Server-Pool Session Tickets for Secure Cross-Server Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication protocols require multiple handshakes with different servers to establish sessions, which are computationally expensive and time-consuming, especially when web services are provided across multiple servers rather than a single server.
Innovation Solution
Implementing a system where servers in a server pool share a centrally-generated encryption key, allowing session tickets to be used across multiple servers within the pool, with staggered expiration times and different encryption keys for each pool, enabling secure communication sessions to be shared without requiring multiple handshakes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple handshakes are performed with different servers to establish secure communication sessions, then security is maintained, but computational expense and time consumption increase significantly
Solution Approach 1:
The patent merges multiple server identities into a shared encryption key system. Servers in a pool share a common encryption key, allowing session tickets generated by one server to be validated by any other server in the pool. This eliminates the need for separate handshakes with each server while maintaining security through the shared key infrastructure.
Solution Approach 2:
The shared encryption key serves multiple functions: it enables session ticket generation, validates tickets across different servers, and provides authentication. This universal key system allows a single handshake to establish sessions that can be resumed across multiple servers, making the system multi-functional and eliminating redundant handshakes.
2Reliability
If multiple handshakes are performed with different servers to establish secure communication sessions, then security is maintained, but computational resources are consumed excessively
Solution Approach 1:
The patent combines the cryptographic functions of multiple servers into a single shared encryption key system. Instead of each server performing independent cryptographic operations during handshakes, the shared key allows any server to validate tickets from any other server in the pool, dramatically reducing computational overhead while maintaining security.
Solution Approach 2:
The system performs preliminary key establishment once for the entire server pool, rather than requiring separate key establishment (handshake) with each server. The shared encryption key is pre-configured and can be used repeatedly for session resumption across multiple servers, eliminating redundant computational work.
3Adaptability or versatility
If a single encryption key is used for session resumption across multiple servers, then session sharing is enabled, but key compromise affects all servers in the pool
Solution Approach 1:
The patent segments the server pool into multiple independent encryption key groups. Each server or subset of servers has its own encryption key, allowing session tickets to be scoped to specific key groups. This segmentation isolates security compromises to individual key groups rather than affecting the entire system, while still enabling session sharing within each group.
Solution Approach 2:
Different encryption keys are assigned to different servers or server subsets based on their specific security requirements and trust relationships. This local quality approach allows each server to have customized security properties while maintaining overall system functionality, enabling session sharing where appropriate while isolating security risks.
4Ease of manufacture
If encryption keys have uniform expiration times, then key management is simplified, but system availability is reduced during key rotation failures
Solution Approach 1:
The patent implements staggered expiration times for encryption keys, creating a periodic rotation schedule where keys expire at different intervals. This ensures that not all keys expire simultaneously, providing fallback options during key rotation failures and maintaining system availability while still enabling automated key management through structured rotation schedules.
Solution Approach 2:
The system prepares for potential key rotation failures by implementing overlapping key validity periods and staggered expiration. This cushioning approach ensures that if one key rotation fails, other keys with different expiration times remain valid, preventing complete system unavailability and providing time for recovery.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In various embodiments, servers in a server pool share a centrally-generated encryption key that is used to encrypt session keys in tickets that can be used by client applications to share secure communication sessions across different servers belonging to the same server pools. When the client application first establishes a secure communication session with a server in a server pool, the server returns a ticket that includes an encrypted version of a session key generated using an encryption key shared by servers in the server pool. Thereafter, the client application can present the ticket to other servers in the server pool to restore the secure communication session with the other servers. Associations between servers and server pools can be communicated to the client application in any technically feasible manner, such as part of information indicating servers from which content can be accessed or via the Domain Name System (DNS).