Granted Patent B2

US 8,843,738 · App. 13/471,390 · Granted Sep 23, 2014

Abstract

Claims (50)

1. A method of authentication between a client and a server, the method comprising:

negotiating a secure network connection between the client and the server using Transport Layer Security (TLS) protocol;

providing a unique Abbreviated Session Identifier (ASI) by the server along with a TLS protocol session identifier;

associating the unique ASI with the TLS protocol session identifier; and

transmitting the unique ASI along with the TLS protocol session identifier to the client,

wherein subsequent data packets transferred between the client and the server include the unique ASI,

wherein the subsequent data packets comprise packets other than TLS handshake packets,

wherein the subsequent data packets correspond to application data packets comprising application-level data for exchange between the client and the server, and

wherein including the unique ASI in the subsequent data packets comprises causing a pre-existing field of each of the subsequent data packets to hold a data value, the data value being at least a portion of the unique ASI, the data value, as conveyed via the pre-existing field of each of the subsequent data packets, also used for another purpose during processing of each of the subsequent data packets.

2. The method of claim 1 , further comprising re-establishing the secure network connection following disconnection, wherein re-establishing the secure network connection comprises:

transmitting the unique ASI in at least one of said subsequent data packets, and using the unique ASI to re-establish the secure network connection.

3. The method of claim 1 , wherein the subsequent data packets are encapsulated with a TLS ASI header indicative of the unique ASI.

4. The method of claim 3 , wherein the TLS ASI Header adds an overhead of 0 bytes, 1 byte, 2 bytes or 4 bytes to each of the subsequent data packets.

5. The method of claim 1 , wherein the subsequent data packets comprise client-originating application data packets, and wherein the pre-existing field of the client-originating application data packets comprises a destination IP address field, a destination port number field, or both, the method further comprising:

adjusting operation of the server to use a destination IP address indicated in the destination IP address field and a destination port number indicated in the destination port number field for communication with the client, in accordance with an established TCP/IP protocol,

wherein the destination IP address, the destination port number, or both, are selected from respective pluralities of values which are usable by the server in operation thereof.

6. The method of claim 1 , wherein the unique ASI is a random arbitrarily chosen or generated value, a port number, or an Internet Protocol (IP) address.

7. The method of claim 6 , wherein the IP address belongs to IPv4 or IPv6.

8. The method of claim 1 , wherein one or both of a destination port number and a destination IP address of each of the subsequent data packets is concurrently used as the ASI, wherein the destination IP address, the destination port number, or both, are selected from respective pluralities of values which are usable by the server in operation thereof.

9. The method according to claim 1 , wherein the unique ASI is shorter in length than the TLS protocol session identifier.

10. A system for authenticating connection between a client and a server, the system comprising:

a client configured to send and/or receive data;

a server configured to send and/or receive data;

the system configured to negotiate a secure network connection between the client and the server using Transport Layer Security (TLS) protocol;

the server configured to provide a unique Abbreviated Session Identifier (ASI) along with a TLS protocol session identifier;

the server configured to associate the unique ASI with the TLS protocol session identifier; and

the server configured to transmit the unique ASI with the TLS protocol session identifier;

wherein at least some subsequent data packets transferred between the client and the server include the unique ASI,

wherein the subsequent data packets comprise packets other than TLS handshake packets,

wherein the subsequent data packets correspond to application data packets comprising application-level data for exchange between the client and the server, and

wherein including the unique ASI in the subsequent data packets comprises causing a pre-existing field of each of the subsequent data packets to hold a data value, the data value being at least a portion of the unique ASI, the data value, as conveyed via the pre-existing field of each of the subsequent data packets, also used for another purpose during processing of each of the subsequent data packets.

11. The system of claim 10 , wherein the subsequent data packets comprise application data packets.

12. The system of claim 10 , further configured to re-establish the secure network connection following disconnection, wherein re-establishing the secure network connection comprises:

transmitting a data packet including the unique ASI, and using the unique ASI received in the data packet to re-establish the secure network connection.

13. The system of claim 10 , wherein the data packets are encapsulated with a TLS ASI header indicative of the unique ASI.

14. The system of claim 13 , wherein the TLS ASI Header adds an overhead of 0 bytes, 1 byte, 2 bytes or 4 bytes to each of the subsequent data packets.

15. The system of claim 10 , wherein the subsequent data packets comprise client-originating application data packets, and wherein the pre-existing field of the client-originating application data packets comprises a destination IP address field, a destination port number field, or both, the server further configured to:

adjust operation to use a destination IP address indicated in the destination IP address field and a destination port number indicated in the destination port number field for communication with the client, in accordance with an established TCP/IP protocol,

wherein the destination IP address, the destination port number, or both, are selected from respective pluralities of values which are usable by the server in operation thereof.

16. The system of claim 10 , wherein the unique ASI is a random arbitrarily chosen/generated value, a port number, or an Internet Protocol (IP) address.

17. The system of claim 16 , wherein the IP address belongs to IPv4 or IPv6.

18. A computer program product comprising a non-transitory computer readable memory storing computer executable instructions thereon that when executed by a computer perform the following steps of authentication between a client and a server:

negotiate a secure network connection between the client and the server using Transport Layer Security (TLS) protocol;

provide a unique Abbreviated Session Identifier (ASI) by the server along with a TLS protocol session identifier;

associate the unique ASI with the TLS protocol session identifier;

transmit the unique ASI along with the TLS protocol session identifier to the client; and

wherein at least some subsequent data packets transferred between the client and the server include the unique ASI,

wherein the subsequent data packets comprise packets other than TLS handshake packets, and

wherein the subsequent data packets corresponding to application data packets comprising application-level data for exchange between the client and the server,

wherein including the unique ASI in the subsequent data packets comprises causing a pre-existing field of each of the subsequent data packets to hold a data value, the data value being at least a portion of the unique ASI, the data value, as conveyed via the pre-existing field of each of the subsequent data packets, also used for another purpose during processing of each of the subsequent data packets.

Assignments (8)