Certificate echoing for session security
First Claim
1. A computer-implemented method, comprising:
- under the control of one or more computer systems configured with executable instructions,providing a first digital certificate as part of performing, in accordance with a handshake protocol, a handshake process to establish a cryptographically protected communications session of an encrypted communications protocol that includes the handshake protocol and a record protocol;
receiving, over the established cryptographically protected communications session, a set of encrypted records;
decrypting the set of records to obtain information indicating a second digital certificate and a digital signature;
determining, based at least in part on the information indicating the second digital certificate, that the first digital certificate is the same as the second digital certificate;
determining, based at least in part on the information indicating the second digital certificate and a cryptographic key associated with a client computer system, that the digital signature is valid; and
as a result of both the first digital certificate being the same as the second digital certificate and the digital signature being valid, providing data over the cryptographically protected communications session that would have been excluded from transmission over the cryptographically protected communications session as a result of either the first digital certificate being different from the second digital certificate or the digital signature being invalid.
1 Assignment
0 Petitions
Accused Products
Abstract
A client establishes a cryptographically protected communications session with a server. To detect a man-in-the-middle, the client echoes information about a certificate purportedly received from the server. The information echoed by the client is digitally signed so as to be verifiable by the server without any cryptographic key used in the cryptographically protected communications session or its establishment, thereby rendering the echoed information unmodifiable by a man-in-the-middle without invalidating the signature. The server can therefore verify both the echoed information and the digital signature to determine whether it has established a cryptographically protected communications session with the client or with a man-in-the-middle purporting to be the client.
-
Citations
20 Claims
-
1. A computer-implemented method, comprising:
under the control of one or more computer systems configured with executable instructions, providing a first digital certificate as part of performing, in accordance with a handshake protocol, a handshake process to establish a cryptographically protected communications session of an encrypted communications protocol that includes the handshake protocol and a record protocol; receiving, over the established cryptographically protected communications session, a set of encrypted records; decrypting the set of records to obtain information indicating a second digital certificate and a digital signature; determining, based at least in part on the information indicating the second digital certificate, that the first digital certificate is the same as the second digital certificate; determining, based at least in part on the information indicating the second digital certificate and a cryptographic key associated with a client computer system, that the digital signature is valid; and as a result of both the first digital certificate being the same as the second digital certificate and the digital signature being valid, providing data over the cryptographically protected communications session that would have been excluded from transmission over the cryptographically protected communications session as a result of either the first digital certificate being different from the second digital certificate or the digital signature being invalid. - View Dependent Claims (2, 3, 4, 5)
-
6. A system, comprising at least one computing device configured to implement one or more services, the one or more services configured to:
-
receive, outside of a handshake used to establish a cryptographically protected communications session, a digital signature and information indicating the cryptographically protected communications session and information indicating a digital certificate; determine, based at least in part on the information indicating the digital certificate, whether the indicated digital certificate matches a digital certificate provided to establish the cryptographically protected communications session; determine, based at least in part on the information indicating the digital certificate and a cryptographic key associated with a client before the cryptographically protected communications session was established, whether the digital signature is valid; and perform one or more mitigating actions if either the indicated digital signature fails to match the provided digital certificate or the digital signature is invalid. - View Dependent Claims (7, 8, 9, 10, 11, 12)
-
-
13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
-
receive a digital certificate as part of a process for establishing a cryptographically protected communications session; determine information that is specific to the digital certificate; generate a digital signature based at least in part on the determined information specific to the digital certificate and a cryptographic key registered with another computer system outside of establishment of the cryptographically protected communications session; and provide the digital signature and the information that is specific to the digital certificate over the cryptographically protected communications session after the cryptographically protected communication session is established. - View Dependent Claims (14, 15, 16, 17, 18, 19, 20)
-
Specification