Untrusted Proxy TLS Handshake Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-latency relay systems, such as those in rural areas, experience significant delays due to the two-round trip handshake protocol in Transport Layer Security (TLS) authentication, which hampers secure network communication.
Innovation Solution
Introducing an untrusted proxy between the client and server devices to reduce the TLS handshake to a single round trip, allowing pre-generated messages to be used, thereby mitigating latency without compromising security by not sharing private keys with the proxy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a two-round trip handshake protocol is used for TLS authentication, then security is ensured, but latency increases significantly in high-latency relay systems
Solution Approach 1:
The patent introduces a proxy server as an intermediary between the client and server. The proxy receives the client's hello message, generates and caches server hello messages in advance, and sends pre-generated responses back to the client. This intermediary mechanism reduces the handshake from two round trips to one round trip, significantly reducing latency in high-latency relay systems while maintaining security through proper certificate validation and key exchange protocols.
2Productivity
If an untrusted proxy is introduced to reduce handshake latency, then session initiation speed increases, but security risks may be introduced
Solution Approach 1:
The proxy server performs preliminary actions by generating and caching server hello messages in advance before actual client connections are established. When a client connects, the proxy retrieves pre-generated messages from cache rather than generating them in real-time, enabling rapid session initiation. The proxy is designed to be untrusted, meaning it does not store or access private keys, thereby maintaining security while achieving high productivity.
3Loss of time
If private keys are shared with the proxy to enable session resumption, then latency is reduced, but security is compromised
Solution Approach 1:
The patent extracts the latency-reducing functionality from the security-critical components. Instead of sharing private keys with the proxy, the system extracts only the necessary public information and pre-generated server hello messages (containing public keys and certificates) to be cached and reused. This separation allows the proxy to reduce handshake time without compromising security, as private keys never leave the original server.
Data Source
AI summary
Some embodiments include a method of utilizing a proxy device to mitigate latency related to a transport layer security (TLS) handshake protocol. The proxy device can be an untrusted proxy of a server or a client. The proxy device can negotiate cipher suites on behalf of its principal (e.g., the server or the server) without storing private keys of its principal. The use of the proxy device can reduce a typical two round-trips taken between the server and the client into a single round-trip.