US6094485A
Expired / Lapsed
US
⏱️ 0.0 years remaining
SSL step-up
Assignee: Meta Platforms Inc
•
Filing: 1997-09-18
•
Granted: 2000-07-25
•
Expires: 2017-09-18
Abstract
Abstract A process is provided that allows an exportable SSL client to negotiate an encrypted session using strong encryption with a server if the server is allowed to use strong encryption. With this process, the SSL client is normally limited to export strength encryption. But, when it is communicating with an approved server, it is able to expand the available set of encryption algorithms to include stronger algorithms/key lengths. The process involves performing an SSL handshake twice. The process begins when a client, i.e. a user, wants to establish a session with a server. The client first initiates a network connection to the server. The first handshake between an export client and an approved server results in an SSL session that uses export strength encryption. This establishes a connection using an exportable cipher suite. The client examines the server's certificate obtained as part of the first handshake. If the server is not approved, the SSL session transfers application data that are protected by the export cipher. If the server is approved, then the client initiates a second handshake, this time allowing stronger cipher suites. The result of the second handshake is an SSL session that uses strong encryption. The SSL session may then be used to transfer application data that are protected by the strong cipher suite. At this point, the process is complete.
Inventors
- 👤 Jeff Weinstein
- 👤 Tom Weinstein
- 👤 Taher Elgamal
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 05:05
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/10; H04L63/105; H04L63/16; H04L63/166; H04L63/20; H04L63/205
Claims Analysis
Total Claims: 30
Claim 1
Independent Claim
175 words
A process for determining the strongest legally permissible level of cryptographic service in an electronic network, comprising the steps of: performing a first handshake between a client and a server to establish a session that uses export strength encryption, wherein a connection is established using an export cipher suite; examining with said client a server certificate obtained as part of said first handshake; transferring application data that are protected by said export cipher suite if said server is not approved for a stronger level of cryptographic service; initiating a second handshake allowing a stronger cipher suite if said server is approved for a stronger level of cryptographic service; and transferring application data that are protected by said stronger cipher suite; wherein said server certificate is required by said client to determine if said server is approved; wherein said server certificate is not available to said client at the time that it must send said list of cipher suites during said first handshake; and wherein said first handshake must be performed with weaker, export strength cryptography.
Claim 2
Dependent Claim
175 words
A process for determining the strongest legally permissible level of cryptographic service in an electronic network, comprising the steps of: performing a first handshake between a client and a server to establish a session that uses export strength encryption, wherein a connection is established using an export cipher suite; examining with said client a server certificate obtained as part of said first handshake; transferring application data that are protected by said export cipher suite if said server is not approved for a stronger level of cryptographic service; initiating a second handshake allowing a stronger cipher suite if said server is approved for a stronger level of cryptographic service; and transferring application data that are protected by said stronger cipher suite; wherein said server certificate is required by said client to determine if said server is approved; wherein said server certificate is not available to said client at the time that it must send said list of cipher suites during said first handshake; and wherein said first handshake must be performed with weaker, export strength cryptography.
Claim 3
Dependent Claim
15 words
The process of claim 1, wherein said session is a secure socket layer (SSL) session.
Claim 4
Dependent Claim
30 words
The process of claim 1, further comprising the step of: sending with said client sends a list of cipher suites said client allows before said server sends said server certificate.
Claim 5
Dependent Claim
29 words
The process of claim 1, wherein said client has said server certificate and can determine if said server is approved for stronger cryptography after said first handshake is complete.
Claim 6
Dependent Claim
19 words
The process of claim 4, wherein said client performs said second handshake with said expanded list of cipher suites.
Claim 7
Dependent Claim
24 words
The process of claim 1, further comprising the step of: verifying that said server is approved for stronger cryptography based on said server certificate.
Claim 8
Dependent Claim
32 words
The process of claim 6, wherein said server certificate comprises a certificate chain consisting of said server certificate, zero or more intermediate certification authority (CA) certificates, and a trusted root CA certificate.
Claim 9
Dependent Claim
112 words
The process of claim 6, wherein said verification step comprises the steps of: initiating a session; providing with said server a server certificate, wherein said server certificate and any intermediate certification authority (CA) certificates must contain a certificate extension, wherein a trusted root CA certificate must be on a list of CAs that is built into said client and that are known to be approved for issuing special certificates that allow for the use of stronger cryptography, wherein said list is built into said client and is configurable by a user; and approving said certificate for stronger cryptography if said certificate is on said list, wherein session may proceed using strong encryption.
Claim 10
Dependent Claim
51 words
The process of claim 8, said verification step further comprising the steps of: determining if said certificate has an approved extension if said certificate is not on said list; finding an issuer certificate; and comparing said issuer certificate to said list again if said certificate does not have an approved extension.
Claim 11
Dependent Claim
15 words
The process of claim 9, wherein said certificate extension is an extended key usage extension.
Claim 12
Dependent Claim
16 words
The process of claim 1, wherein the order in which said handshakes are performed is reversed.
Claim 13
Dependent Claim
43 words
The process of claim 11, comprising the steps of: negotiating a session using strong cryptography; sending data using strong cryptography if said server certificate is approved; and renegotiating down to a weaker export grade cipher suite if said server certificate is not approved.
Claim 14
Dependent Claim
21 words
The process of claim 1, wherein one handshake is required for approved servers and two handshakes are required for non-approved servers.
Claim 15
Dependent Claim
21 words
The process of claim 1, wherein one handshake is required for non-approved servers and two handshakes a required for approved servers.
Claim 16
Independent Claim
182 words
An apparatus for determining the strongest legally permissible level of cryptographic service in an electronic network, comprising: means for performing a first handshake between a client and a server to establish a session that uses export strength encryption, wherein a connection is established using an export cipher suite; means for examining with said client a server certificate obtained as part of said first handshake; means for transferring application data that are protected by said export cipher suite if said server is not approved for a stronger level of cryptographic service; means for initiating a second handshake allowing a stronger cipher suite if said server is approved for a stronger level of cryptographic service; and means for transferring application data that are protected by said stronger cipher suite; wherein said server certificate is required by said client to determine if said server is approved; wherein said server certificate is not available to said client at the time that it must send said list of cipher suites during said first handshake; and wherein said first handshake must be performed with weaker, export strength cryptography.
Claim 17
Independent Claim
182 words
An apparatus for determining the strongest legally permissible level of cryptographic service in an electronic network, comprising: means for performing a first handshake between a client and a server to establish a session that uses export strength encryption, wherein a connection is established using an export cipher suite; means for examining with said client a server certificate obtained as part of said first handshake; means for transferring application data that are protected by said export cipher suite if said server is not approved for a stronger level of cryptographic service; means for initiating a second handshake allowing a stronger cipher suite if said server is approved for a stronger level of cryptographic service; and means for transferring application data that are protected by said stronger cipher suite; wherein said server certificate is required by said client to determine if said server is approved; wherein said server certificate is not available to said client at the time that it must send said list of cipher suites during said first handshake; and wherein said first handshake must be performed with weaker, export strength cryptography.
Claim 18
Dependent Claim
15 words
The apparatus of claim 15, wherein said session is a secure socket layer (SSL) session.
Claim 19
Dependent Claim
29 words
The apparatus of claim 15, further comprising: means for sending with said client sends a list of cipher suites said client allows before said server sends said server certificate.
Claim 20
Dependent Claim
29 words
The apparatus of claim 17, wherein said client has said server certificate and can determine if said server is approved for stronger cryptography after said first handshake is complete.
Claim 21
Dependent Claim
19 words
The apparatus of claim 18, wherein said client performs said second handshake with said expanded list of cipher suites.
Claim 22
Dependent Claim
23 words
The apparatus of claim 15, further comprising: means for verifying that said server is approved for stronger cryptography based on said server certificate.
Claim 23
Dependent Claim
32 words
The apparatus of claim 20, wherein said server certificate comprises a certificate chain consisting of said server certificate, zero or more intermediate certification authority (CA) certificates, and a trusted root CA certificate.
Claim 24
Dependent Claim
118 words
The apparatus of claim 20, wherein said verification means comprises: means for initiating a session; means for providing with said server a server certificate, wherein said server certificate and any intermediate certification authority (CA) certificates must contain an certificate extension, wherein a trusted root CA certificate must be on a list of CAs that is built into said client and that are known to be approved for issuing special certificates that allow for the use of stronger cryptography, wherein said list is built into said client and is configurable by a user; and means for approving said certificate for stronger cryptography if said certificate is on said list, then the certificate, wherein session may proceed using strong encryption.
Claim 25
Dependent Claim
54 words
The apparatus of claim 22, said verification means further comprising: means for determining if said certificate has an approved extension if said certificate is not on said list; means for finding an issuer certificate; and means for comparing said issuer certificate to said list again if said certificate does not have an approved extension.
Claim 26
Dependent Claim
15 words
The apparatus of claim 23, wherein said certificate extension is an extended key usage extension.
Claim 27
Dependent Claim
16 words
The apparatus of claim 15, wherein the order in which said handshakes are performed is reversed.
Claim 28
Dependent Claim
46 words
The apparatus of claim 25 comprising: means for negotiating a session using strong cryptography; means for sending data using strong cryptography if said server certificate is approved; and means for renegotiating down to a weaker export grade cipher suite if said server certificate is not approved.
Claim 29
Dependent Claim
21 words
The apparatus of claim 15, wherein one handshake is required for approved servers and two handshakes are required for non-approved servers.
Claim 30
Dependent Claim
21 words
The apparatus of claim 15, wherein one handshake is required for non-approved servers and two handshakes a required for approved servers.
References Cited (Backward Citations)
US4868877A
Cited
US5323464A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-07-25 | 2004-01-24 | 2004-07-25 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-07-25 | 2008-01-24 | 2008-07-25 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-07-25 | 2012-01-24 | 2012-07-25 | $7700.00 | Window Closed / Lapsed |