SSL Session Identifier Encoding for Multi-Core Certificate Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multi-core system, maintaining secure socket layer (SSL) session persistence and certificate revocation list (CRL) management across cores is challenging due to the lack of access to the master CRL by cores other than the one that established the SSL session, leading to difficulties in validating certificates and resuming SSL sessions.
Innovation Solution
The method involves encoding a core identifier into the SSL session identifier, allowing cores to access a secondary CRL based on the master CRL and determining core ownership through encoded identifiers, enabling secure SSL session management and certificate validation across multiple cores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL session is established on a specific core in a multi-core system, then the core can maintain the session with full access to master CRL, but other cores cannot access the master CRL when session resumption is requested, leading to certificate validation failures
Solution Approach 1:
The patent divides the monolithic CRL access model into segmented per-core CRL copies. Each core maintains its own CRL copy in its private memory space, allowing independent access without inter-core communication overhead. This segmentation resolves the contradiction by enabling both reliable session persistence (original core retains master CRL) and easy certificate validation (requesting core has local CRL copy).
Solution Approach 2:
The patent creates copies of the master CRL and distributes them to each core's private memory space. When a session is established on one core, that core keeps the master CRL, while other cores receive copies. This copying mechanism allows any core to validate certificates for sessions it didn't originally establish, resolving the access limitation while maintaining security.
2Productivity
If SSL session information is distributed across multiple cores, then load balancing and session resumption are improved, but the complexity of managing CRL access and session state consistency increases
Solution Approach 1:
The patent segments CRL management into independent per-core units, where each core maintains its own CRL copy in private memory. This eliminates the need for complex inter-core synchronization mechanisms and CRL sharing protocols, reducing management complexity while enabling efficient session resumption across cores.
Solution Approach 2:
Each core independently manages its own CRL copy without requiring services from other cores. When certificate validation is needed, the core simply uses its local CRL copy, eliminating the need for complex inter-core communication and coordination mechanisms.
3Reliability
If a core maintains master CRL in private memory space, then security is enhanced through isolated access, but other cores lack access to validate certificates for sessions they didn't establish
Solution Approach 1:
The patent creates and distributes copies of the master CRL to each core's private memory space. This copying approach maintains security by keeping CRL data isolated in each core's private space while enabling cross-core session validation, as each core has its own copy to use for validating sessions it didn't originally establish.
Solution Approach 2:
The patent makes the CRL copy mechanism universal across all cores, allowing any core to validate certificates for any session in the system. Each core's CRL copy serves multiple purposes: validating sessions it established and validating sessions established by other cores, enhancing system versatility.
Data Source
AI summary
The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.