SSL Proxy Session Reuse to Reduce Handshake Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SSL connections, especially when established through proxy devices, introduce significant latency due to the handshaking processes, which can hinder client access to server resources.
Innovation Solution
The use of session re-use techniques based on session identifiers or session tickets, combined with intercepting and parsing DNS requests to pre-establish SSL sessions, reduces the latency by optimizing the SSL session establishment process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL connections are established through a proxy device, then secure communication is achieved, but latency increases due to multiple handshaking processes
Solution Approach 1:
The proxy device performs preliminary actions by intercepting DNS requests before SSL handshakes occur, resolving domain names to IP addresses in advance. This preliminary DNS resolution eliminates the need for DNS lookups during the SSL handshake process, reducing connection establishment time while maintaining secure communication through the proxy.
Solution Approach 2:
The proxy device acts as an intermediary that optimizes the connection establishment process between clients and servers. By intercepting and parsing DNS requests, resolving domains to IPs, and managing SSL sessions, the proxy mediates the communication to reduce latency while preserving security.
2Reliability
If two SSL sessions are established in sequence (client-proxy and proxy-server), then secure connections are established, but connection setup time increases
Solution Approach 1:
The proxy device initiates the SSL session with the server in advance, before receiving the client's SSL request. By pre-establishing the proxy-server SSL connection and utilizing session tickets, the system reduces the time required for sequential connection establishment, improving productivity while maintaining security.
Solution Approach 2:
The system utilizes session tickets and session identifiers to recover and reuse SSL session state information. Instead of establishing complete SSL sessions from scratch each time, the proxy discards redundant authentication steps and recovers session state, enabling faster reconnections.
3Loss of time
If DNS requests are intercepted and parsed to pre-establish SSL sessions, then connection latency is reduced, but device complexity increases
Solution Approach 1:
The proxy device performs multiple functions including DNS request interception, domain name resolution, SSL session management, and connection optimization. By consolidating these functions into a single multi-functional proxy system, the design avoids the complexity of multiple separate devices while achieving latency reduction.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Described embodiments establish at least one secure connection for a session. An intermediary device may intercept a domain name service (DNS) request from a client. The device may determine, according to the intercepted DNS request and configuration data of the device, that the client is preparing to establish a session with a server. The device may send a client hello message of the device to the server for establishing a first secure connection between the device and the server for the session, prior to the client sending a client hello message of the client for establishing a second secure connection between the client and the device for the session. The second secure connection may be established between the client and the device using a specified value for a session identifier received from the server in response to the client hello message of the device.