US 12,218,923 B1
Security protocol handshake offloading
Neha Shetty, Bothell, WA (US); Steven Collison, Seattle, WA (US); Andrew Hourselt, Seattle, WA (US); James Christopher Sorenson, III, Seattle, WA (US); Douglas Stewart Laurence, Redmond, WA (US); and Colm MacCárthaigh, Seattle, WA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Dec. 10, 2021, as Appl. No. 17/547,909.
Int. Cl. H04L 9/40 (2022.01); G06F 21/60 (2013.01)
CPC H04L 63/0485 (2013.01) [G06F 21/602 (2013.01); H04L 63/123 (2013.01); H04L 63/166 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system, comprising:
a first processor and a first memory storing first program instructions that when executed by the first processor implement a control plane server of a security protocol offloading service;
a second processor and a second memory storing second program instructions that when executed by the second processor implement a data plane server of the security offloading service, wherein the data plane server is configured to implement a handshake processing offloader; and
a third processor and a third memory storing third program instructions that when executed by the third processor implement a front-end request processor of an application;
wherein the control plane server is configured to, in response to one or more programmatic requests, (a) store an indication that the front-end request processor is permitted to communicate with the handshake processing offloader, and (b) cause a first security artifact associated with the application to be stored at a location which is inaccessible from the front-end request processor;
wherein the handshake processing offloader is configured to:
obtain at least a portion of contents of a set of client-initiated handshake messages of a security protocol utilized for client-server interactions of the application; and
generate a second security artifact using (a) the portion of contents of the set of client-initiated handshake messages and (b) the first security artifact, wherein a validity period of the second security artifact is shorter than a validity period of the first security artifact; and
cause the second security artifact to be obtained at the front-end request processor; and
wherein the front-end request processor is configured to utilize the second security artifact to perform, during the validity period of the second security artifact, a cryptographic operation with respect to a client-server interaction of the application.