IP Library › Granted Patent US 12,676,880

Granted Patent B1

US 12,676,880 · App. 18/341,709 · Granted Jul 7, 2026

Secure session resumption protocol selection based on network condition analysis

Inventors: Steven Collison (Seattle, WA); Cameron Jared Bytheway (Saratoga Springs, UT)

Assignee: Amazon Technologies, Inc.

H04L63/1441 H04L43/0864

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12,676,880
App. No.: 18/341,709
Granted: Jul 7, 2026
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Embodiments of secure session resumption protocol selection based on cost analysis are disclosed. Session resumption requests are received from clients (e.g., as packets). A cost (e.g., network latency time) associated with a client-round-trip-based resumption process that requires a round trip between the server and the client is determined. Another cost associated with a no-round-trip-to-client-based resumption process is determined (e.g., network latency to access a session state data store and/or session state data store processing time). The costs are analyzed in order to select which session resumption process is used to resume the requested session. The session is resumed using the selected session resumption process. In some embodiments, a particular secure session resumption protocol may be selected based on classification of the client into a category that estimates a roundtrip time between the client and the server.

Claims (76)

1 . A system, comprising:

one or more processors and corresponding memory storing program instructions to implement a frontend to receive requests from clients associated with an application;

a session state data store for storing state information associated with secure sessions between the clients and a plurality of servers executing the application;

one or more processors and corresponding memory storing program instructions to implement the plurality of servers, individual servers of the plurality of servers respectively comprising respective server-side secure session managers configured to:

receive a request from a client to resume a prior secure session between the client and the server using a secure session resumption process of a plurality of secure session resumption processes;

determine a client-round-trip latency or resource impact for resumption of the secure session via a client-round-trip-based resumption process that requires a round trip between the server and the client;

determine a no-round-trip-to-client latency or resource impact for resumption of the secure session via a no-round-trip-to-client-based resumption process, wherein the no-round-trip-to-client-based resumption process comprises accessing the session state data store to access data for preventing replay attacks;

select between the no-round-trip-to-client-based resumption process and the client-round-trip-based resumption process, based on a comparison of the client-round-trip latency or resource impact and the no-round-trip-to-client latency or resource impact; and

use the selected resumption process to resume the requested secure session to the client.

2 . The system of claim 1 , wherein:

the selected resumption process comprises reusing one or more encryption keys from the prior secure session; and

said use the selected resumption process to resume the requested secure session to the client comprises reusing the one or more encryption keys from the prior session to resume the prior secure session.

3 . The system of claim 1 , wherein:

the resumed secure session is between the client and a different server than the server in the prior secure session; and

the server in the prior secure session and the different server host an instance or component of a same application.

4 . The system of claim 1 , wherein:

the session state date store and the application are implemented on or across one or more services of a service provider that provides compute and storage services for clients of the service provider; and

the frontend is configured as one or more load balancers, hosted by the service provider and configured to load balance requests, comprising the request, across instances of the application hosted by resources of the service provider.

5 . The system of claim 4 , wherein:

one or more of the clients are hosted within a service provider network of the service provider, and one or more of the clients are external to the provider network; and

said determine a client-round-trip latency or resource impact for resumption of the secure session comprises determining the client-round-trip latency or resource impact based on whether one or more networks of the corresponding round trip are internal or external to the service provider network.

6 . A method, performed by one or more processors of one or more computing devices, the method comprising:

responsive to a request from a client to resume a prior secure session between the client and a server:

determining a client-round-trip cost for resumption of the secure session via a client-round-trip-based resumption process that requires a round trip between the server and the client;

determining a no-round-trip-to-client-based resumption cost for resumption of the secure session via a no-round-trip-to-client-based resumption process;

selecting between the no-round-trip-to-client-based resumption process and the client-round-trip-based resumption process, based on a comparison of the client-round-trip cost and the no-round-trip-to-client cost; and

using the selected resumption process to resume the secure session to the client.

7 . The method of claim 6 , wherein:

said selecting between the no-round-trip-to-client-based resumption process and the client-round-trip-based resumption process comprises selecting the no-round-trip-to-client-based resumption process; and

performing said using the selected resumption process to resume the secure session to the client comprises checking a session state data store for session state data used to prevent replay attacks.

8 . The method of claim 7 , wherein said determining a no-round-trip-to-client cost for resumption of the secure session is based at least in part on an amount of time to contact and receive a response from the session state data store.

9 . The method of claim 8 , wherein:

the request comprises a packet including encrypted application data encrypted using a key from the prior secure session; and

using the no-round-trip-to-client resumption process to resume the secure session to the client comprises decrypting the encrypted application data with a key from the prior secure session.

10 . The method of claim 6 , wherein:

the request comprises a packet including encrypted application data encrypted using a key from the prior secure session;

the no-round-trip-to-client-based resumption process comprises checking a session state data store for session state data used to prevent replay attacks;

said selecting between the no-round-trip-to-client-based resumption process and the client-round-trip-based resumption process comprises selecting the client-round-trip-based resumption process to resume the secure session to the client; and

said using the client-round-trip-based resumption process to resume the secure session to the client comprises:

performing a secure session handshake with the client; and

resuming the secure session without processing the encrypted application data from the packet; and

the secure session is resumed, via the client-round-trip-based resumption process, without accessing the session state data store.

11 . The method of claim 6 , wherein said selecting between the resumption processes based on a comparison of the costs comprises selecting the no-round-trip-to-client-based resumption process based on the cost of the no-round-trip-to-client-based resumption process being less than the client-round-trip-based resumption process by a threshold amount.

12 . The method of claim 11 ,

wherein the client-round-trip cost is based at least in part on an estimated round-trip network transmission latency between the server and the client; and

wherein the no-round-trip-to-client cost is based at least in part on an estimated round-trip network transmission latency between the server and a session state data store and a data processing time associated with accessing the session state data store.

13 . The method of claim 12 , wherein:

the estimated round-trip network transmission latency between the server and the client is based on:

a non-secure connection handshake preceding the request from the client to resume the prior secure session, or

a network location or geolocation of the client.

14 . One or more non-transitory computer-readable media storing program instructions executable on or across one or more processors to perform:

responsive to a request from a client to resume a prior secure session between the client and a server:

determining a client-round-trip cost for resumption of the secure session via a client-round-trip-based resumption process that requires a round trip between the server and the client;

determining a no-round-trip-to-client-based resumption cost for resumption of the secure session via a no-round-trip-to-client-based resumption process;

using the selected resumption process to resume the secure session to the client.

15 . The one or more non-transitory computer-readable media of claim 14 , wherein:

performing said using the selected resumption process to resume the secure session to the client comprises checking a session state data store for session state data used to prevent replay attacks.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein said determining a no-round-trip-to-client cost for resumption of the secure session is based at least in part on an amount of time to contact and receive a response from the session state data store.

17 . The one or more non-transitory computer-readable media of claim 16 , wherein:

the request comprises a packet including encrypted application data encrypted using a key from the prior secure session; and

using the no-round-trip-to-client resumption process to resume the secure session to the client comprises decrypting the encrypted application data with a key from the prior secure session.

18 . The one or more non-transitory computer-readable media of claim 14 , wherein: