Concurrent TLS Streams via Single Handshake
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The TLS protocol faces performance issues due to CPU and latency costs associated with initiating multiple handshakes for concurrent data streams, which adversely impact performance when establishing multiple data streams in parallel.
Innovation Solution
A method where a single TLS handshake is performed for a parent connection, and subsequent child connections are established without additional handshakes, using Key-Derivation Functions (KDF) to generate session/connection keys for concurrent peer connections, allowing for concurrent data streaming.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple TLS handshakes are performed for concurrent data streams, then security and authentication are ensured for each connection, but CPU cost and latency increase adversely impacting performance
Solution Approach 1:
The patent performs a single TLS handshake in advance to establish parent connection secrets, then reuses these secrets to derive child connection secrets for multiple concurrent data streams. This preliminary action eliminates the need for repeated handshakes, reducing CPU cost and latency while maintaining security through cryptographic derivation.
Solution Approach 2:
The patent merges multiple TLS handshakes into a single handshake by establishing parent connection secrets that can serve multiple child connections. Instead of performing separate handshakes for each data stream, the system combines the authentication and key establishment into one initial handshake, then derives individual secrets for each stream.
2Reliability
If multiple TLS handshakes are performed for concurrent data streams, then each connection is independently authenticated, but latency increases due to multiple handshake sequences
Solution Approach 1:
The patent performs the authentication handshake in advance once, establishing parent connection secrets that are then reused for multiple child connections. This preliminary authentication action eliminates repeated latency from multiple handshake sequences while maintaining independent authentication for each stream through secret derivation.
Solution Approach 2:
The patent segments the authentication process into two parts: a single parent handshake that establishes shared secrets, and multiple child connections that derive individual secrets from the parent. This segmentation allows one-time authentication overhead to serve multiple streams, reducing per-stream latency.
3Reliability
If separate handshakes are performed for each connection, then connection-specific security keys are established, but computational cost increases
Solution Approach 1:
The patent merges multiple key establishment operations into a single handshake by deriving child connection secrets from parent connection secrets using cryptographic key derivation functions. This combining approach maintains connection-specific security keys while eliminating the computational overhead of repeated handshakes.
Solution Approach 2:
The patent performs the computationally expensive key establishment in advance during a single parent handshake, then uses efficient cryptographic derivation to generate child connection secrets. This preliminary key establishment action reduces per-connection computational cost while maintaining security.
Data Source
AI summary
In an approach to efficient concurrent TLS data streams, a parent connection is established by performing a normal TLS handshake. A concurrent mode of operation is negotiated, where one or more child connections are established without using the TLS handshake. The one or more child connections are associated to the parent connection. Child application traffic secrets are derived for each child connection of the one or more child connections from application traffic secrets of the parent.