This document describes, among other things, systems and methods for more efficiently resuming a
client-to-origin TLS session through a proxy layer that fronts the origin in order to provide
network security services. At the time of an initial TLS
handshake with an unknown
client, for example, the proxy can perform a set of security checks. If the
client passes the checks, the proxy can transmit a ‘proxy token’ upstream to the origin. The origin can incorporate this token into
session state data which is passed back to and stored on the client, e.g., using a TLS session
ticket extension field, pre-shared key extension field, or other field. On TLS session resumption, when the client sends the
session state data, the proxy can recover its proxy token from the
session state data, and upon successful validation, bypass security checks that it would otherwise perform against the client, thereby more efficiently handling known clients.