TLS Session Ticket Client Identity Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of clients increases, application servers face unequal loads and increased complexity, leading to potential vulnerabilities and challenges in secure communication, particularly with the use of load balancers which can relay information between clients and application servers, making it difficult to directly communicate and manage client identities across multiple connections.
Innovation Solution
Creating a session identifier that combines session information and client identification information, allowing for secure connection resumption and correlation of client actions across multiple connections, thereby identifying and managing client identities effectively, such as through the use of TLS session tickets and IDs, to prevent activities like sock puppeting and click fraud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If load balancers are used to distribute load and terminate secure communication protocols, then the vulnerability of application servers is reduced and load is distributed evenly, but the complexity of managing client identities and secure connections increases
Solution Approach 1:
The patent uses TLS session tickets as an intermediary mechanism that carries client identification information between the load balancer and application servers. This allows the load balancer to terminate secure connections while still enabling application servers to identify and track client identities without direct communication with clients, thus resolving the contradiction between security and connection management complexity
Solution Approach 2:
The patent segments the secure connection management into two parts: the load balancer handles TLS handshake and session resumption using session tickets, while application servers handle client identification using the information embedded in these tickets. This segmentation allows each component to focus on specific functions, reducing overall system complexity while maintaining security
2Productivity
If the number of application servers is increased to service more clients, then the capacity to serve clients is improved, but the complexity and vulnerability of the system increases
Solution Approach 1:
The patent uses TLS session tickets as reusable copies that contain client identification information. Instead of maintaining complex state information about each client connection across multiple servers, the system uses these self-contained ticket copies that can be exchanged between servers, enabling horizontal scalability without proportionally increasing system complexity
Solution Approach 2:
The session ticket acts as an intermediary data structure that simplifies communication between load balancers and application servers. It encapsulates the necessary client identification information in a standardized format, allowing new servers to join the system without requiring complex integration or reconfiguration, thus improving productivity while controlling complexity
3Power
If TLS session resumption is used to reduce computational load, then the processing requirements are reduced, but the ability to correlate client actions across multiple connections becomes more difficult
Solution Approach 1:
The patent merges client identification information with TLS session resumption by embedding client identifiers within the session ticket structure. This allows the system to benefit from computational savings of session resumption while simultaneously maintaining the ability to correlate client actions across multiple connections, as the same session ticket can be presented in subsequent connections
Data Source
AI summary
A session identifier is used during negotiation of a secure connection between a client and an endpoint that includes both session information and client identification information. For example, a client connects to a load balancer using transport layer security (TLS). The load balancer may pass client information, such as session information, on to an application server that determines client information to put in a TLS session identifier. The application may send the client information to include in the TLS session identifier back to the load balancer. The load balancer may combine TLS session information for resuming TLS communications and client information for identifying the client into the session identifier. The session identifier may be passed to the client for use in later communication. TLS negotiation between the client and the load balancer may be completed and a secure connection begun. The application may monitor actions performed by the client.