US 2018/0020020 A1Published application

Seamless abort and reinstatement of tls sessions

AssigneeInternational Business Machines Corporation

InventorsCHENG-TA LEE, PING MIN LIN, WEI-SHIAU SUEN, MING-HSUN WU

Life of this patent

Estimating the term…

Loading patent…

Abstract

In response to receiving an unknown first session identifier from a client for a first communication session between the client and a server, a Man in the Middle (MitM) computer requests a second session identifier from the server for a second communication session between the server and the MitM computer. The MitM computer generates a third session identifier for a third communication session between the MitM computer and the client. The MitM computer generates a fourth communication session between the server and the client using a combination of the second communication session and the third communication session. In response to receiving an invalid session identifier from the client for a fifth communication session between the client and the server, the MitM computer transmits an instruction, to the client, to flush a session cache in the client to force a full TLS handshake between the client and the server.

Claims20

Dependent claims

A method comprising:

receiving, by a Man in the Middle (MitM) computer, an unknown first session identifier from a client for a first communication session between the client and a server, wherein the MitM computer monitors Transport Layer Security (TLS) communication sessions between the client and the server;
in response to receiving the unknown first session identifier from the client for the first communication session between the client and the server, requesting, by the MitM computer, a second session identifier from the server for a second communication session between the server and the MitM computer;
generating, by the MitM computer, a third session identifier for a third communication session between the MitM computer and the client;
establishing, via the MitM computer, a fourth communication session between the server and the client using a combination of the second communication session and the third communication session;
detecting, by the MitM computer, an end of the fourth communication session;
subsequent to detecting the end of the fourth communication session, receiving, by the MitM computer, an invalid session identifier from the client for a fifth communication session between the client and the server;
and
in response to receiving the invalid session identifier from the client for the fifth communication session between the client and the server, transmitting an instruction, from the MitM computer to the client, to flush a session cache in the client, wherein flushing the session cache in the client forces the client and the server to establish a full TLS handshake in order to establish the fifth communication session between the client and the server.

5 more elements

A computer program product comprising one or more computer readable storage mediums, and program instructions stored on at least one of the one or more storage mediums, the stored program instructions comprising:

program instructions to receive an unknown first session identifier from a client for a first communication session between the client and a server, wherein a Man in the Middle (MitM) computer monitors Transport Layer Security (TLS) communication sessions between the client and the server;
program instructions to, in response to receiving the unknown first session identifier from the client for the first communication session between the client and the server, request a second session identifier from the server for a second communication session between the server and the MitM computer;
program instructions to generate a third session identifier for a third communication session between the MitM computer and the client;
program instructions to establish a fourth communication session between the server and the client using a combination of the second communication session and the third communication session;
program instructions to detect an end of the fourth communication session;
program instructions to, subsequent to detecting the end of the fourth communication session, receive an invalid session identifier from the client for a fifth communication session between the client and the server;
and
program instructions to, in response to receiving the invalid session identifier from the client for the fifth communication session between the client and the server, transmit an instruction to the client to flush a session cache in the client, wherein flushing the session cache in the client forces the client and the server to establish a full TLS handshake in order to establish the fifth communication session between the client and the server.

5 more elements

A computer system comprising one or more processors, one or more computer readable memories, and one or more computer readable storage mediums, and program instructions stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:

program instructions to receive an unknown first session identifier from a client for a first communication session between the client and a server, wherein a Man in the Middle (MitM) computer monitors Transport Layer Security (TLS) communication sessions between the client and the server;
program instructions to, in response to receiving the unknown first session identifier from the client for the first communication session between the client and the server, request a second session identifier from the server for a second communication session between the server and the MitM computer;
program instructions to generate a third session identifier for a third communication session between the MitM computer and the client;
program instructions to establish a fourth communication session between the server and the client using a combination of the second communication session and the third communication session;
program instructions to detect an end of the fourth communication session;
program instructions to, subsequent to detecting the end of the fourth communication session, receive an invalid session identifier from the client for a fifth communication session between the client and the server;
and
program instructions to, in response to receiving the invalid session identifier from the client for the fifth communication session between the client and the server, transmit an instruction to the client to flush a session cache in the client, wherein flushing the session cache in the client forces the client and the server to establish a full TLS handshake in order to establish the fifth communication session between the client and the server.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/211,090Filed 15 Jul 2016
Published: 18 Jan 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…
H04L 9/0894
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: escrow, recovery or storing of secret…
H04L 63/061
For supporting key management in a packet data network: for key exchange, e.g. in peer-to-peer networks
H04L 63/0823
For authentication of entities: using certificates