Secure session capability using public-key cryptography without access to the private key
First Claim
1. A non-transitory computer-readable storage medium that stores instructions that, when executed by a hardware processor of a first server, causes the hardware processor to perform operations for establishing a secure session with a client device, the operations comprising:
- receiving, from the client device, a Client Hello message that includes a first random value;
in response to the received Client Hello message, transmitting a Server Hello message to the client device that includes a second random value;
transmitting, to the client device, a Server Certificate message that includes one or more digital certificates;
transmitting, to the client device, a Server Hello Done message;
receiving, from the client device, a Client Key Exchange message that includes an encrypted premaster secret, wherein a private key is not accessible from the first server to decrypt the encrypted premaster secret;
transmitting the encrypted premaster secret, the first random value, and the second random value to a different second server that has access to the private key to decrypt the encrypted premaster secret to generate a decrypted premaster secret;
receiving, from the second server, a master secret that was generated using a function that takes as input at least in part the decrypted premaster secret, the first random value, and the second random value;
receiving, from the client device, a first Change Cipher Spec message;
receiving, from the client device, a first Finished message;
generating, using the received master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server;
transmitting to the client device, a second Change Cipher Spec message; and
transmitting, to the client device, a second Finished message.
0 Assignments
0 Petitions
Accused Products
Abstract
A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.
36 Citations
22 Claims
-
1. A non-transitory computer-readable storage medium that stores instructions that, when executed by a hardware processor of a first server, causes the hardware processor to perform operations for establishing a secure session with a client device, the operations comprising:
-
receiving, from the client device, a Client Hello message that includes a first random value; in response to the received Client Hello message, transmitting a Server Hello message to the client device that includes a second random value; transmitting, to the client device, a Server Certificate message that includes one or more digital certificates; transmitting, to the client device, a Server Hello Done message; receiving, from the client device, a Client Key Exchange message that includes an encrypted premaster secret, wherein a private key is not accessible from the first server to decrypt the encrypted premaster secret; transmitting the encrypted premaster secret, the first random value, and the second random value to a different second server that has access to the private key to decrypt the encrypted premaster secret to generate a decrypted premaster secret; receiving, from the second server, a master secret that was generated using a function that takes as input at least in part the decrypted premaster secret, the first random value, and the second random value; receiving, from the client device, a first Change Cipher Spec message; receiving, from the client device, a first Finished message; generating, using the received master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; transmitting to the client device, a second Change Cipher Spec message; and transmitting, to the client device, a second Finished message. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A non-transitory computer-readable storage medium that stores instructions that, when executed by a hardware processor of a first server, causes the hardware processor to perform operations for establishing a secure session with a client device, the operations comprising:
-
receiving a message from the client device that initiates a handshake procedure to establish a secure session between the client device and the first server; negotiating a set of cryptographic parameters between the client device and the first server for the secure session, wherein negotiating the set of cryptographic parameters includes the first server receiving an encrypted premaster secret from the client device, wherein the first server does not have access to a private key to decrypt the encrypted premaster secret; transmitting at least some of the negotiated set of cryptographic parameters to a second server different from the first server, wherein the transmitted at least some of the negotiated set of cryptographic parameters includes the encrypted premaster secret and a plurality of random values exchanged between the client device and the first server; receiving, from the second server, a master secret that has been generated using at least the plurality of exchanged random values and the encrypted premaster secret; generating, using at least the master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; and completing the handshake procedure with the client device such that the set of session keys will be used during the secure session for encrypting and decrypting communication between the client device and the first server. - View Dependent Claims (9, 10, 11, 12, 13, 14, 15)
-
-
16. An apparatus comprising:
a first server including a set of one or more hardware processors and a set of one or more non-transitory computer-readable storage mediums storing instructions, that when executed by the set of hardware processors, cause the set of hardware processors to perform the following operations; receive, from the client device, a Client Hello message that includes a first random value; in response to the received Client Hello message, transmit a Server Hello message to the client device that includes a second random value; transmit, to the client device, a Server Certificate message that includes one or more digital certificates; transmit, to the client device, a Server Hello Done message; receive, from the client device, a Client Key Exchange message that includes an encrypted premaster secret, a private key is not accessible from the first server to decrypt the encrypted premaster secret; transmit the encrypted premaster secret, the first random value, and the second random value to a different second server that has access to the private key to decrypt the encrypted premaster secret to generate a decrypted premaster secret; receive, from the second server, a master secret that was generated using a function that takes as input at least in part the decrypted premaster secret, the first random value, and the second random value; receive, from the client device, a first Change Cipher Spec message; receive, from the client device, a first Finished message; generate, using the received master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; transmit to the client device, a second Change Cipher Spec message; and transmit, to the client device, a second Finished message. - View Dependent Claims (17, 18, 19, 20, 21, 22)
Specification