SSL Accelerator Intercepts Packets to Offload Server Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Secure Sockets Layer (SSL) protocol imposes significant computational overhead on servers handling multiple secure communication sessions, leading to performance bottlenecks and slowed web transactions due to the intensive process of encryption and decryption.
Innovation Solution
An SSL acceleration device intercepts packet-based communications between clients and servers, offloading encryption and decryption tasks to reduce server workload, using a combination of hardware and software to implement packet-level encryption and decryption, and operate in various modes such as direct, load balancing, and full proxy to optimize performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption and decryption is performed on the server for multiple concurrent sessions, then secure communication is achieved, but server CPU overhead increases significantly
Solution Approach 1:
The patent extracts the SSL encryption and decryption functionality from the server system and implements it as a separate, dedicated hardware device. This device handles all computationally intensive SSL operations independently, allowing the server to focus on application logic while maintaining secure communications. The extraction resolves the contradiction by removing the performance burden from the server while preserving security functionality.
Solution Approach 2:
The patent introduces an intermediary SSL acceleration device that sits between the server and clients. This intermediary handles all SSL handshakes, encryption, and decryption operations, acting as a mediator that protects the server from computational overhead. The intermediary resolves the contradiction by providing security services without impacting server performance.
2Adaptability or versatility
If the server handles multiple SSL sessions concurrently, then more clients can be served, but the computational intensity slows down web transactions
Solution Approach 1:
The patent extracts SSL processing from the server timeline, allowing multiple sessions to be handled in parallel by the dedicated SSL device without sequentially blocking server operations. This extraction enables concurrent session handling without the time penalty that would otherwise occur on the server.
Solution Approach 2:
The patent replaces the software-based SSL processing mechanism on the server with a hardware-accelerated system. This substitution uses dedicated cryptographic hardware to perform encryption and decryption operations much faster than software could, thereby reducing transaction processing time while maintaining the ability to handle multiple concurrent sessions.
3Reliability
If SSL protocol is implemented to secure all communications, then security is improved, but the bottleneck in managing and processing SSL sessions degrades web server performance
Solution Approach 1:
The patent extracts SSL session management complexity from the server system and consolidates it in a dedicated SSL acceleration device. This device is specifically designed to handle the complex tasks of session establishment, key management, and protocol negotiation, thereby reducing the overall system complexity burden on the web server while maintaining enhanced security.
Data Source
AI summary
An acceleration apparatus is adapted to operate in a direct mode and a proxy mode. In the direct mode, the acceleration apparatus decrypts data packets received from a client and forwards the decrypted data packets to a server using a communication session negotiated by the client and the server. In the proxy mode, the acceleration apparatus responds to the client on behalf of the server and forwards the decrypted data packets to the server using a communication session negotiated by the acceleration device and the server. The acceleration apparatus automatically switches from the direct mode to the proxy mode upon detection of a communication error associated with the communication session negotiated by the client and the server.