SSL Session Identifier Encoding for Multi-Core Resumption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-core systems, maintaining secure socket layer (SSL) session persistence and certificate revocation list (CRL) across multiple cores is challenging due to the lack of access to the master CRL and the need to identify core ownership of SSL sessions, leading to issues with session resumption and certificate validation.
Innovation Solution
A method where a packet engine in a multi-core system encodes core identifiers into SSL session identifiers, allowing cores to determine session ownership and access secondary CRLs for certificate validation, ensuring secure session resumption and certificate revocation checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL sessions are maintained independently on each core with private memory address space, then session security and integrity are preserved, but session resumption fails when requests are directed to different cores
Solution Approach 1:
The patent introduces a session identifier encoding mechanism that embeds core identification information within the SSL session identifier itself. This encoded identifier acts as an intermediary that enables cores to identify and access session information maintained on other cores, thereby facilitating session resumption across core boundaries while preserving the security benefits of independent session storage.
2Measurement precision
If a master CRL is maintained on one core, then certificate validation accuracy is improved, but other cores cannot perform certificate revocation checks
Solution Approach 1:
The patent implements a mechanism where secondary CRLs are created as copies or derivations of the master CRL maintained on one core. These secondary CRLs are distributed to other cores, enabling them to perform certificate revocation checks independently without direct access to the master CRL, thus maintaining both validation accuracy and operational ease across all cores.
3Reliability
If SSL session information is stored with private memory address space on each core, then memory isolation and security are maintained, but cross-core session access becomes impossible
Solution Approach 1:
The patent transitions from a single-dimension approach (storing session information only in local core memory) to a multi-dimensional approach by encoding core identification information within the session identifier. This allows session information to be accessed across different memory spaces and cores by embedding dimensional information (core ID) within the identifier structure, enabling cross-core access while preserving memory isolation.
Data Source
AI summary
The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.