Secure communication session resumption in a service function chain

#The present technology relates generally to secure communication sessions, and more specifically relates to the resumption of Transport Layer Security (TLS) sessions without performing a full TLS handshake.

#In a session between an endpoint client and an endpoint server secured with the Transport Layer Security (TLS) protocol, one or more Service Function (SF) nodes may act upon the traffic in the session to provide a service function (e.g. firewall, intrusion detection/prevention, traffic compression, etc.). The Service Function node will typically interpose itself into the secure TLS session and create two separate TLS session by acting as a proxy server for the endpoint client and acting as a proxy client for the endpoint server. The TLS session between the endpoint client and the Service Function node is associated with a unique set of cryptographic keys, generated during a TLS handshake. In some embodiments, multiple Service Function nodes can be interposed into the secure TLS session, creating a Service Function Chain (SFC).

#If the endpoint client disconnects from the TLS session, it may still retain a copy of the unique set of cryptographic keys. In order to resume the TLS session, the endpoint client must reconnect to the same Service Function node and provide its copy of the unique set of cryptographic keys. In this manner, a full TLS handshake is avoided. If the endpoint client attempts to present its copy of the unique set of cryptographic keys to a different Service Function node, the connection request will be a rejected and a new full TLS handshake will have to be performed.

#In order to describe the manner in which the above-recited and other advantages and features of the disclosure can be obtained, a more particular description of the principles briefly described above will be rendered by reference to specific examples thereof which are illustrated in the appended drawings. Understanding that these drawings depict only examples of the disclosure and are not therefore to be considered to be limiting of its scope, the principles herein are described and explained with additional specificity and detail through the use of the accompanying drawings in which:

#FIG. 1 depicts a diagram of a network system in which embodiments of the present disclosure may operate;

#FIG. 2 depicts a ladder diagram of the underlying message exchanged involved in a TLS handshake;

#The detailed description set forth below is intended as a description of various configurations of the subject technology and is not intended to represent the only configurations in which the subject technology can be practiced. The appended drawings are incorporated herein and constitute a part of the detailed description. The detailed description includes specific details for the purpose of providing a more thorough understanding of the subject technology. However, it will be clear and apparent that the subject technology is not limited to the specific details set forth herein and may be practiced without these details. In some instances, structures and components are shown in block diagram form in order to avoid obscuring the concepts of the subject technology.

#Transport Layer Security, or TLS, is a cryptographic protocol used to provide secured communications between two computing devices, such as a client and a server. First standardized in 1999 as TLS 1.0, the TLS protocol has continued to be developed and updated in order to keep pace with the ever-increasing importance of security and encryption in the modern world. The previous version, TLS 1.2, has been subject to an increasing number of attacks, and the most recent version, TLS 1.3, was introduced in order to address these flaws and provide an overall enhanced security experience.

#In order to establish a TLS session between a client and a server, a TLS handshake is performed in order to establish shared cryptographic keys. These shared cryptographic keys are typically uniquely associated with both the TLS session and the client/server devices themselves. As such, if a client wishes to resume a TLS session, the original cryptographic keys can be used to identify the originating server and forward the client resume request accordingly. The original cryptographic keys can then be used to resume the TLS session without having to perform a TLS handshake, reducing latency and increasing efficiency.