# US 12,003,639 B2 · Techniques for sharing secure communication sessions within a computer network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,639 B2 - Document ID: US12003639B2 - Status: Granted - Kind: B2 - Application number: 17/071,978 - Filed: 2020-10-15 - Published: 2022-04-21 - Granted: 2024-06-04 - Earliest claimed: 2020-10-15 - Assignees: Netflix, Inc. - Applicants: Netflix, Inc. - Inventors: Andrew Chen; Jonathan T. Looney - Web page: https://patentgrep.com/patent/US12003639B2 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In various embodiments, servers in a server pool share a centrally-generated encryption key that is used to encrypt session keys in tickets that can be used by client applications to share secure communication sessions across different servers belonging to the same server pools. When the client application first establishes a secure communication session with a server in a server pool, the server returns a ticket that includes an encrypted version of a session key generated using an encryption key shared by servers in the server pool. Thereafter, the client application can present the ticket to other servers in the server pool to restore the secure communication session with the other servers. Associations between servers and server pools can be communicated to the client application in any technically feasible manner, such as part of information indicating servers from which content can be accessed or via the Domain Name System (DNS). ## Claims ### Claim 1 A computer-implemented method for sharing secure communication sessions within a computer network, the method comprising: receiving a first ticket from a first server that is included in a first server pool and with which a first secure communication session has been established, wherein the first ticket is generated by the first server encrypting a first session key using a first shared encryption key, wherein the first shared encryption key is used by a first plurality of servers included in the first server pool at a first time to encrypt and decrypt one or more session keys, and wherein a second ticket is generated by encrypting a second session key using a second shared encryption key that is used by a second plurality of servers included in a second server pool at the first time to encrypt and decrypt one or more other session keys, and the second ticket is used to establish and restore a second secure communication session with one or more servers included in the second plurality of servers; receiving information indicating that a different server also is included in the first plurality of servers and is associated with a first address; establishing a connection with the different server based on the first address; and restoring the first secure communication session with the different server using the first ticket. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising storing the first ticket and an association between the first server pool and the first ticket in a cache, wherein restoring the first secure communication session with the different server comprises retrieving the first ticket stored in the cache, and transmitting the first ticket to the different server based on the association. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising performing a handshake with the different server if the first ticket has expired. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the first shared encryption key can be used to encrypt and decrypt session keys during a first period of time and to only decrypt session keys during a second period of time that is after the first period of time. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, further comprising receiving a third ticket from the first server to be used during the second period of time, wherein the third ticket is generated using a third shared encryption key that is used by the first plurality of servers included in the first server pool. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving information indicating that a third server is included in the second server pool and a second address associated with the third server; establishing a connection with the third server based on the second address; and establishing the second secure communication session with the third server, wherein establishing the second secure communication session comprises performing a handshake with the third server. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the first secure communication session and the second secure communication session comprise Transport Layer Security (TLS) sessions, and the first ticket comprises a TLS ticket. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the first address comprises a uniform resource locator (URL), and the information indicates an identifier (ID) of the first server pool. ### Claim 9 A computer-implemented method comprising: storing associations between servers and server pools, wherein a first plurality of servers in a first server pool uses a first shared encryption key at a first time to encrypt and decrypt a first session key to generate a first ticket that is used to establish and restore a first secure communication session with one or more servers included in the first plurality of servers, and a second plurality of servers in a second server pool uses a second shared encryption key at the first time to encrypt and decrypt a second session key to generate a second ticket that is used to establish and restore a second secure communication session with one or more servers included in the second plurality of servers; and transmitting, to a client application, information indicating an address of a first server included in the first plurality of servers from which content can be accessed and indicating a first association between the first server pool and the first server, wherein the client application causes the first ticket to be stored and can use the first ticket to establish the first secure communication session with the first server, and the client application can use the first ticket to restore the first secure communication session with a different server included in the first plurality of servers based on the first association. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, further comprising determining the first server based on a request from the client application. ### Claim 11 (depends on 9) The computer-implemented method of claim 9, wherein the first server is identified by the client application based on a predictive technique. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, wherein the first and second shared encryption keys are generated by a key generator and distributed to the servers in the first and second server pools. ### Claim 13 (depends on 9) The computer-implemented method of claim 9, wherein the first shared encryption key used by the first plurality of servers in the first server pool has a different expiration time than the second shared encryption key used by the second plurality of servers in the second server pool. ### Claim 14 (depends on 9) The computer-implemented method of claim 9, wherein the address comprises a uniform resource locator (URL), and the information indicates an identifier (ID) of the first server pool. ### Claim 15 (depends on 9) The computer-implemented method of claim 9, wherein the client application is a web browser. ### Claim 16 (depends on 9) The computer-implemented method of claim 9, wherein the client application is a streaming video application. ### Claim 17 A system, comprising: one or more memories storing a client application; and one or more processors that are coupled to the one or more memories and, when executing the client application, are configured to perform the steps of: receiving a first ticket from a first server that is included in a first server pool and with which a first secure communication session has been established, wherein the first ticket is generated by the first server encrypting a first session key using a first shared encryption key, wherein the first shared encryption key is used by a first plurality of servers included in the first server pool at a first time to encrypt and decrypt one or more session keys, and wherein a second ticket is generated by encrypting a second session key using a second shared encryption key that is used by a second plurality of servers included in a second server pool at the first time to encrypt and decrypt one or more other session keys, and the second ticket is used to establish and restore a second secure communication session with one or more servers included in the second plurality of servers, receiving information indicating that a different server also is included in the first plurality of servers and is associated with a first address, establishing a connection with the different server based on the first address, and restoring the secure communication session with the different server using the first ticket. ### Claim 18 (depends on 17) The system of claim 17, the steps further comprising storing the first ticket and an association between the first server pool and the first ticket in a cache, wherein restoring the first secure communication session with the different server comprises retrieving the first ticket stored in the cache, and transmitting the first ticket to the different server based on the association. ### Claim 19 (depends on 17) The system of claim 17, the steps further comprising performing a handshake with the different server if the first ticket has expired. ### Claim 20 (depends on 17) The system of claim 17, wherein the first secure communication session is a Transport Layer Security (TLS) session.