Dynamically managing, from a centralized service, valid cipher suites allowed for secured sessions

Patent metadata

Field	Value
Publication number	US-10659441-B2
Application number	US-201816215619-A
Country	US
Kind code	B2
Filing date	Dec 10, 2018
Priority date	Oct 24, 2016
Publication date	May 19, 2020
Grant date	May 19, 2020

Abstract

A service interface of an SSL application hosted on at least one computer system in a hosted network selecting at least one authorized cipher suite. An SSL socket of the SSL application negotiating with another SSL socket of another SSL application in the hosted network for a mutual cipher from among the at least one authorized cipher suite and a shared key to encrypt information exchanged during a secure session. Responsive to establishing a security connection between the SSL socket and the another SSL socket using the selected mutual cipher, the service interface sends to a centralized service an identifier of the selected mutual cipher. Responsive to the service interface receiving a revoked cipher alert from the centralized service, the service interface revokes one or more sessions of the SSL application using a revoked cipher in the revoked cipher alert matching the selected mutual cipher.

First claim

What is claimed is:

1. A method, comprising:
selecting, by a service interface of a secure socket layer (SSL) application hosted on at least one computer system in a hosted network, at least one authorized cipher suite;
negotiating, by an SSL socket of the SSL application with another SSL socket of another SSL application in the hosted network for a mutual cipher from among the at least one authorized cipher suite and a shared key to encrypt information exchanged during a secure session;
responsive to establishing a security connection between the SSL socket and the another SSL socket using the selected mutual cipher, sending, by the service interface to a centralized service an identifier of the selected mutual cipher; and
responsive to receiving, by the service interface, a revoked cipher alert from the centralized service, revoking one or more sessions of the SSL application using a revoked cipher in the revoked cipher alert matching the selected mutual cipher.

2. The method according to claim 1 , wherein selecting, by a service interface of an SSL application hosted on at least one computer system in a hosted network, at least one authorized cipher suite further comprises:
responsive to a secure session phase triggered, sending, by the service interface, a request to the centralized service available in the hosted network for a permission list of at least one cipher suite valid for security connections; and
responsive to receiving the permission list of the at least one cipher suite from the centralized service, filtering, by the service interface, the permission list according to one or more rules specified for ciphers for the SSL application to select the at least one authorized cipher suite.

3. The method according to claim 2 , further comprising:
storing the permission list with a timestamp for use with new sockets by the SSL application for at least one of a period of time and until an update is received from the centralized service.

4. The method according to claim 1 , wherein negotiating, by an SSL socket of the SSL application with another SSL socket of another SSL application in the hosted network for a mutual cipher from among the at least one authorized cipher suite and a shared key to encrypt information exchanged during a secure session further comprises:
negotiating, by the SSL socket of the SSL application with the another SSL socket of the another SSL application in the hosted network, wherein the SSL socket and the another SSL socket are endpoints in communication flow between the SSL application and the another SSL application.

5. The method according to claim 1 , further comprising:
responsive to establishing a security connection between the SSL socket and the another SSL socket using the selected mutual cipher, storing, by the SSL socket, attributes for controlling the SSL socket by the selected mutual cipher and the session data in an SSL configuration of the SSL application.

6. The method according to claim 1 , further comprising:
responsive to receiving, by the service interface, a revoked cipher alert from the centralized service, updating a stored list of current permissible ciphers stored by the SSL client application to remove the revoked cipher.

7. The method according to claim 1 , wherein responsive to establishing a security connection between the SSL socket and the another SSL socket using an identifier of the selected mutual cipher, sending, by the service interface to a centralized service the selected mutual cipher further comprises:
sending, by the service interface to the centralized service a session identifier identifying the selected mutual cipher and the SSL socket, wherein the centralized service adds the session identifier to a current session log, wherein responsive to identifying a particular cipher suite is vulnerable, the centralized service searches the current session log to determine if the particular cipher suite matches one or more previously stored mutual cipher suites, wherein responsive to the particular cipher suite matching one or more previously stored mutual cipher suites, the centralized service generates the revoked cipher alert to send to each socket specified in each entry of the current session log for the matching one or more previously stored cipher suites.

8. The method according to claim 1 , wherein selecting, by a service interface of an SSL application hosted on at least one computer system in a hosted network, at least one authorized cipher suite further comprises:
selecting, by the service interface of the SSL application, the at least one authorized cipher suite, wherein the service interface is specified in a secure socket layer configuration for specifying the SSL socket.

9. The method according to claim 1 , wherein responsive to establishing a security connection between the SSL socket and the another SSL socket using the selected mutual cipher, sending, by the service interface to a centralized service an identifier of the selected mutual cipher further comprises:
sending, by the service interface, the identifier of the selected mutual cipher to the centralized service via an ad hoc network connection between the service interface and the centralized service.

10. A computer system comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:
program instructions to select, by a service interface of a secure socket layer (SSL) application hosted on at least one computer system in a hosted network, at least one authorized cipher suite;
program instructions to negotiate, by an SSL socket of the SSL application with another SSL socket of another SSL application in the hosted network for a mutual cipher from among the at least one authorized cipher suite and a shared key to encrypt information exchanged during a secure session;
program instructions to, responsive to establishing a security connection between the SSL socket and the another SSL socket using the selected mutual cipher, send, by the service interface to a centralized service an identifier of the selected mutual cipher; and
program instructions to, responsive to receiving, by the service interface, a revoked cipher alert from the centralized service, to revoke one or more sessions of the SSL application using a revoked cipher in the revoked cipher alert matching the selected mutual cipher.

11. The computer system according to claim 10 , wherein the program instructions to select, by a service interface of an SSL application hosted on at least one computer system in a hosted network, at least one authorized cipher suite further comprise:
program instructions to, responsive to a secure session phase triggered, send, by the service interface, a request to the centralized service available in the hosted network for a permission list of at least one cipher suite valid for security connections; and
program instructions to, responsive to receiving the permission list of the at least one cipher suite from the centralized service, filter, by the service interface, the permission list according to one or more rules specified for ciphers for the SSL application to select the at least one authorized cipher suite.

12. The computer system according to claim 11 , the stored program instructions further comprising:
program instructions to store the permission list with a timestamp for use with new sockets by the SSL application for at least one of

Assignees

• IBM

Inventors

• Bansal Rinkesh I
• Jha Shiv S
• Panchal Sanjay B
• Paradkar Mahesh S
• Thaker Chintan

Classifications

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/16

  the keys or algorithms being changed during operation · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title