Secure session capability using public-key cryptography without access to the private key

• US 8,996,873 B1
• Filed: 04/08/2014
• Issued: 03/31/2015
• Est. Priority Date: 04/08/2014
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Pahl, Sbastien Andreas Henry, Tourne, Matthieu Philippe Franois, Sikora, Piotr, Bejjani, Ray Raymond, Knecht, Dane Orion, Prince, Matthew Browning, Graham-Cumming, John, Holloway, Lee Hahn, Sullivan, Nicholas Thomas, Strasheim, Albertus
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/248,253
• Time in Patent Office: 357 Days
• Field of Search: 713/173
• US Class Current: 713/173
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3013 involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.

Claims

1. A method in a first server for establishing a secure session with a client device, the method comprising:

receiving, from the client device, a Client Hello message that includes a first random value;

in response to the received Client Hello message, transmitting a Server Hello message to the client device that includes a second random value;

transmitting, to the client device, a Server Certificate message that includes one or more digital certificates;

transmitting, to the client device, a Server Hello Done message;

receiving, from the client device, a Client Key Exchange message that includes an encrypted premaster secret, wherein the first server does not have access to a private key that can decrypt the encrypted premaster secret;

transmitting, to a second server that has access to the private key that can decrypt the encrypted premaster secret, the following;

the first random value,

the second random value,

the encrypted premaster secret, and

an indication data that is to be used by the second server to identify the private key,

wherein the first server and the second server are different servers;

receiving, from the second server, a master secret that was generated using a function that takes as input at least in part the decrypted premaster secret, the first random value, and the second random value;

receiving, from the client device, a first Change Cipher Spec message;

receiving, from the client device, a first Finished message;

generating, using the received master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server;

transmitting to the client device, a second Change Cipher Spec message; and

transmitting, to the client device, a second Finished message.

2. The method of claim 1, wherein the first server and the second server are owned or operated by different entities.

3. The method of claim 1, wherein the master secret is received over a secure session between the first server and the second server.

4. The method of claim 3, further comprising:

as part of establishing the secure session between the first server and the second server, transmitting, to the second server, a client Certificate message that includes a digital certificate of the first server.

5. The method of claim 1, further comprising:

after transmitting the second Finished message to the client device, receiving from the client device a request for a resource over the secure session, wherein the request is encrypted;

decrypting, using the set of session keys, the request for the resource;

transmitting the request for the resource to a third server, wherein the first server and the third server are different servers;

receiving the resource from the third server in response to the request;

generating an encrypted response that includes the retrieved resource, wherein the encrypted response is encrypted with the set of session keys; and

transmitting the encrypted response to the client device.

6. The method of claim 5, wherein the second server and the third server are the same server.

7. The method of claim 1, wherein the transmitted indication data to identify the private key is one of:

a hash of a modulus of a public key included in the one or more digital certificates;

a fingerprint over one of the one or more digital certificates; and

an indication of a domain for which the client device is attempting to establish the secure session.

8. A method in a first server for establishing a secure session with a client device, the method comprising:

receiving a message from the client device that initiates a handshake procedure to establish a secure session between the client device and the first server;

negotiating a set of cryptographic parameters between the client device and the first server for the secure session, wherein negotiating the set of cryptographic parameters includes the first server receiving an encrypted premaster secret from the client device, wherein the first server does not have access to a private key to decrypt the encrypted premaster secret;

transmitting an indication data to identify the private key and at least some of the negotiated set of cryptographic parameters to a second server, wherein the transmitted at least some of the negotiated set of cryptographic parameters includes the encrypted premaster secret and a set of random values exchanged between the client device and the first server, and wherein the first server and the second server are different servers;

receiving, from the second server, a master secret that has been generated using at least the set of exchanged random values and a decrypted premaster secret that is decrypted from the encrypted premaster secret using the private key identified by the transmitted indication data;

generating, using at least the master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; and

completing the handshake procedure with the client device such that the set of session keys will be used for during the secure session for encrypting and decrypting communication between the client device and the first server.

9. The method of claim 8, wherein the set of random values includes a first random value selected by the client device and a second random value selected by the first server.

10. The method of claim 8, wherein the first server and the second server are owned or operated by different entities.

11. The method of claim 8, wherein the master secret is received over a secure session between the first server and the second server.

12. The method of claim 11, further comprising:

as part of establishing the secure session between the first server and the second server, transmitting, to the second server, a client Certificate message that includes a digital certificate of the first server.

13. The method of claim 8, further comprising:

after completing the handshake procedure, receiving from the client device over the secure session a request for a resource, wherein the request is encrypted;

decrypting, using the set of session keys, the request for the resource;

transmitting the request for the resource to a third server, wherein the first server and the third server are different servers;

receiving the resource from the third server in response to the request;

generating an encrypted response that includes the retrieved resource, wherein the encrypted response is encrypted with the set of session keys; and

transmitting the encrypted response to the client device.

14. The method of claim 13, wherein the second server and the third server are the same server.

15. The method of claim 8, wherein the transmitted indication data to identify the private key is one of:

a hash of a modulus of a public key corresponding to the private key;

a fingerprint over a digital certificate that includes the public key corresponding to the private key; and

an indication of a domain for which the client device is attempting to establish the secure session.

16. An apparatus comprising:

a first server including a set of one or more processors and a set of one or more non-transitory computer-readable storage mediums, wherein the set of processors is hardware, and wherein the set of non-transitory computer-readable storage mediums stores instructions, that when executed by the set of processors, cause the set of processors to perform the following operations;

receive, from the client device, a Client Hello message that includes a first random value;

in response to the received Client Hello message, transmit a Server Hello message to the client device that includes a second random value;

transmit, to the client device, a Server Certificate message that includes one or more digital certificates;

transmit, to the client device, a Server Hello Done message;

receive, from the client device, a Client Key Exchange message that includes an encrypted premaster secret, wherein the first server does not have access to a private key that can decrypt the encrypted premaster secret;

transmit, to a second server that has access to the private key that can decrypt the encrypted premaster secret, the following;

the first random value,

the second random value,

the encrypted premaster secret, and

an indication data that is to be used by the second server to identify the private key,

wherein the first server and the second server are different servers;

receive, from the second server, a master secret that was generated using a function that takes as input at least in part the decrypted premaster secret, the first random value, and the second random value;

receive, from the client device, a first Change Cipher Spec message;

receive, from the client device, a first Finished message;

generate, using the received master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server;

transmit to the client device, a second Change Cipher Spec message; and

transmit, to the client device, a second Finished message.

17. The apparatus of claim 16, wherein the first server and the second server are owned or operated by different entities.

18. The apparatus of claim 16, wherein the master secret is received over a secure session between the first server and the second server.

19. The apparatus of claim 18, wherein the set of non-transitory computer-readable storage mediums further stores instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:

as part of the establishment of the secure session between the first server and the second server, transmit, to the second server, a client Certificate message that includes a digital certificate of the first server.

20. The apparatus of claim 16, wherein the set of non-transitory computer-readable storage mediums further stores instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:

after transmission of the second Finished message to the client device, receive from the client device a request for a resource over the secure session, wherein the request is encrypted;

decrypt, using the set of session keys, the request for the resource;

transmit the request for the resource to a third server, wherein the first server and the third server are different servers;

receive the resource from the third server in response to the request;

generate an encrypted response that includes the retrieved resource, wherein the encrypted response is encrypted with the set of session keys; and

transmit the encrypted response to the client device.

21. The apparatus of claim 20, wherein the second server and the third server are the same server.

22. The apparatus of claim 16, wherein the indication data to identify the private key is one of:

a hash of a modulus of a public key included in the one or more digital certificates;

a fingerprint over one of the one or more digital certificates; and

an indication of a domain for which the client device is attempting to establish the secure session.

23. An apparatus comprising:

a first server including a set of one or more processors and a set of one or more non-transitory computer-readable storage mediums, wherein the set of processors is hardware, and wherein the set of non-transitory computer-readable storage mediums stores instructions, that when executed by the set of processors, cause the set of processors to perform the following operations;

receive a message from the client device that initiates a handshake procedure to establish a secure session between the client device and the first server;

negotiate a set of cryptographic parameters between the client device and the first server for the secure session, wherein negotiating the set of cryptographic parameters includes the first server receiving an encrypted premaster secret from the client device, wherein the first server does not have access to a private key to decrypt the encrypted premaster secret;

transmit an indication data to identify the private key and at least some of the negotiated set of cryptographic parameters to a second server, wherein the transmitted at least some of the negotiated set of cryptographic parameters includes the encrypted premaster secret and a set of random values exchanged between the client device and the first server, and wherein the first server and the second server are different servers;

receive, from the second server, a master secret that has been generated using at least the set of exchanged random values and a decrypted premaster secret that is decrypted from the encrypted premaster secret using the private key identified by the indication data;

generate, using at least the master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; and

completing the handshake procedure with the client device such that the set of session keys will be used for during the secure session for encrypting and decrypting communication between the client device and the first server.

24. The apparatus of claim 23, wherein the set of random values includes a first random value selected by the client device and a second random value selected by the first server.

25. The apparatus of claim 23, wherein the first server and the second server are owned or operated by different entities.

26. The apparatus of claim 23, wherein the master secret is received over a secure session between the first server and the second server.

27. The apparatus of claim 26, wherein the set of non-transitory computer-readable storage mediums further stores instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:

as part of establishment of the secure session between the first server and the second server, transmit, to the second server, a client Certificate message that includes a digital certificate of the first server.

28. The apparatus of claim 23, wherein the set of non-transitory computer-readable storage mediums further stores instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:

after completion of the handshake procedure, receive from the client device over the secure session a request for a resource, wherein the request is encrypted;

decrypt, using the set of session keys, the request for the resource;

transmit the request for the resource to a third server, wherein the first server and the third server are different servers;

receive the resource from the third server in response to the request;

generate an encrypted response that includes the retrieved resource, wherein the encrypted response is encrypted with the set of session keys; and

transmit the encrypted response to the client device.

29. The apparatus of claim 28, wherein the second server and the third server are the same server.

30. The apparatus of claim 23, wherein the indication data to identify the private key is one of:

a hash of a modulus of a public key corresponding to the private key;

a fingerprint over a digital certificate that includes the public key corresponding to the private key; and

an indication of a domain for which the client device is attempting to establish the secure session.