Terminating SSL connections without locally-accessible private keys

Patent metadata

Field	Value
Publication number	US-11038854-B2
Application number	US-201715588907-A
Country	US
Kind code	B2
Filing date	May 8, 2017
Priority date	Dec 16, 2011
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

An Internet infrastructure delivery platform (e.g., operated by a service provider) provides an RSA proxy “service” as an enhancement to the SSL protocol that off-loads the decryption of the encrypted pre-master secret (ePMS) to an external server. Using this service, instead of decrypting the ePMS “locally,” the SSL server proxies (forwards) the ePMS to an RSA proxy server component and receives, in response, the decrypted pre-master secret. In this manner, the decryption key does not need to be stored in association with the SSL server.

First claim

What is claimed is as follows:

1. Apparatus that is a first machine located behind a firewall of an enterprise, the enterprise being a customer of a service provider that provides an acceleration service via an overlay network, comprising:
a processor;
computer memory holding program code configured to be executed by the processor, the program code configured as a client component of a split proxy server, the split proxy server also having a server component distinct from the client component and that executes on a second machine located remote from the first machine, the second machine located in a data center associated with the overlay network and managed by the service provider, comprising:
code operative in response to receipt of a handshake request from a client to determine whether a key exchange can be processed in part using a private key held in association with the server component of the split proxy server;
code operative in response to determining, based on information in a data structure, that the key exchange can be processed in part using the private key held in association with the server component of the split proxy server, to forward first information from the client component of the split proxy server to the server component of the split proxy server, the first information configured to be processed using the private key maintained in association with the server component of the split proxy server; and
code operative to receive a response from the server component of the split proxy server, the response including second information, the second information having been generated at the server component of the split proxy server by generating a hash of the first information, using the hash as an index into a cache, determining based on the hash whether first information is already present in the cache, when the first information is not already present in the cache, storing the first information in the cache and applying the private key maintained at the server component of the split proxy server to the first information;
wherein, following a successful completion of a handshake initiated by the handshake request, an application associated with the first machine is enabled to receive the acceleration service via the overlay network.

2. The apparatus as described in claim 1 wherein the first information is an encrypted pre-master secret and the second information is a decrypted pre-master secret, and wherein the program code further includes code to use the decrypted pre-master secret to generate a master secret.

3. The apparatus as described in claim 2 further including code to return the master secret to the client.

4. The apparatus as described in claim 2 wherein the pre-master secret is established using asymmetric Rivest-Shamir-Adelman (RSA).

5. The apparatus as described in claim 1 wherein the handshake request is one of: a Secure Sockets Layer (SSL) handshake request, and a Transport Layer Security (TLS) handshake request.

6. A method to secure a communication, comprising:
establishing a connection between a client component of a split proxy server executing on a first machine, and a server component of the split proxy server executing on a second machine, the first machine located behind a firewall of an enterprise, the enterprise being a customer of a service provider that provides an acceleration service via an overlay network, the second machine located in a data center associated with the overlay network and managed by the service provider, the second machine located remotely from the first machine;
receiving, by the client component of the split proxy server executing on the first machine, a handshake request;
upon receipt of the handshake request, determining, by the client component of the split proxy server, and based on information in a data structure, whether a key exchange associated with the handshake request can be processed in part using a private key that is held remotely and in association with the server component of the split proxy server;
based on determining that the handshake request can be processed in part by using the private key that is held remotely, proxying first information over the connection from the client component of the split proxy server to the server component of the split proxy server;
receiving from the server component of the split proxy server, over the connection, a response that includes second information, the second information having been generated at the server component of the split proxy server by generating a hash of the first information, using the hash as an index into a cache, determining based on the hash whether first information is already present in the cache, when the first information is not already present in the cache, storing the first information in the cache and applying the private key maintained at the server component of the split proxy server to the first information; and
using the second information to further the key exchange;
wherein, following a successful completion of a handshake initiated by the handshake request, an application associated with the first machine is enabled to receive the acceleration service via the overlay network.

7. The method as described in claim 6 wherein the handshake request is one of: a Secure Sockets Layer (SSL) handshake request, and a Transport Layer Security (TLS) handshake request.

8. The method as described in claim 6 wherein the first information is an encrypted pre-master secret, and the second information is the pre-master secret.

9. A system, comprising:
at least one machine in a first network-accessible location and that includes proxy server component software program that executes on hardware, the first network-accessible location being part of an overlay network that is managed by a service provider that provides an acceleration service via the overlay network;
at least one machine in a second network-accessible location and that includes a proxy client component software program that executes on hardware, the second network-accessible location being behind a firewall of an enterprise, the enterprise being a customer of the overlay network service provider;
the proxy server component software program and the proxy client component software program comprising a split proxy and each including code to establish and maintain a connection there-between;
the proxy client component software program configured to receive a handshake request from a client;
the proxy client component software program operative to determine, based on information in a data structure, whether a key exchange associated with the handshake request can be processed using a private key held remotely and in association with the proxy server component software program;
the proxy client component software program, upon determining that the secure handshake request can be processed using the private key held remotely, forwarding to the proxy server component software program over the connection first information;
the proxy server software program configured to receive the first information forwarded from the proxy client software program;
the proxy server component software program further configured to return a response to the proxy client software program over the connection, the response including second information, the second information having been generated at the proxy server component software program by receiving the first information, generating a hash of the first information, using the hash as an index into a cache, determining based on the hash whether first information is already present in the cache, when the first information is not already present in the cache, storing the first information in the cache and

Assignees

• Akamai Tech Inc

Inventors

• Gero Charles E
• Shapiro Jeremy N
• Burd Dana J

Classifications

• H04L63/166

  at the transport layer · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L63/0471 Primary

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title