Techniques for secure session reestablishment

Patent metadata

Field	Value
Publication number	US-10785261-B2
Application number	US-201815917471-A
Country	US
Kind code	B2
Filing date	Mar 9, 2018
Priority date	Dec 18, 2014
Publication date	Sep 22, 2020
Grant date	Sep 22, 2020

Abstract

A client establishes a network session with a server. The network session is used to establish an encrypted communications session. The client establishes another network session with another server, such as after terminating the first network session. The client resumes the encrypted communications session over the network session with the other server. The other server is configured to receive encrypted communications from the client and forward them to the appropriate server.

First claim

What is claimed is:

1. A system, comprising a set of computing devices that implement one or more services to:
establish a network connection with a client computer system;
receive, over the network connection, a network packet that includes an encrypted message, the encrypted message being encrypted using a cryptographic key of a communications session established over another network connection between the client computer system and an additional computer system; and
as a result of an attempt to decrypt at least a portion of the network packet being unsuccessful due to lack of access to the cryptographic key, provide the network packet to the additional computer system.

2. The system of claim 1 , wherein the network connection with the client computer system is a transmission control protocol (TCP) connection.

3. The system of claim 1 , wherein the communications session with the client computer system is terminated prior to providing the network packet to the additional computer system.

4. The system of claim 1 , wherein:
the network connection is over a public communications network; and
the network packet is provided over a local area network.

5. A computer-implemented method, comprising:
establishing a network connection with a client computer system;
receiving, over the network connection, a network packet that includes an encrypted message, the encrypted message being encrypted using a cryptographic key of a communications session established over another network connection between the client computer system and an additional computer system; and
as a result of an attempt to decrypt at least a portion of the network packet being unsuccessful due to lack of access to the cryptographic key, providing the network packet to the additional computer system.

6. The computer-implemented method of claim 5 , further comprising:
obtaining, from the additional computer system, a decrypted network packet, the decrypted network packet comprising at least a message encrypted using a second cryptographic key; and
decrypting, through use of the second cryptographic key, the message.

7. The computer-implemented method of claim 5 , wherein the network connection with the client computer system is a TCP connection.

8. The computer-implemented method of claim 5 , wherein the network connection with the client computer system is over a local area network.

9. The computer-implemented method of claim 5 , wherein providing the network packet to the additional computer system includes:
establishing a second network connection with the additional computer system; and
transmitting, over the second network connection, the network packet.

10. The computer-implemented method of claim 5 , wherein the network packet is provided to the additional computer system in accordance with a record protocol of an encrypted communications session established over the network connection.

11. The computer-implemented method of claim 5 , further comprising establishing a transport layer security session with the client computer system through negotiation of a set of session keys.

12. The computer-implemented method of claim 5 , further comprising terminating the network connection with the client computer system in response to receiving the network packet.

13. A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
establish a network connection with a client computer system;
receive, over the network connection, a network packet that includes an encrypted message, the encrypted message being encrypted using a cryptographic key of a communications session established over another network connection between the client computer system and an additional computer system; and
as a result of an attempt to decrypt at least a portion of the network packet being unsuccessful due to lack of access to the cryptographic key, provide the network packet to the additional computer system.

14. The non-transitory computer-readable storage medium of claim 13 , wherein an indication specifies that the additional computer system received the network packet for decryption of the encrypted message from the network packet.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the network connection is over a public communications network.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the encrypted message is further encrypted using a second cryptographic key accessible by the additional computer system.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the network packet is provided to the additional computer system over a local area network.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the communications session with the client computer system is established in accordance with a record protocol of the communications session and is encrypted using the cryptographic key.

19. The non-transitory computer-readable storage medium of claim 13 , wherein the network connection is a first transport layer security connection and the network packet is provided to the additional computer system over a second transport layer security connection.

20. The non-transitory computer-readable storage medium of claim 13 , wherein the executable instructions further cause the computer system to determine, based at least in part on first information in the network connection, to utilize the cryptographic key to generate the encrypted message.

Assignees

• Amazon Tech Inc

Inventors

• Johansson Jesper Mikael
• Canavor Darren Ernest
• Mcclintock Jon Arron
• Roth Gregory Branchek
• Rubin Gregory Alan
• Sharifi Mehr Nima

Classifications

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title