TLS Session Ticket Mechanism for Cacheless Resumption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing TLS inspection methods face scalability issues and performance bottlenecks due to the need for session caching, which is vulnerable to denial-of-service attacks and limited by storage and memory constraints, especially when handling SSL/TLS communications that predominantly use server authentication without client authentication.
Innovation Solution
A network-based appliance generates a new session ticket that embeds the original session ID, allowing the TLS client to maintain the session context, eliminating the need for a local session cache at the inspector and enabling cacheless TLS session resumption by encrypting and decrypting the session ticket to securely resume TLS connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session caching is implemented to support TLS session resumption, then session resumption functionality is achieved, but scalability is limited and the system becomes vulnerable to denial-of-service attacks
Solution Approach 1:
The patent extracts the session state from the inspector's memory and embeds it into a session ticket that is stored and managed by the client. This removes the scalability bottleneck and vulnerability to DoS attacks from the inspector, while preserving session resumption functionality. The session ticket contains all necessary session information that would otherwise be cached by the inspector.
Solution Approach 2:
The session ticket acts as an intermediary carrier between the server and client for session state transmission. Instead of the inspector maintaining session state, the ticket serves as a portable session container that enables resumption without requiring inspector-side caching, thus resolving the scalability contradiction.
2Reliability
If session caching is implemented to support TLS session resumption, then session resumption functionality is achieved, but memory consumption increases due to storage constraints
Solution Approach 1:
The patent extracts session state from the inspector's memory and places it into a session ticket managed by the client. This eliminates the need for the inspector to allocate memory for session caching, directly reducing memory footprint while maintaining session resumption capability.
Solution Approach 2:
The client takes responsibility for storing and managing its own session tickets, rather than relying on the inspector's memory resources. This self-service approach allows the inspector to operate with minimal memory requirements while clients maintain their own session state locally.
3Reliability
If session caching is implemented to support TLS session resumption, then session resumption functionality is achieved, but performance bottlenecks occur due to cache lookup requirements
Solution Approach 1:
The patent removes the cache lookup operation from the inspector's workflow by extracting session state into client-managed tickets. During inspection, the inspector receives already-validated session tickets from the client, eliminating the need for time-consuming cache lookups and improving inspection performance.
Solution Approach 2:
Session state validation is performed in advance when the session ticket is created and signed by the server. This preliminary validation eliminates the need for repeated verification during session resumption, reducing processing time and improving inspector performance.
Data Source
AI summary
A network-based appliance includes a mechanism to provide TLS inspection with session resumption, but without requiring that a session cache be maintained. To this end, the inspector is configured to cause the TLS client to participate in maintaining the session context, in effect on behalf of the TLS inspector. In operation, when the inspector first receives a session ID from the TLS server, the inspector generates and issues to the client a session ticket that includes the original session ID and other session context information. In this manner, the inspector converts the Session ID-based connection to a Session Ticket-based connection. The session ticket is encrypted by the inspector to secure the session information. When the TLS client presents the session ticket to resume the TLS connection, the inspector decrypts the ticket and retrieves the session ID from it directly. The inspector then uses the original session ID to resume the TLS session.