Secure Session Resumption Across Network Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security protocols, such as SSL and TLS, face challenges in efficiently managing secure sessions across different network boundaries, leading to increased computational resources and latency, as well as vulnerabilities when sessions need to be renegotiated, especially in complex network configurations.
Innovation Solution
Implementing a technique where a client completes a handshake process with a frontend server to establish a secure communications channel, using two secrets: one for the frontend server and another that remains inaccessible to it, allowing secure communication between the client and a backend server, with the frontend server only provided with limited cryptographic keys to minimize potential breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL/TLS handshake processes are used to establish secure communications, then data security is improved, but computational resources and latency increase
Solution Approach 1:
The patent applies preliminary action by establishing the secure TLS session before the actual data transfer begins. The handshake process completes all cryptographic key exchanges and session establishment in advance, allowing subsequent data communications to proceed without repeated authentication overhead, thus reducing latency while maintaining security.
Solution Approach 2:
The patent implements continuity of useful action by maintaining the established TLS session across multiple data transfer operations. Once the secure channel is created through the initial handshake, the same cryptographic keys and session parameters are reused for continuous data communications, eliminating the need for repeated handshakes and reducing overall computational overhead and latency.
2Reliability
If sessions are renegotiated when computers move between networks, then security is maintained, but additional latency and computational overhead are introduced
Solution Approach 1:
The patent applies universality by designing the TLS session to be network-agnostic. The established secure session can be maintained and reused across different network boundaries (LAN, WAN, public networks) without requiring renegotiation. The cryptographic session parameters are universally applicable regardless of the network environment, allowing the same secure channel to function across multiple network contexts.
Solution Approach 2:
The patent implements dynamics by allowing the communication system to adapt to network changes without breaking the secure session. When a computer moves between networks, the system dynamically maintains the existing TLS session rather than statically requiring re-establishment, optimizing performance by keeping the secure channel active while accommodating network mobility.
3Reliability
If full cryptographic keys are provided to the frontend server, then secure communication is enabled, but security vulnerabilities increase
Solution Approach 1:
The patent applies segmentation by dividing the cryptographic key material into separate components with different access rights. The frontend server receives only the portion of cryptographic material necessary for its function (to establish and manage the TLS session), while the backend server retains access to the full cryptographic keys. This segmentation ensures that compromise of the frontend server does not expose the complete cryptographic secret.
Solution Approach 2:
The patent implements the intermediary principle by using the frontend server as a mediator that handles TLS session management without requiring access to the complete cryptographic keys. The frontend server acts as an intermediate layer that can establish and maintain secure communications while the backend server, which holds the full keys, remains protected. The intermediary frontend server sufficient cryptographic material to perform its function but not enough to compromise the entire security system.
Data Source
AI summary
A client establishes a network session with a server. The network session is used to establish an encrypted communications session. The client establishes another network session with another server, such as after terminating the first network session. The client resumes the encrypted communications session over the network session with the other server. The other server is configured to receive encrypted communications from the client and forward them to the appropriate server.