Scalable session management using an encrypted session key
Scalable session management is achieved by generating a cookie that includes an encrypted session key and encrypted cookie data. The cookie data is encrypted using the session key. The session key is then signed and encrypted using one or more public/private key pairs. The encrypted session key can be decrypted and verified using the same private/public key pair(s). Once verified, the decrypted session key can then be used to decrypt and verify the encrypted cookie data. A first server having the private/public key pair(s) may generate the cookie using a randomly generated session key. A second server having the same private/public key pair(s) may decrypt and verify the cookie even if the session key is not initially installed on the second server. A session key cache may be used to provide session key lookup to save public/private key operations on the servers.
1. A method comprising:
identifying cookie data;
encrypting the cookie data using a session key to generate encrypted cookie data;
signing the session key using a first key having a first key identifier to generate a signed session key;
encrypting the signed session key using a second key having a second key identifier to generate an encrypted signed key;
applying a message authentication code to the cookie data and the session key to generate an authentication tag; and
combining the first key identifier, the second key identifier, the encrypted signed key, the encrypted cookie data, and the authentication tag to form a cookie.
2. A method as recited in claim 1 , wherein identifying cookie data comprises generating the cookie data.
3. A method as recited in claim 1 , wherein the session key is associated with an established session between a server and a client.
4. A method as recited in claim 1 , wherein:
signing the session key using a first key to generate a signed session key includes signing the session key using a private key to generate the signed session key; and
encrypting the signed session key using a second key to generate a signed session key includes encrypting the signed session key with a public key to generate the encrypted signed key.
5. A method as recited in claim 4 , wherein:
the private key is associated with a first private/public key pair having the first key identifier; and
the public key is associated with a second private/public key pair having the second key identifier.
6. A method as recited in claim 1 , further comprising maintaining the session key in association with the encrypted signed key.
7. A method comprising:
maintaining a store of private/public key pairs;
signing and encrypting a session key using a private/public key pair to generate an encrypted signed key; and
maintaining, in a session key cache, the session key in association with the encrypted signed key;
receiving a data cookie from a client;
parsing the data cookie to identify a key ID, a received encrypted signed key, and encrypted cookie data;
searching the session key cache for a session key based on the received encrypted signed key;
in an event that the session key based on the received encrypted signed key is found in the session key cache, decrypting the encrypted cookie data using the session key based on the received encrypted signed key, resulting in cookie data; and
in an event that the session key based on the received encrypted signed key is not found in the session key cache:
searching the store of private/public key pairs based on the key ID to identify a private key and a public key;
decrypting the received encrypted signed key using the private key, resulting in a received session key and a received signed session key; and
decrypting the encrypted cookie data using the received session key, resulting in the cookie data.
8. A method as recited in claim 7 , wherein signing and encrypting the session key using a private/public key pair comprises:
signing the session key using a private key to generate a signed session key; and
encrypting the session key and the signed session key with a public key to generate the encrypted signed key.
9. A method as recited in claim 8 , wherein:
the private key is associated with a first private/public key pair; and
the public key is associated with a second private/public key pair.
10. A system comprising:
a memory;
a processor;
a session management module, executed on the processor, to:
identify a session key associated with an established session between the system and a client device;
sign the session key with a private key associated with a first private/public key pair, generating a signed session key;
encrypt the session key and the signed session key with a public key associated with a second private/public key pair, generating an encrypted signed session key;
encrypt cookie data with the session key to generate encrypted cookie data; and
generate an authentication tag by applying a message authentication code to the cookie data and the session key.
11. A system as recited in claim 10 , wherein the first private/public key pair is obtained from a private/public key store.
12. A system as recited in claim 11 , wherein the second private/public key pair is obtained from the private/public key store.
13. A system as recited in claim 10 , wherein the first private/public key pair and the second private/public key pair are the same private/public key pair.
14. A system as recited in claim 10 , further comprising a session key cache to maintain the session key in association with the encrypted signed session key.
15. A system as recited in claim 10 , wherein the session management module is further executed on the processor to:
generate a cookie by combining a first key ID associated with the first private/public key pair, a second key ID associated with the second private/public key pair, the encrypted signed key, the encrypted cookie data, and the authentication tag; and
transmit the cookie from the system to the client device.
16. A system as recited in claim 15 , wherein the message authentication code is based on a hash function.
17. A method as recited in claim 4 , wherein encrypting the signed session key using a second key to generate a signed session key further includes encrypting the session key with the public key.
18. A method as recited in claim 6 , wherein maintaining the session key in association with the encrypted signed key comprises maintaining a session key cache.