Edge Network Secure Traffic Optimization via TLS Handshake Signaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current infrastructure services face challenges in optimizing the flow of secure traffic due to the opaque nature of encrypted communications, which prevents them from enhancing the traffic's characteristics and paths within their networks.
Innovation Solution
The solution involves a client application signaling to an infrastructure service to apply optimizations to secure traffic by including information in the request header, allowing the edge network to remove this information and apply optimizations to the traffic as it passes through, such as route selection and address manipulation, to improve traffic flow and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the infrastructure service applies optimizations to encrypted secure traffic, then traffic flow efficiency and security are improved, but the opaque nature of encrypted communications prevents the service from enhancing traffic characteristics and paths within their networks
Solution Approach 1:
The patent applies preliminary action by having the client application embed optimization signaling information in the TLS handshake request before the encrypted session begins. This allows the infrastructure service to pre-configure routing and optimization parameters before the encrypted traffic flow starts, enabling subsequent optimization without needing to inspect encrypted content. The signaling is done in advance during the unencrypted handshake phase.
Solution Approach 2:
The patent uses an intermediary approach by introducing a signaling mechanism that acts as a mediator between the client application and the infrastructure service. The optimization signaling information serves as an intermediary carrier that conveys traffic characteristics and optimization requirements without requiring direct inspection of encrypted traffic content. This intermediary signaling enables the infrastructure service to apply appropriate optimizations while maintaining encryption privacy.
2Productivity
If the infrastructure service removes optimization information from the request header and applies optimizations to subsequent traffic, then secure traffic optimization is achieved, but the initial request must be modified which could affect protocol compliance
Solution Approach 1:
The patent applies local quality by making modifications only to specific portions of the TLS handshake protocol rather than the entire protocol. The optimization signaling information is embedded in designated fields within the ClientHello message (such as the SNI extension or custom extensions), allowing the infrastructure service to extract and process optimization parameters without altering the fundamental TLS protocol structure. This localized modification approach maintains protocol compliance while enabling optimization functionality.
Solution Approach 2:
The patent uses parameter changes by modifying specific parameters within the TLS handshake messages to convey optimization information. The client application changes certain protocol parameters (such as adding custom extension fields or modifying existing fields) to include optimization signaling information. These parameter changes are reversible and do not fundamentally alter the protocol, allowing the infrastructure service to interpret and act on the optimization parameters while maintaining protocol compatibility.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A client application establishes a connection between the client application and an origin server over one or more networks. The application generates a request to establish a secure session with the origin server over the connection. The request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network. Subsequent to establishing the secure session, the application encrypts the traffic in accordance with the secure session and sends the traffic to the origin server over the connection, subject to the one or more optimizations. The infrastructure service applies the one or more optimizations to the traffic as it passes through the edge network to the origin server.