SSL Session Cloning Across Multi-Core Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-core systems, maintaining secure socket layer (SSL) session persistence and certificate revocation list (CRL) management across cores is challenging due to the lack of access to the master CRL by cores other than the original core that established the SSL session, leading to difficulties in resuming SSL sessions and validating certificates.
Innovation Solution
A method where a core in a multi-core system encodes its identifier into the SSL session identifier, allowing other cores to access and manage SSL sessions and CRLs, including generating secondary CRLs for certificate validation, ensuring seamless session resumption and certificate verification across cores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL session information is stored in private memory address space associated with a specific core, then session security is maintained, but other cores cannot access the session information to resume sessions or validate certificates
Solution Approach 1:
The patent divides the CRL data structure into multiple segments, with each core maintaining its own portion of the CRL in its private memory address space. This segmentation allows each core to access relevant certificate revocation information locally while maintaining session security through core-specific memory allocation. The session information is similarly segmented with core identifiers embedded in session identifiers, enabling proper routing across cores.
Solution Approach 2:
The patent introduces an intermediary mechanism where session identifiers act as mediators between cores and session information. The session identifier contains embedded core identifiers that serve as keys to locate the appropriate core's memory space. This intermediary approach allows cores to access session information without direct memory sharing, maintaining security while enabling cross-core session resumption.
2Speed
If each core maintains its own CRL in private memory, then certificate validation can be performed locally, but memory usage increases across the system
Solution Approach 1:
The patent applies local quality by allowing each core to maintain only the portion of the CRL that is relevant to its specific processing needs. Rather than duplicating the entire CRL on every core, each core stores localized segments of certificate revocation information in its private memory. This approach enables fast local validation for certificates processed by that core while minimizing overall memory consumption across the multi-core system.
3Device complexity
If SSL session identifiers are generated without core identification, then session management is simplified, but cores cannot determine which core established the session
Solution Approach 1:
The patent merges the session identifier with the core identifier into a single composite identifier structure. The session identifier is constructed to include both the original session identification elements and the core identifier that established the session. This merging eliminates the need for separate tracking structures while enabling cores to determine session ownership and access appropriate session information in private memory address space.
Data Source
AI summary
The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.