SSL Pre-Handshake Module for Middlebox Connection Speed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In high availability networks, establishing multiple SSL/TLS connections to different servers for a single website request is CPU-intensive and involves additional Round Trip Time (RTT) and data transfer, as each middlebox needs to perform a full handshake to obtain certificates and compute security keys.
Innovation Solution
Implementing an SSL pre-handshake establishment module in middleboxes that caches session information and forms secure connections with servers grouped by their association, reducing the need for repeated full handshakes by reusing cached sessions and forming connections with servers listed in a server group.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full SSL handshake is performed for each connection request to multiple servers, then secure connections are established with proper certificate verification, but CPU load increases and connection establishment time increases
Solution Approach 1:
The patent performs SSL handshakes in advance for multiple servers that are likely to be accessed, storing the session information locally. When connection requests arrive, the pre-established sessions are reused instead of performing full handshakes, thus resolving the contradiction between security reliability and connection speed.
Solution Approach 2:
The patent combines multiple individual SSL connection requests into a single pre-established session for a group of related servers. By merging the authentication and key exchange operations into one preliminary action, it reduces the overall CPU load and connection establishment time while maintaining security.
2Reliability
If multiple SSL handshakes are performed for related servers, then each server's certificate is properly verified, but additional Round Trip Time (RTT) and data transfer occur
Solution Approach 1:
The system performs certificate verification and session establishment in advance during a preliminary SSL handshake with servers in a group. This preliminary action eliminates the need for repeated RTT and data transfer during actual connection requests, while still ensuring proper certificate verification through the initial handshake.
3Productivity
If session information is cached for reuse, then connection establishment becomes faster, but cache validity and security may be compromised
Solution Approach 1:
The patent implements a feedback mechanism that monitors session validity and securely manages cached session information. The system tracks session expiration, handles server responses to verify ongoing validity, and maintains security by invalidating cached sessions when necessary, thus resolving the contradiction between connection speed and session security.
Data Source
AI summary
An appliance and a method of pre-establishing SSL session connections for SSL connection establishment are provided. The appliance comprises a secure session pre-handshake establishment module configured to facilitate a secure session connection between an appliance and a server associated with a website, wherein the facilitation causes the appliance to receive session information, determine whether session information corresponding to the secure session connection request has been cached, determine whether the server is associated with a server group based on the determination that session information has not been cached, and form secure session connections between the appliance and servers listed in the server group based on the determination that the server is associated with a server group.