Handshake offload
Cryptographically protected communications sessions are established using a distributed process. A server proxies handshake messages to another computer system that negotiates a cryptographically protected communications session with the client. When the client and other computer system complete negotiation of the session, the other computer system provides a set of session keys to the server. The server then uses the session keys to communicate with the client over the cryptographically protected communications session.
1. A computer-implemented method, comprising:
establishing, by a load balancer, a network connection with a client computer system;
determining, by the load balancer and based at least in part on data associated with a first set of messages of a handshake protocol of a cryptographically protected communications protocol, a handshake server from a plurality of handshake servers;
proxying, by the load balancer, over a first cryptographically protected communications session with the handshake server that uses a first symmetric cryptographic key, the first set of messages between the client computer system and the handshake server thereby facilitating negotiation of a second symmetric cryptographic key for a second cryptographically protected communications session using an asymmetric key pair comprising a private cryptographic key accessible to the handshake server;
obtaining, by a server computer system, the second symmetric cryptographic key from the handshake server;
for a second set of messages outside of the handshake protocol of the cryptographically protected communications protocol, using at least the second symmetric cryptographic key to cryptographically process the second set of messages; and
as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server computer system includes data not encrypted in accordance with the cryptographically protected communications session; and
as a result of the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.
2. The computer-implemented method of claim 1 , wherein each message of the first set of messages is addressed to the handshake server.
3. The computer-implemented method of claim 1 , wherein the cryptographically protected communications protocol is a Secure Sockets Layer/Transport Layer Security protocol or Internet Protocol Security.
4. The computer-implemented method of claim 1 , wherein the server computer system and the handshake server are implemented on separate physical computing devices.
5. A system, comprising:
one or more processors; and
memory storing instructions that, as a result of being executed by the one or more processors, cause the system to:
receive, by a load balancer, a message from a client computer system;
determine, by a load balancer, whether the message is for a handshake based at least in part on data associated with the message;
if the message is for a handshake, provide the message to another computer system of a plurality of computer systems to perform the handshake and enable the other computer system to negotiate, with the client computer system, a cryptographically protected communications session;
obtain, by a server, a cryptographic key from the other computer system; and
use the cryptographic key to communicate to the client computer system over the cryptographically protected communications session; and
as a result of the cryptographically protected communications session having been established, determine whether a message between the client computer system and the server includes data not encrypted in accordance with the cryptographically protected communications session; and
if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.
6. The system of claim 5 , wherein the cryptographically protected communications session is a Sockets Layer Security or Transport Layer Security session.
7. The system of claim 5 , wherein the instructions further include instructions that, as a result of being executed by the one or more processors, cause the system to:
if the message is not a handshake message, perform a set of tests on the message to determine whether the message comprises potentially malicious data; and
perform a mitigating action if determined that the message comprises potentially malicious data.
8. The system of claim 5 , wherein the instructions that cause the system uses the cryptographic key to communicate to the client computer system, as a result of being executed by the one or more processors, cause the system to encrypt data using the cryptographic key.
9. The system of claim 5 , wherein the system comprises the other computer system.
10. The system of claim 9 , wherein the other computer system is configured to apply a policy to determine whether to perform the handshake.
11. The system of claim 5 , wherein the handshake involves use of a private cryptographic key to which the system lacks access.
12. The system of claim 5 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors cause the system to:
receive a third message from the other computer system, the third message being part of the handshake; and
provide the third message to the client computer system.
13. The system of claim 5 , wherein:
the system comprises the other computer system; and
the other computer system is inaccessible via any public Internet Protocol address.
14. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a first computer system, cause the first computer system to at least:
determine, by a load balancer, a second computer system from a plurality of computer systems based at least in part on data associated with handshake messages;
proxy, by a load balancer, handshake messages of a protocol for cryptographically protected communications sessions between a client computer system and the second computer system;
obtain, by a server, a set of cryptographic keys for a cryptographically protected communications session from the second computer system; and
use the set of cryptographic keys to communicate with the client computer system over the cryptographically protected communications session; and
as a result of the cryptographically protected communications session having been established, determine whether a message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session; and
if determined that the message from the client computer system includes data not encrypted in accordance with the cryptographically protected communications session, take a mitigating action.
15. The non-transitory computer-readable storage medium of claim 14 , wherein:
the cryptographically protected communications session utilizes encryption.
16. The non-transitory computer-readable storage medium of claim 14 , wherein:
the first computer system is a web server of a web site having a corresponding digital certificate with a corresponding private cryptographic key; and
the first computer system lacks access to the corresponding private cryptographic key.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the cryptographically protected communications session is a transport layer security session.
18. The non-transitory computer-readable storage medium of claim 14 , wherein the executable instructions that cause the first computer system to proxy the message between the client computer system and the second computer system, as a result of being executed by the one or more processors, cause the first computer system to digitally sign message to the second computer system to enable the second computer system to authenticate the message.
19. The non-transitory computer-readable storage medium of claim 14 , wherein the set of cryptographic keys comprises an encryption key, a decryption key, and two data integrity keys.
20. The non-transitory computer-readable storage medium of claim 14 , wherein the executable instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the first computer system to:
determine one or more characteristics of the client computer system; and
select, based at least in part on the one or more characteristics of the client computer system, the second computer system from a plurality of computer systems configured to perform handshakes.
21. The non-transitory computer-readable storage medium of claim 14 , wherein:
the executable instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the system to:
determine one or more characteristics of the client computer system; and
apply a policy to the one or more characteristics to determine whether to proxy the handshake messages.
22. The computer-implemented method of claim 1 , wherein data associated with the first set of messages include at least one of: internet protocol (IP) address, time of day, and geolocation of the client computer system.
23. The system of claim 5 , wherein data associated with the message include at least one of: internet protocol (IP) address, time of day, and geolocation of the client computer system.
24. The non-transitory computer-readable storage medium of claim 14 , wherein data associated with the handshake messages include at least one of: internet protocol (IP) address, time of day, and geolocation of the client computer system.