Cacheless TLS Session Ticket Resumption via Composited Tickets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing TLS inspection mechanisms face challenges with scalability and performance due to the need for session cache maintenance, which leads to inefficiencies and vulnerabilities, especially when handling SSL/TLS communications with Session Ticket support.
Innovation Solution
A network-based appliance configures the TLS client to maintain the session context by generating a composited ticket that includes the original ticket and session context information, eliminating the need for a local session cache in the inspector, allowing the inspector to decrypt and resume TLS sessions without cache lookup.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session cache is maintained in the TLS inspector to support Session Ticket resumption, then TLS session resumption is enabled, but scalability is poor and the system becomes vulnerable to denial-of-service attacks
Solution Approach 1:
The patent extracts the session context storage function from the TLS inspector and relocates it to the TLS client. The inspector no longer maintains session cache locally, but instead retrieves session context from tickets provided by the client, thereby eliminating the scalability bottleneck while preserving session resumption capability.
Solution Approach 2:
The session ticket acts as an intermediary data structure that carries session context information between the server and client. The inspector uses this ticket as a mediator to obtain necessary session context without maintaining its own cache, thus resolving the contradiction between supporting resumption and maintaining scalability.
2Reliability
If session cache is maintained in the TLS inspector, then session ticket resumption can be supported, but processing inefficiencies and memory constraints occur
Solution Approach 1:
The patent removes the session cache maintenance burden from the inspector, extracting this function to the client side. The inspector only performs lightweight verification of tickets provided by clients, significantly improving processing efficiency while eliminating memory constraints associated with maintaining large session caches.
3Ease of operation
If session cache is maintained in the TLS inspector, then TLS inspection can function, but the system is vulnerable to denial-of-service attacks through cache flushing
Solution Approach 1:
The patent implements preliminary anti-action by having the client sign the session ticket with its private key before sending it to the inspector. This pre-authentication mechanism prevents malicious clients from injecting or flushing cache entries, as the inspector can verify the ticket's authenticity through cryptographic signature validation, thereby neutralizing DoS vulnerabilities before they can exploit the system.
Data Source
AI summary
A network-based appliance includes a mechanism to provide TLS inspection with session resumption, but without requiring that a session cache be maintained. To this end, the inspector is configured to cause the TLS client to participate in maintaining the session context, in effect on behalf of the TLS inspector. In operation, when the inspector first receives the session ticket from the TLS server, and in lieu of caching it, the inspector generates and issues to the client a composited ticket that includes the original ticket and session context information that contains the session key. The composited ticket is encrypted by the inspector to secure the session information. When the TLS client presents the composited session ticket to resume the TLS connection, the inspector decrypts the ticket and retrieves the session context from it directly. The inspector then uses the original session ticket to resume the TLS session.