Dynamic updates to a network server
View Patent ↗Techniques are disclosed for configuring a server to establish a secure network communication session. An application monitors one or more resource utilization metrics of the server. Upon determining that at least one of the monitored resource metrics satisfies a specified condition, an optimization algorithm is selected based on the resource metrics and a configuration of the server. The optimization algorithm determines an updated configuration of the server while maintaining the security at par or better. The selected optimization algorithm is performed to modify determine the updated configuration of the server. Once determined, the application applies the updated configuration to the server.
1. A method for managing network communication sessions on a server, the method comprising:
monitoring one or more resource utilization metrics of the server;
upon determining that at least one of the monitored resource metrics satisfies a specified condition, selecting an optimization algorithm based on the resource metrics and a configuration of the server, wherein the optimization algorithm determines an updated configuration of the server used in establishing secure network communication sessions;
performing the selected optimization algorithm to determine the updated configuration of the server, wherein the updated configuration of the server includes an update to one or more of a preferred cipher suite, a preferred digital certificate type, a session resumption validity interval, and a length of cryptographic keys generated by the server used in establishing secure network communication sessions; and
applying the updated configuration to the server.
2. The method of claim 1 , wherein applying the updated configuration modifies the preferred cipher suite of the server from an RSA-based cipher suite to an elliptic curve cryptography (ECC)-based cipher suite and modifies the preferred digital certificate type from an RSA-based digital certificate to an ECC-based digital certificate.
3. The method of claim 1 , wherein applying the updated configuration modifies the length of the cryptographic keys or the session resumption validity interval.
4. The method of claim 1 , wherein the network communication is established by a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) handshake protocol.
5. The method of claim 1 , wherein the resource utilization metrics include at least one of an average CPU utilization, network I/O statistics, memory usage statistics, and cache utilization.
6. The method of claim 1 , wherein selecting the optimization algorithm comprises:
estimating resource usage limitations that would result from performing each one of a plurality of optimization algorithms to the server;
identifying, from the plurality, one of the optimization algorithms based on the estimated resource usage limitations and the configuration of the server; and
persisting the estimated resource usage limitations.
7. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for managing network communication sessions on a server, the operation comprising:
monitoring one or more resource utilization metrics of the server;
upon determining that at least one of the monitored resource metrics satisfies a specified condition, selecting an optimization algorithm based on the resource metrics and a configuration of the server, wherein the optimization algorithm determines an updated configuration of the server used in establishing secure network communication sessions;
performing the selected optimization algorithm to determine the updated configuration of the server, wherein the updated configuration of the server includes an update to one or more of a preferred cipher suite, a preferred digital certificate type, a session resumption validity interval, and a length of cryptographic keys generated by the server used in establishing secure network communication sessions; and
applying the updated configuration to the server.
8. The non-transitory computer-readable storage medium of claim 7 , wherein applying the updated configuration modifies the preferred cipher suite of the server from an RSA-based cipher suite to an elliptic curve cryptography (ECC)-based cipher suite and modifies the preferred digital certificate type from an RSA-based digital certificate to an ECC-based digital certificate.
9. The non-transitory computer-readable storage medium of claim 7 , wherein applying the updated configuration modifies the length of the cryptographic keys or the session resumption validity interval.
10. The non-transitory computer-readable storage medium of claim 7 , wherein the network communication is established by a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) handshake protocol.
11. The non-transitory computer-readable storage medium of claim 7 , wherein the resource utilization metrics include at least one of an average CPU utilization, network I/O statistics, memory usage statistics, and cache utilization.
12. The non-transitory computer-readable storage medium of claim 7 , wherein selecting the optimization algorithm comprises:
estimating resource usage limitations that would result from performing each one of a plurality of optimization algorithms to the server;
identifying, from the plurality, one of the optimization algorithms based on the estimated resource usage limitations and the configuration of the server; and
persisting the estimated resource usage limitations.
13. A system, comprising:
a processor; and
a memory storing one or more application programs configured to perform an operation for managing network communication sessions on a server, the operation comprising:
monitoring one or more resource utilization metrics of the server,
upon determining that at least one of the monitored resource metrics satisfies a specified condition, selecting an optimization algorithm based on the resource metrics and a configuration of the server, wherein the optimization algorithm determines an updated configuration of the server used in establishing secure network communication sessions,
performing the selected optimization algorithm to determine the updated configuration of the server, wherein the updated configuration of the server includes an update to one or more of a preferred cipher suite, a preferred digital certificate type, a session resumption validity interval, and a length of cryptographic keys generated by the server used in establishing secure network communication sessions, and
applying the updated configuration to the server.
14. The system of claim 13 , wherein applying the updated configuration modifies the preferred cipher suite of the server from an RSA-based cipher suite to an elliptic curve cryptography (ECC)-based cipher suite and modifies the preferred digital certificate type from an RSA-based digital certificate to an ECC-based digital certificate.
15. The system of claim 13 , wherein applying the updated configuration modifies the length of the cryptographic keys or the session resumption validity interval.
16. The system of claim 13 , wherein the resource utilization metrics include at least one of an average CPU utilization, network I/O statistics, memory usage statistics, and cache utilization.
17. The system of claim 13 , wherein selecting the optimization algorithm comprises:
estimating resource usage limitations that would result from performing each one of a plurality of optimization algorithms to the server;
identifying, from the plurality, one of the optimization algorithms based on the estimated resource usage limitations and the configuration of the server; and
persisting the estimated resource usage limitations.