SSL Handshake Precomputation for Appliance CPU Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL handshake processes are processor-intensive, leading to reduced appliance processor cycles for other tasks, as they require significant computing resources, which can slow down client access and reduce efficiency in secure communication initialization.
Innovation Solution
A method and system for buffering SSL handshake messages prior to computing a message digest, where a network appliance conducts an SSL handshake, stores messages, and computes a message digest using a separate device, allowing for efficient SSL handshakes by precomputing handshake messages and optimizing CPU usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL handshake processing is conducted directly on the network appliance, then security authentication is ensured, but processor cycles are consumed reducing efficiency for other tasks
Solution Approach 1:
The patent extracts the computationally intensive SSL handshake processing from the network appliance by introducing a separate SSL processing device. The appliance only needs to forward handshake messages and receive the final session key, while the separate device performs the actual cryptographic computations. This extraction resolves the contradiction by maintaining security authentication (principle of using dedicated SSL processing) while preserving processor cycles on the appliance for other tasks.
Solution Approach 2:
The patent introduces an intermediary SSL processing device that acts as a mediator between the client and the network appliance. This intermediary handles the processor-intensive SSL handshake computations, allowing the appliance to maintain its primary functions without being burdened by SSL processing. The intermediary receives handshake messages from the appliance, performs the cryptographic operations, and returns the session key, thus resolving the resource allocation conflict.
2Productivity
If SSL handshake processing is offloaded to a separate device, then appliance processor cycles are preserved, but system complexity increases
Solution Approach 1:
The patent designs the SSL processing device to be a multi-functional component that can serve multiple purposes: it processes SSL handshakes for multiple appliances, manages session keys for multiple connections, and can operate independently or in coordination with different network appliances. This universality reduces the overall system complexity by consolidating SSL processing capabilities into a single shared resource rather than requiring each appliance to have dedicated SSL processing capabilities.
3Reliability
If message digest computation is performed during SSL handshake, then security is maintained, but handshake time increases
Solution Approach 1:
The patent applies preliminary action by having the SSL processing device compute the message digest and verify the handshake integrity in advance, before the final session key is established. The device prepares the cryptographic verification ahead of time, so that when the handshake is completed, the security verification is already in place. This preliminary computation reduces the perceived handshake time on the appliance while maintaining the necessary security checks.
Data Source
AI summary
A method for enabling efficient SSL handshakes through precomputing of handshake messages, the method includes: receiving, by an appliance, a server certificate identifying a server; generating, by the appliance, at least one of: (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message; storing, by the appliance, the generated messages; receiving, by the appliance from a client, an SSL client hello message identifying the server; and transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages. Corresponding systems are also described.