Handshake Manager for TLS Memory Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microcontrollers with limited RAM struggle to support multiple concurrent Transport Layer Security (TLS) connections due to memory-intensive handshake processes, which can exhaust available resources, especially when handling HTTPS and cloud connectivity.
Innovation Solution
Implementing a handshake manager that handles TLS handshake requests in a round-robin fashion, allowing only one handshake at a time and reusing handshake memory for multiple connections, combined with efficient buffer management for HTTPS requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple concurrent TLS connections are established on a microcontroller, then communication security and protocol compliance are improved, but memory consumption increases and resource exhaustion occurs
Solution Approach 1:
The patent merges multiple TLS handshake operations into a single unified handshake process. The handshake manager consolidates authentication steps for multiple connections, allowing the microcontroller to perform one comprehensive handshake that establishes multiple secure connections simultaneously, rather than executing separate handshakes for each connection. This reduces memory consumption during the authentication phase.
Solution Approach 2:
The handshake manager is designed as a universal component that handles TLS handshakes for multiple different protocols and connections through a single interface. It can manage HTTPS, MQTT, and other TLS-based protocols using the same memory resources and authentication logic, making the system more versatile while reducing overall memory requirements compared to having separate handshake implementations for each protocol.
2Reliability
If standard TLS handshake processes are executed for each connection, then authentication security is maintained, but processing time increases and system efficiency decreases
Solution Approach 1:
The handshake manager performs preliminary authentication actions by consolidating the verification of certificates and establishment of encryption parameters for multiple connections in advance. During the unified handshake process, it pre-computes authentication results that can be reused across multiple connections, reducing the time required for subsequent connection establishments while maintaining security requirements.
Solution Approach 2:
The patent implements continuous handshake management where the handshake manager maintains an active state that continuously processes authentication requests without requiring full re-initialization for each connection. This continuous operation allows the system to maintain secure connections more efficiently by avoiding repeated setup overhead while ensuring authentication security is continuously validated.
Data Source
AI summary
Embodiments of the present disclosure include a system for performing authentication. The system can include a computing device comprising processor resources and memory resources, the memory resources storing computer-readable instructions that can be executed by the processor resources to perform various functions. In some embodiments, instructions can be executed by the processor to receive, with a transport layer security stack, a first transport layer security request from a first internal communication endpoint task and a second transport layer security request from a second internal communication endpoint task, wherein the first transport layer security request is related to establishing a secure connection with a first external communication endpoint and the second transport layer security request is related to establishing a secure connection with a second external communication endpoint. In some embodiments, instructions can be executed by the processor to perform a first series of authentication steps with the server related to the first transport layer security request. In some embodiments, instructions can be executed by the processor to determine whether to establish the secure connection between the first external communication endpoint and the server in response to completion of the first series of authentication steps. In some embodiments, instructions can be executed by the processor to perform a second series of authentication steps with the server related to the second transport layer security request, in response to completion of the first series of authentication steps.