SSL Handshake Buffering for Appliance CPU Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SSL handshake processing is processor-intensive, reducing appliance processor cycles available for other tasks and slowing down client access, as existing solutions offloading SSL processing to network appliances are not sufficient for all networks.
Innovation Solution
A method and system for buffering SSL handshake messages prior to computing a message digest, where a network appliance conducts an SSL handshake, stores messages, provides them to a message digest computing device, and completes the handshake upon receiving a matching digest, enabling efficient SSL handshakes through precomputing of handshake messages and efficient buffering and encryption of data for transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL handshake processing is performed on the network appliance, then secure communications are enabled, but processor cycles are consumed reducing availability for other tasks
Solution Approach 1:
The patent divides the SSL handshake processing into two segments: message generation is performed by the network appliance, while message digest computation is offloaded to a separate cryptographic processing card. This segmentation allows the appliance to handle other tasks while maintaining secure communications through coordinated processing between components.
Solution Approach 2:
The patent introduces a cryptographic processing card as an intermediary device that专门 handles the computationally intensive message digest computation. This intermediary relieves the network appliance of the processing burden while ensuring cryptographic operations are performed with appropriate security and performance characteristics.
2Device complexity
If SSL handshake messages are processed sequentially, then processing simplicity is maintained, but throughput is limited
Solution Approach 1:
The patent implements preliminary action by pre-computing and buffering SSL handshake messages before the actual handshake occurs. The network appliance generates and stores messages such as server hello, server certificate, and other handshake components in advance, so they are ready for rapid transmission during the actual SSL handshake, significantly increasing throughput without complex processing.
3Reliability
If message digest computation is performed during SSL handshake, then authentication is ensured, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-generating and buffering SSL handshake messages before authentication is needed. When authentication occurs, the network appliance simply retrieves pre-computed messages from buffers rather than computing them in real-time, ensuring authentication reliability while minimizing processing time.
Solution Approach 2:
The patent uses copying by storing copies of SSL handshake messages in buffers after they are initially generated. These buffered copies are then reused during subsequent handshakes or authentication processes, eliminating the need to regenerate messages and reducing processing time while maintaining authentication integrity.
Data Source
AI summary
A method for buffering SSL handshake messages prior to computing a message digest for the SSL handshake includes: conducting, by an appliance with a client, an SSL handshake, the SSL handshake comprising a plurality of SSL handshake messages; storing, by the appliance, the plurality of SSL handshake messages; providing, by the appliance to a message digest computing device in response to receiving a client finish message corresponding to the SSL handshake, the plurality of SSL handshake messages; receiving, by the appliance from the message digest computing device, a message digest corresponding to the provided messages; determining by the appliance, the message digest matches a message digest included in the SSL client finish message; and completing, by the appliance with the client, the SSL handshake. Corresponding systems are also described.