Scalable session management

A method, comprising:

• generating cookie data associated with an established session between a server and a client;
• determining a first key ID associated with a private/public key pair for signing a session key, the private/public key pair for signing the session key comprising a first private key and a first public key, wherein the private/public key pair is obtained from a private/public key store;
• signing the session key with the first private key to generate a signed session key;
• determining a second key ID associated with another private/public key pair for encrypting the session key and the signed session key, the private/public key pair for encrypting the session key and the signed session key comprising a second private key and a second public key, wherein the another private/public key pair is obtained from the private/public key store;
• encrypting the session key and the signed session key with the second public key to generate an encrypted signed key;
• encrypting the cookie data with the session key to generate encrypted cookie data;
• generating an authentication tag by applying a message authentication code to the cookie data and the session key;
• generating a cookie by combining the first key ID, the second key ID, the encrypted signed key, the encrypted cookie data, and the authentication tag;
• storing the session key and the encrypted signed key in a session key cache;
• receiving the cookie from the client;
• parsing the cookie to identify the first key ID, the second key ID, the encrypted signed key, the encrypted cookie data, and the authentication tag;
• searching the session key associated with the encrypted signed key in the session key cache based on the encrypted signed key;
• in an event that the session key is found in the session key cache, decrypting the encrypted cookie data using the session key, resulting in the cookie data;
• in an event that the session key is not found in the session key cache:
• searching the first public/private key pair based on the first key ID in the private/public key store, the private/public key pair comprising the first private key and the first public key;
• decrypting the encrypted signed key using the first private key, resulting in a session key and a signed session key;
• determining the second private/public key pair based on the second key ID, the second private/public key pair comprising the second private key and the second public key;
• verifying the signed session key using the second public key, the session key, and the signed session key;
• if the signed session key is invalid, generating an error message and refusing to accept the data cookie;
• and
• if the signed session key is valid:
• updating the session key and the encrypted signed key in the session key cache;
• and
• decrypting the encrypted cookie data using the session key, resulting in the cookie data;
• verifying the cookie by applying the message authentication code to the cookie data and the session key and comparing the result to the authentication tag;
• in an event that the result does not match the authentication tag, generating an error message and refusing to accept the cookie;
• and
• in an event that the result matches the authentication tag, using the cookie data.