Secure transport channel using multiple cipher suites

Patent metadata

Field	Value
Publication number	US-10523707-B2
Application number	US-201815925470-A
Country	US
Kind code	B2
Filing date	Mar 19, 2018
Priority date	Sep 10, 2014
Publication date	Dec 31, 2019
Grant date	Dec 31, 2019

Abstract

A plurality of cipher suites is negotiated as part of a handshake process to establish a cryptographically protected communications session. The handshake process is completed to establish the cryptographically protected communications session. A message is communicated over the established cryptographically protected communications session using at least two cipher suites of the plurality of cipher suites.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
negotiating, during a handshake process of a protocol for establishing cryptographically protected communications sessions, a plurality of cipher suites supported by a remote computer system;
establishing the cryptographically protected communications session with the remote computer system;
receiving a request for data from the remote computer system over the cryptographically protected communications session, a first part of the request indicating a first type of security for a first set of the data and a second part of the request indicating a second type of security for a second set of the data; and
communicating a message over the protected communications session with the remote computer system, the message including:
the first set of data that is cryptographically protected, in response to the first part of the request, to fulfill the first part of the request according to a first cipher suite of the plurality of cipher suites; and
the second set of data that is cryptographically protected, in response to the second part of the request, to fulfill the second part of the request according to a second cipher suite of the plurality of cipher suites.

2. The computer-implemented method of claim 1 , wherein the message further includes a third set of data communicated that is cryptographically protected according to a third cipher suite of the plurality of cipher suites.

3. The computer-implemented method of claim 1 , wherein:
the first cipher suite is designated for use with non-sensitive information; and
the second cipher suite is designated for use with sensitive information.

4. The computer-implemented method of claim 1 , wherein the plurality of cipher suites is negotiated based at least in part on metadata of a connection with the remote computer system.

5. A system, comprising:
one or more processors; and
memory including executable instructions that, as result of being executed by the one or more processors, cause the system to at least:
negotiate, during a handshake process of a protocol for establishing a cryptographically protected communications session, a plurality of cipher suites supported by a remote computer system;
establish the cryptographically protected communications session with the remote computer system;
receive a request for data over the cryptographically protected communication session, a first part of the request indicating a first type of cryptographic protection for a first set of data, and a second part of the request indicating a second type of cryptographic protection for a second set of data; and
communicate a message over the cryptographically protected communications session with the remote computer system, the message including:
the first set of data that is cryptographically protected according to a first cipher suite of the plurality of cipher suites, wherein the first cipher suite is suitable for use in fulfilling the first part of the request; and
the second set of data that is cryptographically protected according to a second cipher suite of the plurality of cipher suites, wherein the second cipher suite is suitable for use in fulfilling the second part of the request.

6. The system of claim 5 , wherein the executable instructions that cause the system to communicate the message further communicate the message in response to a request received from the remote computer system.

7. The system of claim 5 , wherein the memory further includes executable instructions that, as result of being executed by the one or more processors, cause the system to:
receive, from the remote computer system, a request comprising a first part and a second part;
select the first cipher suite based at least in part on a first security level associated with the first part; and
select the second cipher suite based at least in part on a second security level, different from the first security level, associated with the second part.

8. The system of claim 5 , wherein the executable instructions that cause the system to communicate the message further cause the system to communicate the message according to a third cipher suite of the plurality of cipher suites.

9. The system of claim 5 , wherein the executable instructions further cause the system to select the first cipher suite and the second cipher suite from the plurality of cipher suites based at least in part on at least one of an Internet connection type or a hardware type of the remote computer system.

10. The system of claim 5 , wherein:
the first cipher suite is for use in a first use context; and
the second cipher suite is for use in a second use context different from the first use context.

11. The system of claim 10 , wherein the first use context is associated with a first data security level and the second use context is associated with a second data security level.

12. The system of claim 10 , wherein the memory further includes executable instructions that, as result of being executed by the one or more processors, cause the system to:
obtain, in response to receipt of a request for a set of data, the set of data;
parse the set of data to determine that:
a first subset of the set of data is associated with the first use context; and
a second subset of the set of data is associated with the second use context;

cryptographically protect the first subset according to the first cipher suite to produce the first set of data; and
cryptographically protect the second subset according to the second cipher suite to produce the second set of data.

13. A non-transitory computer-readable storage medium comprising stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
negotiate, as part of a handshake process to establish a cryptographically protected communications session, a plurality of cipher suites;
complete the handshake process to establish the cryptographically protected communications session;
receive a request for a set of data from a remote computer system over the cryptographically protected communications session, a first part of the request indicating a first type of security for a first subset of the set of data and a second part of the request indicating a second type of security for a second subset of the set of data; and
communicate a message over the cryptographically protected communications session using at least two cipher suites of the plurality of cipher suites to fulfill the request for the set of data.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the executable instructions that cause the computer system to negotiate the plurality of cipher suites further cause the computer system to negotiate the plurality of cipher suites based at least in part on at least one of:
geolocation data of another computer system associated with the handshake process,
a connection latency value associated with the other computer system, or
a connection bandwidth associated with the other computer system.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the executable instructions further cause the computer system to at least:
evaluate the set of data to determine that:
the first subset of the set of data is associated with a first use context that corresponds to a first cipher suite of the at least two cipher suites; and
the second subset of the set of data is associated with a second use context that corresponds on a second cipher suite of the at least two ciphe

Assignees

• Amazon Tech Inc

Inventors

• Sharifi Mehr Nima
• Canavor Darren Ernest
• Johansson Jesper Mikael
• Mcclintock Jon Arron
• Roth Gregory Branchek

Classifications

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title