Filtering TLS Requests with Extensions and Federated Tickets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current TLS protocols face challenges in efficiently managing TLS connection requests, particularly in preventing Distributed Denial of Service (DDoS) attacks, which can overwhelm servers and disrupt legitimate user access due to the computational expense of full handshakes and the difficulty in filtering malicious traffic.
Innovation Solution
An application delivery system that filters TLS connection requests using TLS extensions and federated TLS tickets, allowing for more efficient management of TLS connections and enhanced security measures to mitigate DDoS attacks by employing a KnownSender extension and dynamic resource scaling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full TLS handshake is performed for each connection request, then security authentication is ensured, but communication latency increases and server computational load increases
Solution Approach 1:
The patent implements TLS session resumption mechanisms where the server performs authentication and key exchange in advance during the initial full handshake, then stores session state. Subsequent connections can resume from this pre-computed state using session tickets or session IDs, eliminating the need to repeat the computationally expensive parts of the handshake while maintaining security.
Solution Approach 2:
The patent uses session tickets that contain encrypted copies of session state information. Instead of repeating the full authentication process, the server decrypts and verifies the ticket copy to quickly resume the TLS session, significantly reducing latency while maintaining the security guarantees of the original handshake.
2Reliability
If computational resources are allocated to handle all TLS connection requests, then service availability is maintained, but vulnerability to DDoS attacks increases
Solution Approach 1:
The patent implements a filtering mechanism that applies partial action by processing only a subset of connection requests through the full TLS handshake. A filter evaluates connection requests based on criteria such as source IP reputation, connection patterns, and session resumption eligibility, allowing legitimate traffic to proceed with optimized handshakes while blocking or rate-limiting malicious traffic before it consumes full computational resources.
Solution Approach 2:
The patent introduces an intermediary filtering layer between the network and the TLS processing infrastructure. This intermediary component analyzes connection requests and makes decisions about which requests should undergo full authentication, providing a buffer that protects the core TLS processing system from DDoS attacks while maintaining service availability for legitimate users.
3Object-affected harmful factors
If filtering mechanisms are implemented to block malicious traffic, then DDoS protection is enhanced, but false positives may block legitimate requests
Solution Approach 1:
The patent implements feedback mechanisms where the filtering system continuously monitors the outcomes of connection decisions. When legitimate traffic is incorrectly blocked (false positives), the system learns from these events and adjusts its filtering criteria to reduce future false positives. This feedback loop allows the system to maintain strong DDoS protection while improving its accuracy over time in distinguishing malicious from legitimate traffic.
Data Source
AI summary
A system to deliver an application, hosted by a private application provider, over a network to a user device comprising: an application delivery system that includes, a frontend network interface that includes at least one first traffic director (FTD) instance; a network security interface that includes a plurality of traffic processing server (TPS) instances; a backend network interface that includes at least one backend traffic director (BTD) instance; and at least one agent that is associated with the application and that is disposed within the private application provider system; wherein a federated TLS ticket is used to filter TLS connection requests received by an FTD instance; and wherein a TLS extension is used to filter TLS connection requests received by a BTD instance.