SSL Handshake Buffering and Precomputation for Network Appliances
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network appliances face challenges in efficiently processing SSL handshakes due to processor-intensive cryptographic operations, which can reduce available processor cycles and limit bandwidth utilization, leading to delays and reduced performance in handling other network tasks.
Innovation Solution
A method and system that involve buffering SSL handshake messages and precomputing handshake messages, allowing a network appliance to efficiently manage SSL handshakes by storing and regenerating messages, and using a message digest computing device to verify message integrity, thereby reducing the computational load on the appliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL cryptographic processing is performed on the network appliance, then secure communications are enabled, but processor cycles are consumed reducing availability for other tasks
Solution Approach 1:
The patent extracts the message digest computation task from the network appliance's CPU and assigns it to a separate co-processor. This allows the main processor to focus on other tasks while the co-processor handles the cryptographic hashing operations, effectively separating the security function from the general processing load.
Solution Approach 2:
The patent introduces a co-processor as an intermediary device between the network appliance's CPU and the cryptographic operations. This intermediary handles the computationally intensive message digest calculations, acting as a mediator that offloads specific cryptographic tasks from the main processor.
2Reliability
If cryptographic operations are performed for each SSL message, then message integrity is verified, but processing time increases
Solution Approach 1:
The patent implements preliminary action by having the co-processor compute message digests in advance and store them in a buffer before the main processor needs to verify them. This allows the CPU to retrieve pre-computed digests without waiting for cryptographic operations to complete, significantly reducing processing delays.
Solution Approach 2:
The patent ensures continuity of useful action by maintaining a buffer of pre-computed message digests that the main processor can continuously retrieve and verify against incoming messages. This eliminates idle time for the CPU and maintains continuous processing flow.
3Speed
If SSL handshakes are processed in real-time, then connection establishment is immediate, but computational load increases
Solution Approach 1:
The patent applies preliminary action by pre-computing and buffering message digests during the SSL handshake process. This allows the main processor to quickly verify cryptographic elements without performing intensive calculations in real-time, reducing the computational load during connection establishment.
Solution Approach 2:
The patent uses copying by creating and storing copies of message digests in a buffer before they are needed for verification. This allows the main processor to work with copied digest values rather than performing repeated cryptographic computations, significantly reducing real-time computational requirements.
Data Source
AI summary
A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two or more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.