Secure Session Resumption Using Credential Identifier Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure session resumption and duplication methods over communication networks are unreliable due to frequent changes in IP addresses and ports, especially in peer-to-peer multimedia sessions, leading to increased delays and processing requirements.
Innovation Solution
A method that uses a credential identifier to reliably identify and associate with a session identifier, allowing for the storage and retrieval of secure session information, enabling faster and seamless resumption or duplication of secure sessions even with dynamic IP addresses and ports, by leveraging existing security infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP address and port are used to identify a secure session at the client side, then session identification can be implemented, but the identification becomes unreliable due to frequent changes in IP addresses and ports
Solution Approach 1:
The patent introduces a session identifier as an intermediary element that mediates between the client and server for session identification. Instead of directly using volatile IP addresses and ports, the session identifier acts as a stable reference that both parties can use to identify and resume sessions, resolving the unreliability caused by dynamic network parameters
Solution Approach 2:
The patent changes the identification parameter from volatile network parameters (IP address and port) to a stable session identifier. This parameter transformation allows sessions to be reliably identified and resumed even when network conditions change, as the session identifier remains constant throughout the session lifecycle
2Reliability
If a full handshake procedure is performed for each new secure session, then security is ensured, but performance decreases due to increased round-trips and cryptographic computations
Solution Approach 1:
The patent implements session resumption functionality that allows previously established session parameters to be reused. By performing authentication and key exchange in advance (during the initial session establishment), the system can quickly resume sessions without repeating the full handshake procedure, thus improving performance while maintaining security
Solution Approach 2:
The patent introduces dynamic session management where the handshake procedure can be either full or abbreviated based on session state. The system dynamically selects between performing a complete security handshake or reusing existing session parameters, optimizing the balance between security and performance according to current needs
3Productivity
If session resumption is enabled to improve performance, then fewer round-trips and less cryptographic computation are required, but the system becomes more complex due to session state management
Solution Approach 1:
The patent extracts the essential session identification functionality into a separate session identifier mechanism. By separating session identification from the main handshake procedure, the system can manage session state more efficiently, reducing the complexity burden while maintaining resumption capabilities
Solution Approach 2:
The session identifier serves multiple functions: it identifies the session, enables resumption, and provides a reference for both client and server. This multi-functional element simplifies the overall session management complexity by consolidating several responsibilities into a single mechanism
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
This disclosure provides a method, performed in a client terminal (50), for enabling an establishment of a second secure session over a communication network. The second secure session is additional to a first secure session. The first secure session is established using a session establishment protocol and a transport security protocol. The method performed in the client terminal (50) comprises obtaining a session identifier of the first secure session; and obtaining a credential identifier, the credential identifier identifying a server terminal (60) of the first secure session. The method performed in the client terminal (50) comprises associating the credential identifier to the session identifier of the first secure session; and storing the session identifier and the credential identifier associated with the session identifier of the first secure session.