Virtual Context Server for SSL Session Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional communication networks face challenges in transferring secure SSL/TLS sessions between different physical servers, leading to computational inefficiencies and difficulties in monitoring network traffic, especially in virtualized environments where server migration occurs.
Innovation Solution
The implementation of a virtualized SSL/TLS layer that stores and shares context information, including session identifiers, secrets, and states, between multiple servers, allowing seamless transfer of secure communication sessions across different physical and virtual servers while maintaining end-to-end security and visibility for monitoring devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional secure communication sessions are used between client and server, then security is maintained, but the session cannot be moved between physical servers without closing and opening a new session
Solution Approach 1:
A virtual context server is introduced as an intermediary component that stores and manages SSL/TLS session context information. This mediator enables session migration between physical servers by centralizing the storage of session state, allowing any server to access and continue an existing session without requiring the original server to remain active or reopen the session.
2Reliability
If secure communication sessions are established on each physical server, then security is maintained, but computational resources are consumed for session establishment and monitoring is difficult
Solution Approach 1:
The virtual context server provides multi-functional capabilities: it stores session context information, enables session migration, and provides a centralized interface for monitoring. This universal component serves multiple purposes that were previously handled by individual server instances, reducing overall computational overhead while maintaining security.
3Adaptability or versatility
If multiple virtual servers share the same physical server hardware, then resource utilization increases, but session transfer and monitoring become more complex
Solution Approach 1:
The session management function is segmented from the physical server hardware and consolidated into a separate virtual context server. This segmentation allows the session context to be independently managed and stored, simplifying the complexity of tracking sessions across multiple virtual servers while enabling flexible resource sharing.
Data Source
AI summary
In one embodiment, a method includes receiving at one of a plurality of servers, a request from a client for a secure communication session, storing context information associated with the secure communication session at a virtual context server in communication with the servers, and establishing the secure communication session between one of the servers and the client. The context information includes a session identifier, a secret, and a session state. The stored context information is available to the servers to allow the secure communication session to move between the servers. An apparatus for secure data transfer in a virtual environment is also disclosed.