OTLS Proxy Handshake Optimization for High Latency Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional TLS and SSL security schemes face challenges in accelerating the handshake process without modifying servers or compromising compatibility, especially over disadvantaged communication links with high latency and low bandwidth.
Innovation Solution
Implementing an OTLS proxy that straddles the disadvantaged link, optimizing message timing and content, and utilizing TLS extensions to reduce data transmission and round-trip communications, while maintaining backward compatibility with standard TLS servers and preserving end-to-end security guarantees.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional TLS/SSL handshake processes are used over disadvantaged links, then security is maintained, but connection establishment time is excessive
Solution Approach 1:
The patent segments the TLS handshake process by introducing a proxy that intercepts and processes handshake messages. The proxy divides the traditional client-server handshake into multiple stages: client-to-proxy exchange, proxy-to-server exchange, and proxy-mediated finalization. This segmentation allows parallel processing and optimization of different handshake phases, reducing overall handshake time while maintaining security through the proxy's mediation.
Solution Approach 2:
The patent introduces a proxy as an intermediary component between the client and server. This proxy acts as a mediator that receives, processes, and forwards TLS handshake messages. The proxy can optimize message timing, pre-process cryptographic parameters, and manage the handshake flow to reduce latency over disadvantaged links, while the server maintains its original TLS implementation without modifications.
2Productivity
If acceleration techniques are applied to TLS handshake, then connection establishment speed improves, but server compatibility is compromised
Solution Approach 1:
The proxy serves as an intermediary that translates between optimized client requests and standard server expectations. It implements acceleration techniques such as message timing optimization and pre-computation of cryptographic parameters on the client side, while converting these optimized requests into standard TLS handshake messages that any compliant server can process, thus maintaining broad server compatibility.
Solution Approach 2:
The patent segments the TLS implementation into client-side optimization components and standard server components. The proxy handles the optimized portions (message timing, parameter preparation) while the server processes standard TLS messages unchanged. This segmentation allows acceleration techniques to be applied without requiring server modifications or compromising compatibility with existing TLS servers.
3Loss of energy
If data transmission is reduced over disadvantaged links, then bandwidth consumption decreases, but protocol complexity increases
Solution Approach 1:
The patent applies preliminary action by having the proxy pre-process and prepare cryptographic parameters, certificates, and handshake messages before transmission over the disadvantaged link. The proxy can cache frequently used data, pre-compute cryptographic values, and optimize message sizes in advance, reducing the actual data transmitted during the handshake while the increased complexity is confined to the proxy's preprocessing operations.
Data Source
AI summary
A method for establishing a secure communication session over communication paths between one or more client devices and one or more server computers according to a communication protocol includes initiating the session including passing communication through a proxy on a device on the communication paths, passing session initiation information between the client devices and the server computers via the proxy, passing encrypted content between the client devices and the server computers over secure communication sessions, each established for exclusive access from one client device and one server computer based on the exchanged session initiation information between said client device and said server computer whereby the proxy does not have access to the content, and modifying, using the proxy, at least some information passing between a client device and a server computer such that the communication to and from the server computer adheres to the communication protocol.