Encrypted Session Resumption Ticket Across Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In configurations with multiple servers, using a single encryption key for all domains poses a security risk, and generating a unique key for each session can prevent secure session resumption across servers.
Innovation Solution
Implementing a system where multiple servers store common keys that are periodically rotated, allowing one server to generate a session key using a common key and domain secret key, which is then used to encrypt and decrypt session resumption tickets for secure session establishment and resumption across servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single encryption key is used for all domains on multiple servers, then session resumption is simplified, but security is compromised
Solution Approach 1:
The patent segments the encryption key into two parts: a server-specific common key and a domain-specific secret key. The common key is stored on each server and used for session resumption, while the domain secret key is stored only on the server handling that domain. This segmentation allows session resumption to work across servers while maintaining security through domain-specific key isolation.
Solution Approach 2:
The common key acts as an intermediary that enables session resumption across multiple servers without compromising domain-specific security. It mediates between the need for cross-server session continuity and the need for domain-specific security isolation.
2Object-affected harmful factors
If a unique encryption key is generated for each session, then security is improved, but session resumption across servers is prevented
Solution Approach 1:
The encryption key is segmented into a common key component (shared across servers for resumption) and a domain secret key component (unique to each domain and server). This allows the system to achieve both security through unique domain keys and session resumption through shared common keys.
Solution Approach 2:
The common key serves multiple functions: it enables session resumption across different servers and domains while working in conjunction with domain-specific secret keys. This multi-functionality allows a single key component to support both security and versatility requirements.
3Adaptability or versatility
If multiple servers store common keys for session resumption, then cross-server session continuity is enabled, but key management complexity increases
Solution Approach 1:
By segmenting keys into common and domain-specific portions, the patent reduces key management complexity. Each server only needs to store and manage its local common key and the domain secret keys for domains it handles, rather than managing all domain keys system-wide.
Solution Approach 2:
Each server maintains local copies of common keys and domain-specific keys relevant to its operations. This local quality approach allows servers to operate independently with their own key sets while still enabling cross-server session resumption through the shared common key component.
Data Source
AI summary
Technologies are provided for generating an encrypted session resumption ticket and using the encrypted session resumption ticket to resume a secure session. As part of establishing a secure session with a client, a server can use a common key that is accessible by multiple servers and secret data (such as a private key, etc.) for a tenant associated with the secure session request to generate a session key. The session key can be used to encrypt a session resumption ticket. The client can transmit the encrypted session resumption ticket to another server to re-establish a secure session. The another server can retrieve the common key and the secret data for the tenant, and can use them to generate the session key. The another server can then decrypt the encrypted session resumption ticket using the session key and use the decrypted session resumption ticket to resume a secure session.