Handshake offload

Patent metadata

Field	Value
Publication number	US-10122692-B2
Application number	US-201514741384-A
Country	US
Kind code	B2
Filing date	Jun 16, 2015
Priority date	Jun 16, 2015
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

Cryptographically protected communications sessions are established using a distributed process. A server proxies handshake messages to another computer system that negotiates a cryptographically protected communications session with the client. When the client and other computer system complete negotiation of the session, the other computer system provides a set of session keys to the server. The server then uses the session keys to communicate with the client over the cryptographically protected communications session.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
establishing, by a load balancer, a network connection with a client computer system;
determining, by the load balancer and based at least in part on data associated with a first set of messages of a handshake protocol of a cryptographically protected communications protocol, a handshake server from a plurality of handshake servers;
proxying, by the load balancer, over a first cryptographically protected communications session with the handshake server that uses a first symmetric cryptographic key, the first set of messages between the client computer system and the handshake server thereby facilitating negotiation of a second symmetric cryptographic key for a second cryptographically protected communications session using an asymmetric key pair comprising a private cryptographic key accessible to the handshake server;
obtaining, by a server computer system, the second symmetric cryptographic key from the handshake server;
for a second set of messages outside of the handshake protocol of the cryptographically protected communications protocol, using at least the second symmetric cryptographic key to cryptographically process the second set of messages; and
as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server computer system includes data not encrypted in accordance with the cryptographically protected communications session; and
as a result of the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.

2. The computer-implemented method of claim 1 , wherein each message of the first set of messages is addressed to the handshake server.

3. The computer-implemented method of claim 1 , wherein the cryptographically protected communications protocol is a Secure Sockets Layer/Transport Layer Security protocol or Internet Protocol Security.

4. The computer-implemented method of claim 1 , wherein the server computer system and the handshake server are implemented on separate physical computing devices.

5. A system, comprising:
one or more processors; and
memory storing instructions that, as a result of being executed by the one or more processors, cause the system to:
receive, by a load balancer, a message from a client computer system;
determine, by a load balancer, whether the message is for a handshake based at least in part on data associated with the message;
if the message is for a handshake, provide the message to another computer system of a plurality of computer systems to perform the handshake and enable the other computer system to negotiate, with the client computer system, a cryptographically protected communications session;
obtain, by a server, a cryptographic key from the other computer system; and
use the cryptographic key to communicate to the client computer system over the cryptographically protected communications session; and
as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server includes data not encrypted in accordance with the cryptographically protected communications session; and
if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.

6. The system of claim 5 , wherein the cryptographically protected communications session is a Sockets Layer Security or Transport Layer Security session.

7. The system of claim 5 , wherein the instructions further include instructions that, as a result of being executed by the one or more processors, cause the system to:
if the message is not a handshake message, perform a set of tests on the message to determine whether the message comprises potentially malicious data; and
perform a mitigating action if determined that the message comprises potentially malicious data.

8. The system of claim 5 , wherein the instructions that cause the system uses the cryptographic key to communicate to the client computer system, as a result of being executed by the one or more processors, cause the system to encrypt data using the cryptographic key.

9. The system of claim 5 , wherein the system comprises the other computer system.

10. The system of claim 9 , wherein the other computer system is configured to apply a policy to determine whether to perform the handshake.

11. The system of claim 5 , wherein the handshake involves use of a private cryptographic key to which the system lacks access.

12. The system of claim 5 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors cause the system to:
receive a third message from the other computer system, the third message being part of the handshake; and
provide the third message to the client computer system.

13. The system of claim 5 , wherein:
the system comprises the other computer system; and
the other computer system is inaccessible via any public Internet Protocol address.

14. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a first computer system, cause the first computer system to at least:
determine, by a load balancer, a second computer system from a plurality of computer systems based at least in part on data associated with handshake messages;
proxy, by a load balancer, handshake messages of a protocol for cryptographically protected communications sessions between a client computer system and the second computer system;
obtain, by a server, a set of cryptographic keys for a cryptographically protected communications session from the second computer system; and
use the set of cryptographic keys to communicate with the client computer system over the cryptographically protected communications session; and
as a result of the cryptographically protected communications session having been established, determine whether a message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session; and
if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.

15. The non-transitory computer-readable storage medium of claim 14 , wherein:
the cryptographically protected communications session utilizes encryption.

16. The non-transitory computer-readable storage medium of claim 14 , wherein:
the first computer system is a web server of a web site having a corresponding digital certificate with a corresponding private cryptographic key; and
the first computer system lacks access to the corresponding private cryptographic key.

17. The non-transitory computer-readable storage medium of claim 14 , wherein the cryptographically protected communications session is a transport layer security session.

18. The non-transitory computer-readable storage medium of claim 14 , wherein the executable instructions that cause the first computer system to proxy the message between the client computer system and the second computer system, as a result of being executed by the one or more processors, cause the first computer system to di

Assignees

• Amazon Tech Inc

Inventors

• Maccarthaigh Colm

Classifications

• H04L67/1004

  Server selection for load balancing · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/168

  above the transport layer · CPC title