte communication session with the first server in accordance with a first set of session parameters, obtains a list of servers at the client computer from the first server that identifies a plurality of servers with which the cryptographically protected communication session may be resumed, wherein the first set of session parameters includes a cryptographic key and is associated with the list of servers; receives, at a second server in the list of servers, from the client computer, another request to establish another communication session with the second server; and based at least on the other request, establishes the other communication session between the second server and the client computer in accordance with a second set of session parameters, the second set of session parameters based at least in part on the first set of session parameters, wherein the other communication session enables data to be communicated between the second server and the client computer using at least the cryptographic key of the first set of session parameters. ### Claim 6 (depends on 5) The system of claim 5, wherein the system further: sends, from the second server, to the client computer, a session ticket including information that identifies the other communication session. ### Claim 7 (depends on 6) The system of claim 6, wherein: the session ticket is associated with a Transport Layer Security protocol (TLS) message; and the session ticket is provided at least based on a TLS handshake between the client computer and the second server. ### Claim 8 (depends on 6) The system of claim 6, wherein: the session ticket is encrypted. ### Claim 9 (depends on 5) The system of claim 5, wherein the system further: establishes an expiration time for the second set of session parameters; determines that the second set of session parameters is not expired based at least in part on the expiration time; and as a result of having determined that the second set of session parameters is not expired, causes the second set of session parameters to be available for establishing new communication sessions. ### Claim 10 (depends on 5) The system of claim 5, wherein the system further: establishes a usage limit for the second set of session parameters; determines a number of times that the second set of session parameters has been used to establish a communication session; determines that the number of times does not exceed the usage limit; as a result of having determined that the number of times does not exceed the usage limit, determines that the second set of session parameters is not expired; and as a result of having determined that the second set of session parameters is not expired, causes the second set of session parameters to be available for establishing new communication sessions. ### Claim 11 (depends on 6) The system of claim 6, wherein the information is associated with an extension record in an extended TLS message. ### Claim 12 (depends on 5) The system of claim 5, wherein the cryptographic key of the first set of session parameters includes a write encryption key, a read decryption key, a write message authentication code key, or a read message authentication code key. ### Claim 13 A computer-implemented method comprising: as a result of receiving, from a client computer system, a request to establish a communication session and a handshake being initiated between the client computer system and a server providing to the client computer system, a list of servers that indicates a plurality of servers with which another communication session may be established; receiving, from the client computer system, another request to establish another communication session; storing a first set of session parameters associated with the communication session, wherein the first set of session parameters includes at least a cryptographic key or a cipher suite and is determined at least in part by the handshake between the client computer and the server; obtaining the cryptographic key or the cipher suite from the stored first set of session parameters as a result of receiving the other request; and establishing a cryptographically protected communication session based on the other request, the cryptographically protected communication session allowing exchange of cryptographically protected data between the client computer and the server based at least in part on the cryptographic key or the cipher suite of the first set of session parameters. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the request to establish the other communication session is received subsequent to receiving the request to establish the communication session. ### Claim 15 (depends on 13) The computer-implemented method of claim 13, further comprising: receiving a session ticket, the session ticket including the first set of session parameters. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, wherein: the session ticket is encrypted using a symmetric key; and the symmetric key is stored in a data store. ### Claim 17 (depends on 15) The computer-implemented method of claim 15, further comprising: receiving another session ticket for the other communication session. ### Claim 18 (depends on 13) The computer-implemented method of claim 13, providing information that identifies is the server, the information associated with a digital certificate. ### Claim 19 (depends on 13) The computer-implemented method of claim 13, further comprising: determining information that enables access to the first set of session parameters, the information associated with a message from the client computer. ### Claim 20 (depends on 13) The computer-implemented method of claim 13, wherein: the first set of session parameters is removed from a data store a threshold amount of time after being stored in the data store. ### Claim 21 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the list of servers comprises a reference to information that identifies servers in a sharing zone.