SYSTEMS AND METHODS FOR ENCODING THE CORE IDENTIFIER IN THE SESSION IDENTIFIER

• US 20100325419A1
• Filed: 06/22/2009
• Published: 12/23/2010
• Est. Priority Date: 06/22/2009
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Kanekar, Tushar
• Granted Patent: US 9,654,505 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 2209/043 of tables, e.g. lookup, substitution or mapping
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3271 : using challenge-response
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps

Abstract

The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.

Claims

1. A method of identifying a core establishing a secure socket layer (SSL) connection in a multi-core system via an SSL identifier, the method comprising:

a) receiving, by a packet engine executing on a core of a multi-core system, a request from a client to establish a secure socket layer (SSL) session, the core assigned a core identifier;

b) establishing, by the packet engine, a session identifier for the SSL session;

c) encoding, by the packet engine, the core identifier in the session identifier to form a second session identifier; and

d) establishing, by the packet engine responsive to the request, the SSL session with the client using the second session identifier.

2. The method of claim 1, wherein step (a) further comprises receiving, by the packet engine of the core of the multi-core system deployed as an intermediary between the client and a server, the request from the client to establish the SSL session with the server.

3. The method of claim 1, wherein step (a) further comprises assigning the core identifier based on an identifier of a processing unit.

4. The method of claim 1, wherein step (a) further comprises assigning the core a one-byte core identifier.

5. The method of claim 1, wherein step (b) further comprises generating, by the packet engine, the session identifier for the SSL connection.

6. The method of claim 1, wherein step (b) further comprises obtaining, by the packet engine, the session identifier from a server.

7. The method of claim 1, wherein step (c) further comprises encoding a byte of the session identifier with the core identifier to form the second session identifier.

8. The method of claim 1, wherein step (c) further comprises encoding with a block cipher the core identifier and a validity identifier with the session identifier to form the second session identifier.

9. The method of claim 1, wherein step (c) further comprises encoding the core identifier into a plurality of bits of the session identifier to form the second session identifier.

10. The method of claim 1, wherein step (c) further comprises determining, by the packet engine, at a predetermined frequency a predetermined set of one or more bytes of the session identifier to encode to form the second session identifier.

11. A method of determining an identifier of a core of a multi-core system via a Secure Socket Layer (SSL) session identifier, the method comprising:

a) receiving, by a packet engine executing on a core of a multi-core system, a request from a client via a secure socket layer (SSL) session, the request comprising a session identifier, the core assigned a core identifier;

b) decoding, by the packet engine, a second core identifier encoded in the session identifier; and

c) determining, by the packet engine, whether the second core identifier corresponds to the core identifier of the core.

12. The method of claim 11, wherein step (a) further comprises receiving, by the packet engine of the core of the multi-core system deployed as an intermediary between the client and a server, the request from the client to establish the SSL session with the server.

13. The method of claim 11, wherein step (a) further comprises assigning the core identifier to the core based on an identifier of a processing unit.

14. The method of claim 11, wherein step (a) further comprises assigning the core a one-byte core identifier.

15. The method of claim 11, wherein step (b) further comprises decoding a predetermined byte of the session identifier to obtain the second core identifier.

16. The method of claim 11, wherein step (b) further comprises decoding with a block cipher the second core identifier to obtain the session identifier.

17. The method of claim 11, wherein step (b) further comprises decoding the second core identifier from a plurality of bits of the session identifier.

18. The method of claim 11, wherein step (c) further comprises determining, by the packet engine, that the second core identifier does not correspond to the core identifier of the core, and responsive to the determination, sending a message to a second core identified by the second core identifier to obtain information about the SSL session.

19. The method of claim 18, further comprising establishing by the core a copy of the SSL session on the core based on the information about the SSL session obtained from the second core.

20. The method of claim 11, wherein step (c) further comprises determining, by the packet engine, that the second core identifier corresponds to the core identifier of the core, and responsive to the determining, forwarding the request to a server.