# US 12,192,237 B2 · Detecting attacks using handshake requests systems and methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,237 B2
- Document ID: US12192237B2
- Status: Granted
- Kind: B2
- Application number: 17/236,233
- Filed: 2021-04-21
- Published: 2021-08-05
- Granted: 2025-01-07
- Earliest claimed: 2018-12-03
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Andrew Penner; Tushar Kanekar
- Web page: https://patentgrep.com/patent/US12192237B2

## CPC

- H04L 63/1458: {Denial of Service}
- H04L 63/166: {at the transport layer}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/126: {the source of the received data}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/168: {above the transport layer}
- H04L 67/63: Routing a service request depending on the request content or context
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods for detecting attacks using a handshake request are provided. A plurality of devices can receive a plurality of handshake requests to establish TLS connections that include a respective application request. At least one of the plurality of handshake requests can include a first application request. The plurality of devices can record each of the respective application requests to a registry of application requests. A first device of the plurality of devices can receive a subsequent handshake request to establish a subsequent TLS connection that includes the first application request. The first device can query, prior to accepting the first application request, the registry for the first application request. The first device can determine whether to accept or reject the first application request responsive to identifying from the query that the first application request has not been or has been recorded in the registry.

## Claims

### Claim 1

A method comprising:
receiving, by a computing device, a handshake request to establish a connection for an application request to access an application, wherein the connection is a transport layer security (TLS) connection;
identifying, by the computing device prior to one of rejecting or accepting the handshake request to establish the TLS connection for the application request, that the application request of the handshake request is stored in a registry, the registry storing application requests received from handshake requests across a plurality of computing devices, wherein the handshake request of the application request is different from the handshake requests that provided the application requests stored in the registry;
determining, by the computing device, prior to accepting the handshake request to establish the connection for the application request, to reject the application request of the handshake request responsive to identifying that the application request is stored in the registry; and
accepting the handshake request to establish the connection and rejecting the application request.

### Claim 2 (depends on 1)

The method of claim 1, wherein the plurality of computing devices is intermediary to a requestor of the application and the application.

### Claim 3 (depends on 1)

The method of claim 1, wherein the plurality of computing devices record to the registry at least each respective application request of the handshake requests.

### Claim 4 (depends on 1)

The method of claim 1, further comprising querying, by the computing device, the registry for the application request of the handshake request.

### Claim 5

A system comprising:
one or more processors, coupled to memory and configured to:
receive a handshake request to establish a connection for an application request to access an application, wherein the connection is a transport layer security (TLS) connection;
identify, prior to one of rejecting or accepting the handshake request to establish the connection for the application request, that the application request of the handshake request is stored in a registry, the registry storing application requests received from handshake requests across a plurality of computing devices, wherein the handshake request of the application request is different from the handshake requests that provided the application requests stored in the registry;
determine, prior to accepting the handshake request to establish the connection for the application request, to reject the application request of the handshake request responsive to identifying that the application request is stored in the registry; and
accept the handshake request to establish the connection and rejecting the application request.

### Claim 6 (depends on 5)

The system of claim 5, wherein the plurality of computing devices is intermediary to a requestor of the application and the application.

### Claim 7 (depends on 5)

The system of claim 5, wherein the plurality of computing devices record to the registry at least each respective application request of the handshake requests.

### Claim 8 (depends on 5)

The system of claim 5, wherein the one or more processors are further configured to query the registry for the application request of the handshake request.

### Claim 9

A non-transitory computer readable medium storing program instructions for causing one or more processors to:
receive a handshake request to establish a connection for an application request to access an application, wherein the connection is a transport layer security (TLS) connection;
identify, prior to one of rejecting or accepting the handshake request to establish the TLS connection for the application request, that the application request of the handshake request is stored in a registry, the registry storing application requests received from handshake requests across a plurality of computing devices, wherein the handshake request of the application request is different from the handshake requests that provided the application requests stored in the registry;
determine, prior to accepting the handshake request to establish the connection for the application request, to reject the application request of the handshake request responsive to identifying that the application request is stored in the registry; and
accept the handshake request to establish the connection and rejecting the application request.

### Claim 10 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein the program instructions further cause the one or more processors to query the registry for the application request of the handshake request.

### Claim 11 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein the plurality of computing devices record to the registry at least each respective application request of the handshake requests.