Live TLS Connection Migration via TCP Socket Handle Transfer

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In client-server architectures, planned upgrades or maintenance of reverse proxy servers often result in service outages due to the need to break existing connections between clients and servers, and there is a challenge in handling in-transit data during these processes without losing or mismanaging it.

Innovation Solution

A method that migrates a server instance by transferring TCP socket handles and negotiating new encryption keys between clients and new applications, allowing seamless communication without breaking TCP connections, using techniques like message peeking and control messages to manage in-transit data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the reverse proxy server is upgraded or maintained by taking down existing connections, then the server instance can be updated, but service availability degrades due to outages

Engineering Contradiction:

Improveservice availabilityVSAvoidease of server maintenance

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The system performs preliminary actions by establishing a new application instance and transferring TCP socket handles before taking down the old instance. This allows the migration to occur with minimal disruption, as clients can be gradually redirected to the new instance while the old one is still operational

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically migrates connections from the old application instance to the new one by transferring TCP socket handles. This dynamic approach allows the system to adaptively shift traffic during the upgrade process, maintaining service availability while enabling server maintenance

Inventive Principle:

Principle #15Dynamics

2Reliability

If existing connections are broken during server upgrade, then the old instance can be replaced, but in-transit data is lost or mismanaged

Engineering Contradiction:

Improvedata integrityVSAvoidmigration efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system uses the TCP socket handle as an intermediary mechanism to transfer connection state from the old application instance to the new one. This intermediary approach ensures that in-transit data is properly managed during migration, as the socket handle maintains the connection context while enabling the transition between instances

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system maintains continuity of useful action by preserving TCP connections during migration. Clients continue their communication sessions without interruption, and in-transit data is handled seamlessly as the connection state is transferred rather than broken, ensuring both data integrity and migration efficiency

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS11122019B2Systems and methods for client collaborated migration of live TLS connection

Publication Date: 2021.09.14 ORACLE INT CORP

AI summary

Described is an improved approach to ensure high availability for established sessions (e.g., application layer sessions) over network connections that negotiates and renegotiates encryption keys (e.g., TLS/SSL) at clean boundaries to ensure in-transit data are properly handled during migration of an application (e.g., a reverse proxy server instance). Connected TCP sessions may be handed off to another application (e.g., from existing proxy server to new/upgraded proxy server) and after establishing a new TLS session with a new encryption key, data transfer may be resumed between a client and a server using the new/upgraded application in a client-server architecture.