SSL/TLS Client Certificate Renegotiation for POST Requests

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Secured servers requiring client certificates often abort POST requests if they are the first on a connection, as they cannot process the request body until the client certificate is received, leading to inefficiencies and potential memory vulnerabilities.

Innovation Solution

A method where a non-POST request, such as a GET or HEAD request, is initially submitted to establish a secured connection, followed by renegotiation with the client certificate, allowing the server to process subsequent POST requests without aborting the connection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the server requires client certificates for POST requests, then security is improved, but the POST request cannot be processed until the certificate is received, causing the request to be aborted

Engineering Contradiction:

ImprovesecurityVSAvoidPOST request processing

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the SSL/TLS connection establishment into two distinct phases: first establishing a secure connection without client certificates, then performing a second SSL/TLS handshake to exchange client certificates. This segmentation allows the POST request to be initiated on the first connection while security verification completes on the second connection, resolving the contradiction between security requirements and request processing capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary SSL/TLS connection establishment before the POST request body is fully transmitted. By setting up the initial secure connection first, the server can begin receiving and buffering the request body while the client certificate exchange is still in progress, allowing processing to continue rather than aborting the entire request.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If the server buffers the entire request before sending the client certificate request, then the POST operation can proceed, but memory vulnerabilities increase

Engineering Contradiction:

ImprovePOST operation completionVSAvoidmemory vulnerability

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent divides the data buffering into two separate buffers: one for the request body on the first connection and another for the client certificate on the second connection. This segmentation allows the server to process and validate certificates independently while maintaining request body data, reducing the memory footprint and vulnerability exposure compared to buffering everything in a single large buffer.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a second SSL/TLS connection as an intermediary mechanism for certificate exchange. This intermediary connection allows the server to obtain and verify client certificates without requiring them to be sent over the original request connection, separating the certificate validation process from the request body processing and reducing memory vulnerability risks.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Object-affected harmful factors

If the server aborts POST requests requiring client certificates, then memory vulnerability is reduced, but the ability to process secure POST requests is lost

Engineering Contradiction:

Improvememory vulnerabilityVSAvoidsecure POST request processing

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The patent makes the SSL/TLS system multi-functional by enabling it to perform two distinct roles: first, establishing a secure data transmission channel for the POST request body, and second, performing certificate authentication and exchange. This universality allows the system to handle both secure data transfer and security verification without aborting the request, maintaining adaptability while reducing vulnerability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If a non-POST request is used first to establish connection, then client certificates can be exchanged, but additional request steps are required

Engineering Contradiction:

Improvecertificate exchangeVSAvoidrequest sequence

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses a preliminary non-POST request (such as OPTIONS or HEAD) to establish the initial SSL/TLS connection and trigger the certificate exchange process. This preliminary action sets up the secure channel and initiates certificate authentication before the actual POST request is sent, ensuring that certificate requirements are resolved in advance without complicating the main POST operation.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8190876B2Renegotiating SSL/TLS connections with client certificates on post requests

Publication Date: 2012.05.29 RED HAT INC

AI summary

A method and apparatus for providing securing a connection with a (Secure Sockets Layer) SSL/TLS-enabled server. In one embodiment, a web client establishes a new connection by initiating a communication with the SSL/TLS-enabled server. The communication includes a non-POST request. After the client negotiates the secured connection with the server in response to the non-POST request, the client submits a POST request to the SSL/TLS-enabled server via the secured connection.