Patent ID: 9692736
Date: 2017-06-27
CPC Classifications: H04L,H05K

Claim:
1. A computer program product in a non-transitory computer readable medium for use in a data processing system comprising a hardware processor, and a memory, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to: during a cryptographic Transport Layer Security (TLS) or Secure Sockets Layer (SSL) handshake request received from a client, apply a cryptographic hash function to an ephemeral value to generate a server random value, and to return to the client the server random value and a public certificate for a domain, the public certificate having a public key of an asymmetric key pair, wherein a private key corresponding to the public key is held at a remote machine distinct from the data processing system; receive from the client a pre-master secret value encrypted with the public key of the public certificate, together with a client random value; transmit to the remote machine the encrypted pre-master secret, together with the ephemeral value and the client random value; purge the ephemeral value from the memory; receive from the remote machine a master secret, the master secret having been generated at the remote machine by (i) applying the cryptographic hash function to the ephemeral value to re-compute the server random value, (ii) decrypting the encrypted premaster secret using the private key to recover the pre-master secret, and then (iii) applying a function to the client random value, the server random value, and the pre-master secret to generate the master secret; and complete the TLS/SSL handshake between the data processing system and the client using the master secret received from the remote machine.