SSL Session Pool Management for WAN Acceleration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data communication networks face challenges in efficiently managing Secure Socket Layer (SSL) sessions across multiple intermediaries, leading to suboptimal performance and security in WAN acceleration scenarios.
Innovation Solution
Implementing an SSL session pool management system where a first intermediary requests and manages SSL sessions from a pool maintained by a second intermediary, enabling efficient identification and utilization of available SSL sessions for secure connections between clients and servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple intermediaries are used between client and server for SSL session management, then security and functionality are improved, but system complexity and coordination overhead increase
Solution Approach 1:
The patent introduces a pool manager as an intermediary component that coordinates between multiple SSL intermediaries. The pool manager maintains a pool of SSL sessions and manages their distribution, acting as a mediator that reduces direct coordination complexity between intermediaries while maintaining security through controlled session sharing.
2Reliability
If SSL sessions are established individually for each client request, then security is maintained, but performance and efficiency deteriorate due to repeated handshaking
Solution Approach 1:
The patent implements preliminary action by pre-establishing SSL sessions and maintaining them in a pool before they are needed. The pool manager keeps these sessions ready for reuse, so when client requests arrive, pre-established sessions can be quickly allocated without performing full SSL handshaking, thus improving performance while maintaining security through controlled session reuse.
Solution Approach 2:
The patent applies discarding and recovering by allowing SSL sessions to be discarded after use and then recovered/reused from the pool for subsequent requests. The pool manager manages the lifecycle of SSL sessions, recycling them appropriately to balance security requirements with performance optimization through reuse.
3Productivity
If SSL sessions are pooled and shared between intermediaries, then resource utilization and efficiency improve, but session management complexity and coordination overhead increase
Solution Approach 1:
The patent merges the session management functions of multiple intermediaries into a centralized pool manager. Instead of each intermediary independently managing its own SSL sessions, the pool manager consolidates session management, reducing overall complexity while improving efficiency through shared resource utilization across the intermediary network.
4Reliability
If SSL handshaking is performed repeatedly for each connection, then security authentication is ensured, but time consumption and latency increase
Solution Approach 1:
The patent performs SSL handshaking in advance and maintains the authenticated sessions in a pool. When subsequent connections are needed, pre-authenticated sessions are reused, eliminating the need to repeat the time-consuming SSL handshaking process while maintaining authentication security through controlled session reuse managed by the pool manager.
Data Source
Figure 1A
Figure 1B
Figure 1C~1F
AI summary
The present invention is directed towards systems and methods for using a Secure Socket Layer (SSL) session from a pool of SSL sessions shared between intermediaries. The method includes receiving, by a first intermediary, information on one or more SSL sessions of a pool established by a second intermediary with a server. The first intermediary can be in communication with one or more clients and the second intermediary can be in communication with one or more servers. The first intermediary may receive a request from a client to establish an SSL session with the server. The first intermediary can identify an SSL session from the pool of SSL sessions. The first intermediary may establish the SSL session with the client responsive to the request.