Kernel-Space Secure Connections via User-Space Proxy Handshake
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing operating system kernel connections over networks, such as SSL/TLS, face challenges due to complex code and resource strain when ported into kernel space, and performance issues when implemented in user space, particularly in environments requiring fast data communication.
Innovation Solution
A method utilizing a proxy application in user space to handle the handshake phase of secure protocols, allowing the kernel to manage data exchange securely without the need for complex cryptographic negotiations, thereby reducing resource strain and latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL/TLS is ported into kernel space, then security is improved, but device complexity and resource strain increase
Solution Approach 1:
The patent segments the SSL/TLS implementation into two parts: a proxy application in user space that handles cryptographic negotiations, and a kernel space component that handles secure data exchange. This segmentation allows security functionality to be distributed across different execution environments, reducing kernel complexity while maintaining security.
Solution Approach 2:
The patent introduces a proxy application as an intermediary between the kernel space and user space. This proxy handles the complex cryptographic negotiations in user space and presents a simplified interface to the kernel, acting as a mediator that resolves the contradiction between security requirements and kernel complexity.
2Reliability
If SSL/TLS is ported into kernel space, then security is improved, but maintenance difficulty increases
Solution Approach 1:
By segmenting the SSL/TLS implementation into user space and kernel space components, the patent enables independent maintenance of each part. The proxy application in user space can be updated and maintained without requiring kernel modifications, thus improving ease of repair while maintaining security.
Solution Approach 2:
The proxy application serves as an intermediary layer that can be independently maintained and updated. This intermediary absorbs the complexity of SSL/TLS updates and maintenance, allowing security patches to be applied in user space without affecting the stable kernel space implementation.
3Ease of repair
If SSL/TLS is hosted in user space, then maintenance ease is improved, but communication speed deteriorates
Solution Approach 1:
The patent segments the SSL/TLS functionality so that maintenance-intensive cryptographic negotiations occur in user space, while high-speed data exchange occurs in kernel space. This segmentation allows each component to operate in its optimal environment, balancing maintenance ease with communication speed.
Solution Approach 2:
The proxy application acts as an intermediary that minimizes the performance impact of user space processing. It handles only the necessary cryptographic negotiations and then establishes efficient kernel space connections for bulk data transfer, thus maintaining communication speed while enabling easy maintenance.
4Reliability
If cryptographic negotiation is performed in kernel space, then security is improved, but resource strain increases
Solution Approach 1:
The patent segments resource-intensive cryptographic operations into the user space proxy application, separating them from the kernel space resources. This segmentation allows cryptographic negotiations to utilize user space resources, reducing the resource strain on the kernel while maintaining security through the coordinated operation of both components.
Data Source
AI summary
A method, non-transitory computer readable medium and local storage node computing device that establishes a first connection between a first endpoint in a kernel of an operating system and a second endpoint. A proxy application in a user space is invoked and a second connection is established from the operating system kernel to the proxy application. The proxy application is linked to a secure protocol implementation. Handshake messages are proxied between the second endpoint and the proxy application using the first and second connections. Security parameters for the first connection and determined from the handshake messages are sent from the proxy application to the operating system kernel via the second connection. Data is exchanged between the first endpoint in the operating system kernel and the second endpoint using the first connection and the security parameters.