Granted Patent B2

US 9,026,784 · App. 13/358,836 · Granted May 5, 2015

Abstract

Claims (42)

1. A method, comprising:

identifying a transport layer security (TLS) session between a client and a server;

parsing a TLS message spread across a plurality of TLS protocol records to identify a session ticket associated with the TLS session;

computing a first hash value for a first portion of the session ticket in a first TLS protocol record of the plurality of TLS protocol records, the session ticket including a key name;

computing a second hash value for a second portion of the session ticket in a next TLS protocol record of the plurality of TLS protocol records, from the first hash value, to incrementally produce a hash value of the session ticket;

assigning the incrementally-produced hash value of the session ticket to a session token; and

managing the TLS session using the session token to identify the TLS session and to detect a network attack on the TLS session.

2. The method of claim 1 , wherein a size of the session ticket is between 32 bytes and 64 Kbytes.

3. The method of claim 1 , wherein a hashing algorithm used in the computing the first hash value and the computing the second hash value is chosen from a group consisting of: GOST, MD5, SHA-1, SHA-256, RIPEMD-160, and WHIRLPOOL.

4. The method of claim 1 , wherein the managing comprises mapping the TLS session to previous sessions using the session token.

5. The method of claim 1 , further comprising:

incrementally computing hash values for portions of the session ticket in subsequent TLS protocol records of the plurality of TLS protocol records, until all portions of the session ticket have been processed.

6. The method of claim 1 , wherein the session ticket includes at least one of a group consisting of: a protocol version, a cipher suite, a compression method, a master secret, and a client identity.

7. The method of claim 1 , wherein the session ticket includes an initialization vector and a message authentication code based on the initialization vector.

8. An apparatus, comprising:

a memory element configured to store instructions; and

at least one processor operable to execute the instructions and configured to

identify a transport layer security (TLS) session between a client and a server;

parse a TLS message spread across a plurality of TLS protocol records to identify a session ticket associated with the TLS session;

compute a first hash value for a first portion of the session ticket in a first TLS protocol record of the plurality of TLS protocol records, the session ticket including a key name;

compute a second hash value for a second portion of the session ticket in a next TLS protocol record of the plurality of TLS protocol records, from the first hash value, to incrementally produce a hash value of the session ticket;

assign the incrementally-produced hash value of the session ticket to a session token; and

manage the TLS session using the session token to identify the TLS session and to detect a network attack on the TLS session.

9. The apparatus of claim 8 , wherein a size of the session ticket is between 32 bytes and 64 Kbytes.

10. The apparatus of claim 8 , wherein a hashing algorithm used in computing the first hash value and the second hash value is chosen from a group consisting of: GOST, MD5, SHA-1, SHA-256, RIPEMD-160, and WHIRLPOOL.

11. The apparatus of claim 8 , wherein the at least one processor is configured to use the session token to map the TLS session to previous sessions using the session token.

12. The apparatus of claim 8 , wherein the session ticket includes at least one of a group consisting of: a protocol version, a cipher suite, a compression method, a master secret, and a client identity.

13. The apparatus of claim 8 , wherein the session ticket includes an initialization vector and a message authentication code based on the initialization vector.

14. Logic, encoded in non-transitory media, that includes code for execution and, when executed by a processor, is operable to perform operations comprising:

identifying a transport layer security (TLS) session between a client and a server;

parsing a TLS message spread across a plurality of TLS protocol records to identify a session ticket associated with the TLS session;

computing a first hash value for a first portion of the session ticket in a first TLS protocol record of the plurality of TLS protocol records, the session ticket including a key name;

computing a second hash value for a second portion of the session ticket in a next TLS protocol record of the plurality of TLS protocol records, from the first hash value, to incrementally produce a hash value of the session ticket;

assigning the incrementally-produced hash value of the session ticket to a session token; and

managing the TLS session using the session token to identify the TLS session and to detect a network attack on the TLS session.

15. The logic of claim 14 , wherein a size of the session ticket is between 32 bytes and 64 Kbytes.

16. The logic of claim 14 , wherein a hashing algorithm used in the computing the first hash value and the computing the second hash value is chosen from a group consisting of: GOST, MD5, SHA-1, SHA-256, RIPEMD-160, and WHIRLPOOL.

17. The logic of claim 14 , wherein the managing comprises mapping the TLS session to previous TLS sessions using the session token.

18. The logic of claim 14 , the operations further comprising:

incrementally computing hash values for portions of the session ticket in subsequent TLS protocol records of the plurality of TLS protocol records, until all portions of the session ticket have been processed.

19. The logic of claim 14 , wherein the session ticket includes at least one of a group consisting of: a protocol version, a cipher suite, a compression method, a master secret, and a client identity.

20. The logic of claim 14 , wherein the session ticket includes an initialization vector and a message authentication code based on the initialization vector.

Assignments (10)