Cloud Caching via TLS Session Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud caching is hindered in HTTPS-enabled communication systems due to encryption, as traditional caching methods cannot work with authenticated TLS/TCP sessions, and distributing secret encryption keys across caching nodes is problematic, leading to latency and service interruptions in streamed web services.
Innovation Solution
Migrating an already authenticated TLS/TCP session from a primary network node to a secondary node within the system, allowing for secure and seamless transfer of HTTPS/TLS sessions without re-authentication, thus enabling cloud caching without distributing HTTPS certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional caching methods are used in HTTPS-enabled systems, then caching functionality can be provided, but encryption prevents traditional caching from working with authenticated TLS/TCP sessions
Solution Approach 1:
The patent introduces a session migration mechanism where the primary server acts as an intermediary that transfers authenticated TLS sessions to cache nodes. The primary server establishes the initial authenticated connection with the client, then migrates the session state to secondary cache nodes, allowing them to serve cached content without requiring separate authentication. This mediator approach enables caching functionality while preserving the security and reliability of original TLS authentication.
2Adaptability or versatility
If secret encryption keys are distributed across caching nodes, then caching can be enabled, but key distribution is problematic and creates security risks
Solution Approach 1:
The patent extracts the cryptographic key management function from the cache nodes and centralizes it at the primary server. Instead of distributing secret encryption keys to caching nodes, the system separates key storage (at the primary server) from caching operations (at secondary nodes). The primary server holds the authenticated session state and can migrate it to cache nodes without exposing the actual cryptographic keys, thus enabling caching capability while eliminating key distribution security risks.
3Speed
If cloud caching is implemented without session migration, then caching speed can be improved, but latency and service interruptions occur in streamed web services
Solution Approach 1:
The patent performs preliminary authentication and session establishment at the primary server before content delivery. The authenticated TLS session is set up in advance, and then the session state is migrated to cache nodes before actual content streaming begins. This preliminary action ensures that when cached content is delivered, no additional authentication latency occurs, eliminating service interruptions and reducing overall latency while maintaining high caching speed.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
In a method in a primary network node for providing a web-service to clients, performing the steps of verifying (S1) a TCP session with a client node and generating TLS keys for said session. Subsequently temporarily suspending (S2) the TCP session. Finally, controlling migrating (S3) said TCP session and the generated TLS keys for the client node to a secondary network node for resumption of the session with the client node.