Interposer with security assistant key escrow

US10178181B2 · kind B2 · utility

Assignee

• Cisco Technology, Inc. · US

Inventors

• Eitan Ben-Nun · Sunnyvale, US
• Michael Zayats · Netanya, IL
• Daniel G. Wing · San Jose, US
• Kirtesh Patil · Milpitas, US
• Jaideep Padhye · San Jose, US
• Manohar B. Hungund · Santa Clara, US
• Saravanan Agasaveeran · Sunnyvale, US

Key dates

• Filing date: Jul 10, 2014
• Grant date: Jan 8, 2019
• Expiry date: Jan 22, 2036

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L67/56
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

An interposer is provided that is configured to interpose into an application security protocol exchange by obtaining application session security state. The interposer does this without holding any private keying material of client or server. An out-of-band Security Assistant Key Escrow service (SAS/SAKE) is also provided. The SAKE resides in the secure physical network perimeter and holds the private keying material required to derive session keys for interposing into application security protocol. During a security protocol handshake, the interposer sends SAKE security protocol handshake messages and in return receives from the SAKE session security state that allows it to participate in application security protocol.