SYSTEMS AND METHODS FOR HANDLING SSL SESSION NOT REUSABLE ACROSS MULTIPLE CORES

• US 20100325420A1
• Filed: 06/22/2009
• Published: 12/23/2010
• Est. Priority Date: 06/22/2009
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Kanekar, Tushar
• Granted Patent: US 8,601,556 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 2209/043 of tables, e.g. lookup, substitution or mapping
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

The present invention is directed towards systems and methods for managing SSL session persistence and reuse in a multi-core system. A first core may indicate that an SSL session established by the first core is non-resumable. Responsive to the indication, the core may set an indicator at a location in memory accessible by each core of the multi-core system, the indicator indicating that the SSL session is non-resumable. A second core of the multi-core system may receive a request to reuse the SSL session. The request may include a session identifier of the SSL session. In addition, the session identifier may identify the first core as an establisher of the SSL session. The second core can identify from encoding of the session identifier whether the second core is not the establisher of the SSL session. Responsive to the identification, the second core may determine whether to resume the SSL session.

Claims

1. A method of identifying a not resumable SSL session among cores in a multi-core system, the method comprising:

a) identifying, by a first packet engine of a first core of a multi-core system, that an SSL session is not resumable;

b) setting, by the first packet engine responsive to the identification, at a location in memory accessible by a second core of the multi-core system, an indicator to indicate that the SSL session is not resumable;

c) receiving, by a second packet engine of a second core of the multi-core system, a request identifying the SSL session established by the first core,

d) identifying, by the second packet engine, that a core different from the second core established the SSL session; and

e) determining not to resume, by the second packet engine, the SSL session responsive to the identification.

2. The method of claim 1, wherein step (a) further comprises receiving, by the first packet engine of the first core of the multi-core system deployed as an intermediary between the client and a server, a notification that the SSL session is not resumable.

3. The method of claim 1, wherein step (a) further comprises determining, by the first packet engine of the first core of the multi-core system deployed as an intermediary between the client and a server, the SSL session is not resumable in accordance with a policy.

4. The method of claim 1, wherein step (b) further comprises storing, by the first packet engine, to the location in the memory a value for a resumable field associated with the SSL session as the indicator.

5. The method of claim 1, wherein step (c) further comprises determining, by a flow distributor of the multi-core system, to forward the request to the second core based on a source port indicated by the request.

6. The method of claim 1, wherein step (c) further comprises receiving the request comprising the session identifier identifying the first core as an establisher of the SSL session.

7. The method of claim 1, wherein step (d) further comprises decoding, by the second packet engine, a core identifier from a byte of the session identifier.

8. The method of claim 1, wherein step (d) further comprises determining, by the second packet engine, that the session identifier is not in a session cache of the second core.

9. The method of claim 1, wherein step (d) further comprises identifying, by the second packet engine, from a session identifier of the SSL session that the second core is not the establisher of the SSL session.

10. The method of claim 1, wherein step (e) further comprises removing, by the second packet engine, information about the SSL session from a session cache of the second core.

11. The method of claim 1, wherein step (e) further comprises establishing, by the second packet engine, a second SSL session responsive to the request.

12. The method of claim 1, wherein step (e) further comprises determining, by the second packet engine, whether a predetermined maximum reuse threshold has been reached.

13. A method of identifying an SSL session as not reusable among cores in a multi-core system, the method comprising:

a) indicating, by a first packet engine executing on a first core of a multi-core system, that an SSL session is not reusable;

b) identifying, by the first packet engine responsive to the indication, one or more core identifiers of one or more cores of the multi-core system that have requested session information for the SSL session;

c) transmitting, by the first packet engine, to each of the identified one or more cores of the multi-core system a message indicating that the SSL session is not reusable;

d) receiving, by a second packet engine of a second core of the multi-core system, a request to reuse the SSL session established by the first core, the request comprising a session identifier of the SSL session, the session identifier identifying the first core as an establisher of the SSL session;

e) identifying, by the second packet engine, from the session identifier that the second core is not the establisher of the SSL session; and

f) determining not to reuse, by the second packet engine, the SSL session based on the message from the first packet engine and the identification that the second core is not the establisher of the SSL session.

14. The method of claim 13, wherein step (a) further comprises receiving, by the first packet engine of the first core of the multi-core system deployed as an intermediary between the client and a server, a notification that the SSL session is not reusable.

15. The method of claim 13, wherein step (a) further comprises determining, by the first packet engine of the first core of the multi-core system deployed as an intermediary between the client and a server, the SSL session is not reusable in accordance with a policy.

16. The method of claim 13, wherein step (b) further comprises identifying, by the first packet engine, based on a bit pattern of data stored on the first core.

17. The method of claim 13, wherein step (b) further comprises identifying the one or more cores via core identifiers included in requests for session information for the SSL session.

18. The method of claim 13, wherein step (c) further comprises determining, by a flow distributor of the multi-core system, to forward the request to the second core based on a source port of the request.

19. The method of claim 13, wherein step (e) further comprises decoding, by the second packet engine, a core identifier from a byte of the session identifier.

20. The method of claim 13, wherein step (e) further comprises determining, by the second packet engine, that the session identifier is not in a session cache of the second core.

21. The method of claim 13, wherein step (f) further comprises removing, by the second packet engine, information about the SSL session from a session cache of the second core.

22. The method of claim 13, wherein step (f) further comprises establishing, by the second packet engine, a second SSL session responsive to the request.

23. The method of claim 13, wherein step (f) further comprises determining, by the second packet engine, whether a predetermined maximum reuse threshold has been reached.

24. A method of identifying an SSL session as not resumable among processors of a plurality of processors, the method comprising:

a) indicating, by a first processor of multiple processors, that an SSL session is not resumable;

b) setting, by the first processor responsive to the indication, an indicator at a location in memory accessible by each processor of the multiple processors, the indicator indicating that the SSL session is not resumable;

c) receiving, by a second processor of the multiple processors, a request to reuse the SSL session established by the first processor, the request comprising a session identifier of the SSL session, the session identifier identifying the first processor as an establisher of the SSL session;

d) identifying, by the second processor, from encoding of the session identifier that the second processor is not the establisher of the SSL session; and

e) determining not to resume, by the second processor, the SSL session responsive to accessing the indicator at the location.