TLS Memory Footprint Reduction via Handshake State Release
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Transport Layer Security (TLS) protocol's handshake sub-protocol has a large memory footprint that remains occupied even after a connection is established, limiting the number of concurrent connections that can be supported without increasing memory hardware.
Innovation Solution
A memory-efficient implementation of TLS that allocates and releases memory space efficiently between the handshake and record sub-protocols, allowing the handshake state machine's memory to be recycled and reused for other connections, reducing the memory footprint by 15-20 times after the handshake is completed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory is allocated for TLS handshake state machine to establish secure connections, then connection security and reliability are improved, but memory footprint increases and limits the number of concurrent connections
Solution Approach 1:
The patent applies the discarding and recovering principle by releasing the handshake state machine memory after the TLS connection is established. The system allocates memory for the handshake state machine during connection setup, completes the handshake protocol, then discards the now-unnecessary handshake state machine and recovers the memory for reuse by other connections. This resolves the contradiction by maintaining connection security through proper handshake completion while reducing memory footprint by eliminating obsolete handshake structures.
2Productivity
If memory is allocated for handshake sub-protocol infrastructure to facilitate connection establishment, then connection setup capability is improved, but available memory for other connections decreases
Solution Approach 1:
The patent applies the dynamics principle by making the memory allocation dynamic rather than static. The system allocates sufficient memory for the handshake sub-protocol infrastructure when needed during connection establishment, then releases that memory after the handshake completes. This dynamic allocation allows the system to have full connection establishment capability when required while maximizing available memory for other connections at other times, resolving the contradiction between establishment capability and available memory.
3Reliability
If large memory blocks are allocated for each TLS connection to ensure all handshake and communication needs, then connection reliability is improved, but the number of supported concurrent connections is reduced
Solution Approach 1:
The patent applies the segmentation principle by dividing the TLS connection memory requirements into distinct phases: handshake phase and communication phase. During the handshake phase, sufficient memory is allocated to ensure reliable connection establishment. After the handshake completes, the system segments the memory usage by releasing the handshake-specific memory while retaining only the essential communication memory. This segmentation allows reliable connections to be established while maximizing the number of concurrent connections by minimizing persistent memory usage per connection.
Data Source
AI summary
For connection establishment, a system allocates memory that will be occupied by the data and handshake sub-protocol infrastructure that facilitates establishing a TLS connection. After connection establishment, the system allocates memory space for the data and record sub-protocol infrastructure that facilitates the asynchronous communication of application traffic. The memory space for the TLS session (i.e., the communication information separate from the handshake) has a substantially smaller footprint than the memory space for the TLS handshake. The TLS handshake memory space can be released and recycled for other connections while application communications use the smaller memory space allocated and populated with the TLS session data and infrastructure.