# US 8,752,162 B2 · Secure sharing of transport layer security session keys with trusted enforcement points > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,162 B2 - Document ID: US8752162B2 - Status: Granted - Kind: B2 - Application number: 13/158,388 - Filed: 2011-06-11 - Published: 2011-09-29 - Granted: 2014-06-10 - Earliest claimed: 2007-07-16 - Assignees: International Business Machines Corporation - Applicants: David G. Kuehr-McLaren; Linwood H. Overby, Jr. - Inventors: David G. Kuehr-McLaren; Linwood H. Overby, Jr. - Web page: https://patentgrep.com/patent/US8752162B2 ## CPC - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of the present invention address deficiencies of the art in respect to security enforcement point operability in a TLS secured communications path and provide a novel and non-obvious method, system and computer program product for the secure sharing of TLS session keys with trusted enforcement points. In one embodiment of the invention, a method for securely sharing TLS session keys with trusted enforcement points can be provided. The method can include conducting a TLS handshake with a TLS client to extract and decrypt a session key for a TLS session with the TLS client traversing at least one security enforcement point. The method further can include providing the session key to a communicatively coupled key server for distribution to the at least one security enforcement point. Finally, the method can include engaging in secure communications with the TLS client over the TLS session. ## Claims ### Claim 1 A method for securely sharing transport layer security (TLS) session keys with trusted enforcement points, the method comprising: conducting a TLS handshake with a TLS client to create a session key for a TLS session with the TLS client, the TLS session traversing at least one security enforcement point; providing the session key and also an initialization vector for the TLS session to a communicatively coupled central key server for distribution to the at least one security enforcement point on demand; and, engaging in secure communications with the TLS client over the TLS session. ### Claim 2 (depends on 1) The method of claim 1, further comprising providing not only the session key to the communicatively coupled central key server, but also a cipher algorithm for the TLS session. ### Claim 3 (depends on 1) The method of claim 1, further comprising providing not only the session key to the communicatively coupled central key server, but also a session identifier for the TLS session. ### Claim 4 (depends on 1) The method of claim 1, wherein providing the session key to a communicatively coupled central key server for distribution to the at least one security enforcement point, comprises providing the session key to a communicatively coupled central key server for distribution to subscribing ones of the at least one security enforcement point. ### Claim 5 (depends on 1) The method of claim 1, wherein providing the session key to a communicatively coupled central key server for distribution to the at least one security enforcement point, comprises providing the session key to a communicatively coupled key server for distribution to requesting ones of the at least one security enforcement point. ### Claim 6 A secure communications data processing system for securely sharing transport layer security (TLS) session keys with trusted enforcement points, the system comprising: a TLS endpoint configured for coupling to a plurality of TLS clients; a central key server communicatively coupled to the TLS endpoint, the TLS endpoint providing TLS session keys and also initialization vectors to the central key server; and, at least one security enforcement point disposed between the TLS clients and the TLS endpoint, the security enforcement point comprising a secure and trusted communicative link with the central key server over which TLS session keys and also initialization vectors for corresponding secure communications paths between the TLS clients and the TLS endpoint are distributed to the security enforcement point on demand. ### Claim 7 A computer program product comprising a computer usable storage device embodying computer usable program code for securely sharing transport layer security (TLS) session keys with trusted enforcement points, the computer program product comprising: computer usable program code for conducting a TLS handshake with a TLS client to create a session key for a TLS session with the TLS client the TLS session traversing at least one security enforcement point; computer usable program code for providing the session key and also an initialization vector for the TLS session to a communicatively coupled central key server for distribution to the at least one security enforcement point on demand; and, computer usable program code for engaging in secure communications with the TLS client over the TLS session. ### Claim 8 (depends on 7) The computer program product of claim 7, further comprising computer usable program code for providing not only the session key to the communicatively coupled central key server, but also a cipher algorithm for the TLS session. ### Claim 9 (depends on 7) The computer program product of claim 7, further comprising computer usable program code for providing not only the session key to the communicatively coupled central key server, but also a session identifier for the TLS session. ### Claim 10 (depends on 7) The computer program product of claim 7, wherein the computer usable program code for providing the session key to a communicatively coupled central key server for distribution to the at least one security enforcement point, comprises computer usable program code for providing the session key to a communicatively coupled central key server for distribution to subscribing ones of the at least one security enforcement point. ### Claim 11 (depends on 7) The computer program product of claim 7, wherein the computer usable program code for providing the session key to a communicatively coupled central key server for distribution to the at least one security enforcement point, comprises computer usable program code for providing the session key to a communicatively coupled central key server for distribution to requesting ones of the at least one security enforcement point.