SSL Proxy TCP Retransmission Memory Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transparent proxy devices face challenges in efficiently handling TCP retransmissions over SSL sessions due to differing cryptographic parameter sets, leading to memory resource constraints and complexity in regenerating unacknowledged TCP segments.
Innovation Solution
A network device uses incoming retransmitted TCP segments to regenerate and retransmit TCP segments to the server by maintaining data structures for SSL payload positions and engine states, allowing it to handle multiple retransmissions without storing unacknowledged segments, thereby conserving memory and simplifying the regeneration process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the transparent proxy device stores unacknowledged TCP segments for retransmission, then the device can reliably retransmit segments, but memory resources are consumed and device complexity increases
Solution Approach 1:
The proxy device pre-establishes SSL sessions and cryptographic contexts before TCP segments need retransmission. By preparing the decryption and encryption engines in advance with the correct cryptographic parameters, the device can quickly regenerate TCP segments when retransmission is needed without complex storage management
Solution Approach 2:
Instead of storing actual TCP segment data in memory, the proxy device creates cryptographic copies or representations of the segmentation state. It maintains metadata about segments and uses cryptographic engines to regenerate the actual segment content when needed, reducing memory usage while maintaining retransmission capability
2Adaptability or versatility
If the transparent proxy device handles multiple SSL sessions with different cryptographic parameter sets, then encryption/decryption can be performed, but the complexity of managing different cryptographic states increases
Solution Approach 1:
The proxy device segments the cryptographic management into separate, independent SSL session contexts. Each SSL session maintains its own cryptographic parameters, keys, and engine states in isolated data structures. This segmentation allows multiple different cryptographic parameter sets to be managed simultaneously without interference, as each session's cryptographic state is independently tracked and processed
Solution Approach 2:
The patent introduces an intermediary cryptographic context layer between the TCP segmentation function and the actual encryption/decryption operations. This intermediary maintains the cryptographic parameters and engine states, acting as a mediator that manages the complexity of multiple cryptographic sessions while presenting a unified interface for TCP segment processing
3Reliability
If the network device stores TCP payload for retransmission, then retransmitted segments can be accurately regenerated, but memory resources are consumed
Solution Approach 1:
The proxy device stores cryptographic copies or metadata representations of TCP payload rather than the actual payload data. It maintains information about the payload's cryptographic context, position, and segmentation state, then uses the SSL cryptographic engines to regenerate the actual payload content when retransmission is required. This approach ensures accurate retransmission while consuming minimal memory resources
Solution Approach 2:
The patent changes the state parameters from storing actual payload data to storing cryptographic state parameters. By maintaining cryptographic context information, engine states, and positional metadata rather than the payload content itself, the device can regenerate accurate retransmissions by changing the cryptographic parameters back to their original state and re-encrypting the payload
Data Source
AI summary
A network device receives TCP segments of a flow via a first SSL session and transmits TCP segments via a second SSL session. Once a TCP segment has been transmitted, the TCP payload need no longer be stored on the network device. Substantial memory resources are conserved, because the device may have to handle many retransmit TCP segments at a given time. If the device receives a retransmit segment, then the device regenerates the retransmit segment to be transmitted. A data structure of entries is stored, with each entry including a decrypt state and an encrypt state for an associated SSL byte position. The device uses the decrypt state to initialize a decrypt engine, decrypts an SSL payload of the retransmit TCP segment received, uses the encrypt state to initialize an encrypt engine, re-encrypts the SSL payload, and then incorporates the re-encrypted SSL payload into the regenerated retransmit TCP segment.