Systems and methods for client collaborated migration of live TLS connection
Described is an improved approach to ensure high availability for established sessions (e.g., application layer sessions) over network connections that negotiates and renegotiates encryption keys (e.g., TLS/SSL) at clean boundaries to ensure in-transit data are properly handled during migration of an application (e.g., a reverse proxy server instance). Connected TCP sessions may be handed off to another application (e.g., from existing proxy server to new/upgraded proxy server) and after establishing a new TLS session with a new encryption key, data transfer may be resumed between a client and a server using the new/upgraded application in a client-server architecture.
1. A method comprising:
maintaining a client-server architecture, the client-server architecture comprising a client, a server, and an intermediate server running a first application for handling messages transmitted between the client and the server, wherein the messages transmitted between the client and the intermediate server are secured using an encryption key over a first TCP connection and the messages transmitted between the intermediate server and the server are over a second TCP connection;
initiating a move from the first application to a second application;
transferring a TCP socket handle used by the first application to the second application by at least detecting a negotiation message sent from the client to the first application;
negotiating a new encryption key between the client and the second application; and
processing the messages between the client and the second application using the new encryption key by having the second application receive messages using the TCP socket handle transferred from the first application.
2. The method of claim 1 , wherein the negotiation message is detected using a TCP message peek function.
3. The method of claim 1 , wherein the move from the first application to the second application is a migration from a first version of an application to a second version of the application, the first version and the second version being different versions.
4. The method of claim 1 , wherein the first application and the second application are reverse proxy servers.
5. The method of claim 1 , further comprising stopping acknowledgement receipts from being sent to the server in response to the move being initiated, wherein the acknowledgement receipts correspond to messages that are sent from the server to the first application.
6. The method of claim 5 , further comprising sending a control message to the client in response to the move being initiated, wherein the control message informs the client that the first application is undergoing the move.
7. The method of claim 6 , wherein the negotiation message initiates the negotiation of the new encryption key between the client and the second application.
8. A system comprising:
a processor; and
a memory to hold a set of program code instructions, in which the set of program code instructions comprises program code to perform: maintaining a client-server architecture, the client-server architecture comprising a client, a server, and an intermediate server running a first application for handling messages transmitted between the client and the server, wherein the messages transmitted between the client and the intermediate server are secured using an encryption key over a first TCP connection and the messages transmitted between the intermediate server and the server are over a second TCP connection, initiating a move from the first application to a second application, transferring a TCP socket handle used by the first application to the second application by at least detecting a negotiation message sent from the client to the first application, negotiating a new encryption key between the client and the second application, and processing the messages between the client and the second application using the new encryption key by having the second application receive messages using the TCP socket handle transferred from the first application.
9. The system of claim 8 , wherein the negotiation message is detected using a TCP message peek function.
10. The system of claim 8 , wherein the move from the first application to the second application is a migration from a first version of an application to a second version of the application, the first version and the second version being different versions.
11. The system of claim 8 , wherein the first application and the second application are reverse proxy servers.
12. The system of claim 8 , wherein the set of program code instructions further comprises program code to stop acknowledgement receipts from being sent to the server in response to the move being initiated, wherein the acknowledgement receipts correspond to messages that are sent from the server to the first application.
13. The system of claim 12 , wherein the set of program code instructions further comprises program code to send a control message to the client in response to the move being initiated, wherein the control message informs the client that the first application is undergoing the move.
14. The system of claim 13 , wherein the negotiation message initiates the negotiation of the new encryption key between the client and the second application.
15. A computer program product including a non-transitory computer readable medium having instructions which, when executed by a processor, causes the processor to perform a process, the process comprising:
maintaining a client-server architecture, the client-server architecture comprising a client, a server, and an intermediate server running a first application for handling messages transmitted between the client and the server, wherein the messages transmitted between the client and the intermediate server are secured using an encryption key over a first TCP connection and the messages transmitted between the intermediate server and the server are over a second TCP connection;
initiating a move from the first application to a second application;
transferring a TCP socket handle used by the first application to the second application by at least detecting a negotiation message sent from the client to the first application;
negotiating a new encryption key between the client and the second application; and
processing the messages between the client and the second application using the new encryption key by having the second application receive messages using the TCP socket handle transferred from the first application.
16. The computer program product of claim 15 , wherein the negotiation message is detected using a TCP message peek function.
17. The computer program product of claim 15 , wherein the move from the first application to the second application is a migration from a first version of an application to a second version of the application, the first version and the second version being different versions.
18. The computer program product of claim 15 , wherein the first application and the second application are reverse proxy servers.
19. The computer program product of claim 15 , further comprising instructions to cause the processor to stop acknowledgement receipts from being sent to the server in response to the move being initiated, wherein the acknowledgement receipts correspond to messages that are sent from the server to the first application.
20. The computer program product of claim 19 , further comprising instructions to cause the processor to send a control message to the client in response to the move being initiated, wherein the control message informs the client that the first application is undergoing the move.
21. The computer program product of claim 20 , wherein the negotiation message initiates the negotiation of the new encryption key between the client and the second application.