TLS Abbreviated Session Identifier for M2M Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standardized security protocols like TLS are inefficient for Machine-to-Machine (M2M) traffic with long pauses between bursts, due to high overhead in resume mechanisms and NAT device port and address binding timeouts, leading to complications in maintaining secure connections.
Innovation Solution
A TLS Abbreviated Session Identifier (ASI) protocol is introduced, where a unique ASI is associated with each data packet, reducing the need for the built-in TLS resume mechanism and providing a more efficient, predictable, and simpler authentication process by including the ASI in every packet, especially for critical packets where IP/port binding loss is likely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the built-in TLS resume mechanism is used to maintain secure connections during long pauses between M2M traffic bursts, then security is maintained, but communication overhead increases significantly (332 bytes and over three messages)
Solution Approach 1:
The patent extracts the essential authentication function from the complex TLS resume mechanism. Instead of using the full TLS resume protocol with multiple messages and 332 bytes of overhead, the invention uses only the critical session identifier exchange to maintain security connections during long pauses between M2M traffic bursts, eliminating unnecessary overhead while preserving security.
Solution Approach 2:
The patent applies partial action by implementing only the necessary portion of the TLS protocol for session resumption. Rather than executing the complete TLS resume sequence with all its messages and handshakes, the invention performs a simplified version that exchanges just the session identifier, achieving sufficient security for M2M traffic without the excessive overhead of the full protocol.
2Reliability
If the TLS resume mechanism is used for M2M traffic with long pauses between bursts, then secure connection is maintained, but the process becomes complicated and non-deterministic due to NAT binding timeouts
Solution Approach 1:
The patent extracts the essential authentication function from the complex TLS resume mechanism. Instead of using the full TLS resume protocol with multiple messages and 332 bytes of overhead, the invention uses only the critical session identifier exchange to maintain security connections during long pauses between M2M traffic bursts, eliminating unnecessary overhead while preserving security.
Solution Approach 2:
The patent enables the session identifier to serve multiple functions. The same session identifier is used both for TLS resumption and for NAT binding identification, allowing the system to self-manage connection state without requiring complex external coordination or additional protocol elements.
3Reliability
If standardized TLS protocol is used for M2M traffic, then security credibility is high, but efficiency is low due to high overhead in resume mechanisms
Solution Approach 1:
The patent extracts the essential authentication function from the complex TLS resume mechanism. Instead of using the full TLS resume protocol with multiple messages and 332 bytes of overhead, the invention uses only the critical session identifier exchange to maintain security connections during long pauses between M2M traffic bursts, eliminating unnecessary overhead while preserving security.
Solution Approach 2:
The patent changes the parameter of message size by reducing the resume data from 332 bytes to a minimal session identifier. This parameter change maintains the security function while dramatically improving communication efficiency for M2M traffic with long pauses between bursts.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, system and computer program product related to an authentication security protocol, which associates a unique Abbreviated Session Identifier (ASI) with some application data packets transmitted, for example, from a client to a server. The present technology can be a modified version of the Transport Layer Security (TLS) protocol. A method of authentication comprises an initial setup comprising negotiating a secure network connection between client and server using TLS, providing a unique ASI by the server, associating the ASI with a TLS protocol session identifier, transmitting the unique ASI and the TLS protocol session identifier to the client, and establishing the secure network connection between the client and server. Subsequent data packets transferred between the client and server may include the unique ASI.