SSL/TLS Handshake Segmentation for Network Switch Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current networking switches face challenges in efficiently handling SSL/TLS operations due to the limitations of control path processors, which are susceptible to denial of service attacks and require complex design changes when offloading computationally intensive tasks, while data path processors are difficult to program for complete SSL/TLS handling.
Innovation Solution
Segmenting SSL/TLS Handshake operations between data path and control path processors, where the data path processor handles the initial authentication phases and transfers information to the control path processor to complete the handshake, allowing for efficient hardware acceleration and reduced susceptibility to attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the control path processor handles SSL/TLS operations, then the processing flexibility and configurability are improved, but the susceptibility to denial of service attacks increases and the processing speed decreases
Solution Approach 1:
The patent segments SSL/TLS processing into two distinct paths: control path processor handles configuration and management tasks, while data path processor handles computationally intensive cryptographic operations. This segmentation isolates the control path from DOS attacks targeting SSL/TLS processing, while maintaining processing flexibility through the control path's ability to configure security parameters.
2Productivity
If the data path processor handles complete SSL/TLS operations, then the processing speed is improved, but the design complexity increases and programming difficulty increases
Solution Approach 1:
The patent divides SSL/TLS processing responsibilities between control path and data path processors. The data path processor is optimized for high-speed cryptographic operations with dedicated hardware acceleration, while the control path processor manages configuration and protocol state. This segmentation allows the data path to achieve high processing speeds without requiring the entire system to be redesigned for SSL/TLS complexity.
Solution Approach 2:
The control path processor acts as an intermediary that manages the complex SSL/TLS protocol logic and configuration, while the data path processor executes optimized cryptographic functions. This intermediary approach allows the data path to focus on high-speed computation without handling protocol complexity, reducing overall design complexity while maintaining processing speed.
3Productivity
If computationally intensive SSL/TLS tasks are offloaded from the control path processor, then the control path processor performance is improved, but the state information management complexity increases
Solution Approach 1:
The patent extracts computationally intensive cryptographic operations from the control path processor and relocates them to the data path processor. This extraction improves control path processor performance by removing heavy computational loads, while state information is managed through structured data structures and protocols that minimize management complexity.
Data Source
AI summary
According to one embodiment of the invention, a method comprises an operation of commencing a first phrase and passing control of an authentication handshaking protocol. The first phase is commenced for establishing a secure communication path by a data path processor within a first network device. The first phrase comprises an exchange of data during an authentication handshaking protocol. The passing of control for authentication handshaking protocol by the data path processor to a control path processor is conducted to complete the authentication handshaking protocol.