End-to-end transport layer security
AssigneeWells Fargo Bank, N.A.
InventorJeffrey J. Stapleton
Life of this patent
Estimating the term…
Abstract
The present disclosure relate to exchanging information between a start node and an end node. Based on the information session keys for a connection comprising the start node, the end node, and at least one intermediate node are established. The session keys include a data encryption session key and a Message Authentication Code (MAC) session key. The data is encrypted using the data encryption session key at the start node. MAC is generated using the MAC session key. The encrypted data is relayed, via the at least one intermediate node, from the start node to the end node without the at least one intermediate node re-encrypting the data.
Claims20
At least one non-transitory processor-readable medium comprising processor-readable instructions such that, when executed, causes at least one processor to:
- exchange information between a start node and an end node via a Transport Layer Security (TLS) connection between the start node, at least one intermediate node, and the end node;
- establish, based on the information, one session key set for the TLS connection at the start node and the end node, the one session key set comprising a data encryption session key and a Message Authentication Code (MAC) session key;
- encrypt at the start node data using the data encryption session key;
- generate at the start node a MAC using the MAC session key;
- and
- relay, via the at least one intermediate node, the encrypted data from the start node to the end node without the at least one intermediate node (i) decrypting and re-encrypting the encrypted data and (ii) receiving the one session key set from the start node or the end node.
A system, comprising:
- at least one memory;
- and
- at least one processor configured to:
- exchange information between a start node and an end node via a Transport Layer Security (TLS) connection between the start node, at least one intermediate node, and the end node;
- establish, based on the information, one session key set for the TLS connection at the start node and the end node, the one session key set comprising a data encryption session key and a Message Authentication Code (MAC) session key;
- encrypt at the start node data using the session key data encryption;
- generate at the start node a MAC using the MAC session key;
- and
- relay, via the at least one intermediate node, the encrypted data from the start node to the end node without the at least one intermediate node (i) decrypting and re-encrypting the encrypted data and (ii) receiving the one session key set from the start node or the end node.
A method, comprising:
- exchanging information between a start node and an end node via a Transport Layer Security (TLS) connection between the start node, at least one intermediate node, and the end node;
- establishing, based on the information, one session key set for the TLS connection at the start node and the end node, the one session key set comprising a data encryption session key and a Message Authentication Code (MAC) session key;
- encrypting at the start node data using the data encryption session key;
- generating at the start node a MAC using the MAC session key;
- and
- relaying, via the at least one intermediate node, the encrypted data from the start node to the end node without the at least one intermediate node (i) decrypting and re-encrypting the encrypted data and (ii) receiving the one session key set from the start node or the end node.
Dependencies are inferred from the claim text.