OCSP Intermediary Batching and Caching for SSL Handshake Latency

Solution Overview

Problem

Existing systems for Online Certificate Status Protocol (OCSP) processing in Secure Socket Layer (SSL) handshaking are inefficient, as they often require multiple requests to OCSP servers and lack effective caching mechanisms, leading to increased latency and resource utilization.

Innovation Solution

Implementing a method and system where an intermediary device batches OCSP requests and caches responses, allowing it to determine the status of client certificates using a single request to an OCSP server and store the results for future connections, thereby reducing the need for repeated queries and improving processing efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple OCSP requests are sent to validate client certificates, then certificate validation reliability is improved, but latency and resource utilization increase

Engineering Contradiction:

Improvecertificate validation reliabilityVSAvoidOCSP processing latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs OCSP validation in advance during the SSL handshake process, obtaining certificate status information before the connection is fully established. This preliminary action allows the intermediary device to cache the validation results and reuse them for subsequent connections from the same client, avoiding repeated OCSP requests and reducing latency while maintaining validation reliability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent combines multiple OCSP requests into a single batched request by the intermediary device. Instead of sending individual requests for each client certificate validation, the system aggregates multiple validation needs and sends them together to the OCSP server, reducing the total number of requests and associated latency while ensuring all certificates are properly validated

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If multiple OCSP requests are sent to validate client certificates, then certificate validation completeness is improved, but resource utilization increases

Engineering Contradiction:

Improvecertificate validation completenessVSAvoidOCSP server resource utilization

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The intermediary device merges multiple OCSP requests into a single batched request sent to the OCSP server. This consolidation reduces the total number of requests from multiple individual queries to one aggregated query, significantly lowering OCSP server resource utilization while maintaining complete validation of all client certificates through the batched processing

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The system performs OCSP validation in advance during the SSL handshake process, obtaining certificate status information before the connection is fully established. This preliminary action allows the intermediary device to cache the validation results and reuse them for subsequent connections from the same client, avoiding repeated OCSP requests and reducing resource utilization while maintaining validation completeness

Inventive Principle:

Principle #10Preliminary action

3Reliability

If OCSP requests are sent for each SSL handshake, then real-time certificate status verification is improved, but processing efficiency decreases

Engineering Contradiction:

Improvereal-time certificate status verificationVSAvoidSSL handshake processing efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs OCSP validation in advance during the SSL handshake process, obtaining certificate status information before the connection is fully established. This preliminary action allows the intermediary device to cache the validation results and reuse them for subsequent connections from the same client, avoiding repeated OCSP requests and reducing resource utilization while maintaining validation completeness

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The intermediary device merges multiple OCSP requests into a single batched request sent to the OCSP server. This consolidation reduces the total number of requests from multiple individual queries to one aggregated query, significantly lowering OCSP server resource utilization while maintaining complete validation of all client certificates through the batched processing

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS9172545B2Systems and methods for evaluating and prioritizing responses from multiple OCSP responders

Publication Date: 2015.10.27 CITRIX SYSTEMS INC

AI summary

The present disclosure is directed towards systems and methods for determining a status of a client certificate from a plurality of responses for an Online Certificate Status Protocol (OCSP) request. An intermediary device between a plurality of clients and one or more servers identifies a plurality of OCSP responders for determining a status of a client certificate responsive to receiving the client certificate from a client during a Secure Socket Layer (SSL) handshake. Each of the plurality of OCSP responders may transmit a request for the status of the client certificate to a uniform resource locator corresponding to each OCSP responder. The intermediary device may determine a single status for the client certificate from a plurality of statuses of the client certificate received via responses from each uniform resource locator.