Patent ID: 9673984
Date: 2017-06-06
CPC Classifications: G06F,H04L

Claim:
1. A method comprising: signing a session key using a private/public key pair to generate a signed key; maintaining, in a session key cache, the session key in association with the signed key; determining an expiration time for the session key; receiving, at a time after the expiration time for the session key, a cookie generated using the session key, the cookie including at least encrypted cookie data, the signed key, and an encrypted authentication tag, the encrypted authentication tag including a message authentication code associated with the cookie data and the session key, and the encrypted authentication tag encrypted using the session key; determining, based at least in part on the receiving the cookie generated using the session key, that the session key associated with the cookie has expired based at least in part the expiration time for the session key; removing the session key from the session key cache in response to determining that the session key associated with the cookie has expired; determining that the cookie is invalid based at least in part on the determining that the session key associated with the cookie has expired; and establishing a new client session that is not based on a previous client session associated with the cookie in response to determining that the session key associated with the cookie has expired.