Patent ID: 9026784
Filing Date: 2015-05-05
Classification: G06F,H04L

Abstract:
1. A method, comprising: identifying a transport layer security (TLS) session between a client and a server; parsing a TLS message spread across a plurality of TLS protocol records to identify a session ticket associated with the TLS session; computing a first hash value for a first portion of the session ticket in a first TLS protocol record of the plurality of TLS protocol records, the session ticket including a key name; computing a second hash value for a second portion of the session ticket in a next TLS protocol record of the plurality of TLS protocol records, from the first hash value, to incrementally produce a hash value of the session ticket; assigning the incrementally-produced hash value of the session ticket to a session token; and managing the TLS session using the session token to identify the TLS session and to detect a network attack on the TLS session.