SSL Session Tracking for SaaS Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SSL/TLS protocols for SaaS applications lead to inefficient re-handshakes and increased latency when users access multiple related links or domain names after an idle period, as session timeouts cause connections to be re-established, impacting user experience and server resource utilization.
Innovation Solution
A system and method that tracks SSL/TLS session state objects to pre-establish connections based on Server Name Indicators (SNIs) using a device intermediary, which sends messages to clients to initiate connections before session timeouts occur, optimizing DNS resolution and SSL connections by reusing previously established sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL/TLS session timeout values are set to maintain session security, then session security is improved, but connection re-establishment latency increases when users access multiple domain names after idle period
Solution Approach 1:
The system performs preliminary actions by pre-establishing SSL/TLS connections for multiple domain names associated with a SaaS application before the session timeout occurs. When a user accesses the application, the system proactively sets up connections to all related domain names in advance, so that when the user subsequently accesses different links or domain names within the application, the connections are already ready and no re-handshake is needed, thus reducing latency while maintaining security through controlled timeout values
Solution Approach 2:
The system dynamically adjusts SSL session management based on user behavior patterns. It monitors user activity and adapts the session timeout and connection establishment strategy accordingly. For active users accessing multiple domain names, the system maintains connections longer and pre-establishes connections proactively, while for inactive users it allows sessions to timeout normally, thus optimizing the balance between security and performance based on real-time dynamics
2Reliability
If SSL handshakes are re-performed after session timeout, then session security is maintained, but server resource utilization increases due to repeated connection establishment
Solution Approach 1:
The system performs preliminary connection establishment for all domain names associated with a SaaS application when the application is first accessed. By proactively creating SSL/TLS connections to multiple domain names in advance, the system eliminates the need for repeated handshakes when users navigate between different links, thereby reducing server resource consumption for connection establishment while maintaining security through controlled session timeout values
Solution Approach 2:
The system maintains continuous SSL/TLS connections for multiple domain names throughout the user session, avoiding interruption and re-establishment. By keeping connections active and reusable across different domain name accesses within the same application session, the system ensures continuous useful action without repeated handshakes, optimizing server resource utilization while preserving security through managed timeout parameters
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Described embodiments provide systems and methods for initiating establishment of a connection. The system may include a device intermediary between a client and a server. The device may determine at least one server name indicator (SNI) for an application executing on the client and having a secure session established with the server. The device may determine, for each domain name corresponding to the at least one SNI, a session timeout value for the corresponding domain name. The device may send a message to the client according to each session timeout value, to cause the client to initiate establishment of a connection for the corresponding domain name using the secure session.