Providing forward secrecy in a terminating TLS connection proxy

Patent metadata

Field	Value
Publication number	US-9531691-B2
Application number	US-201414573894-A
Country	US
Kind code	B2
Filing date	Dec 17, 2014
Priority date	Dec 16, 2011
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

An infrastructure delivery platform provides a RSA proxy service as an enhancement to the TLS/SSL protocol to off-load, from an edge server to an external cryptographic server, the decryption of an encrypted pre-master secret. The technique provides forward secrecy in the event that the edge server is compromised, preferably through the use of a cryptographically strong hash function that is implemented separately at both the edge server and the cryptographic server. To provide the forward secrecy for this particular leg, the edge server selects an ephemeral value, and applies a cryptographic hash the value to compute a server random value, which is then transmitted back to the requesting client. That server random value is later re-generated at the cryptographic server to enable the cryptographic server to compute a master secret. The forward secrecy is enabled by ensuring that the ephemeral value does not travel on the wire.

First claim

The invention claimed is:

1. A method to secure a communication among a client, a first server, and a second server, the first server holding a public certificate for a given domain, the public certificate having a public key of an asymmetric key pair, the second server holding a private key corresponding to the public key, comprising, as an ordered sequence at the first server:
during a cryptographic Transport Layer Security (TLS) or Secure Sockets Layer (SSL) handshake request received from the client, applying a cryptographic hash function to an ephemeral value to generate a server random value, and returning to the client the server random value and the public certificate;
receiving from the client a pre-master secret value encrypted with a public key of the public certificate, together with a client random value;
transmitting to the second server the encrypted pre-master secret, together with the ephemeral value and the client random value;
purging from memory the ephemeral value;
receiving from the second server a master secret, the master secret having been generated at the second server by ordered sub-steps of (i) applying the cryptographic hash function to the ephemeral value to re-compute the server random value, (ii) decrypting the encrypted pre-master secret using the private key to recover the pre-master secret, and then (iii) applying a given function to the client random value, the server random value, and the pre-master secret to generate the master secret; and completing the TLS/SSL handshake between the the first server and the client using the master secret received from the second server.

2. The method as described in claim 1 wherein the ephemeral value is purged immediately following transmitting the ephemeral value to the second server.

3. The method as described in claim 1 wherein the cryptographic hash function is a key derivation function.

4. The method as described in claim 3 wherein the key derivation function is a one-way function.

5. The method as described in claim 1 wherein the given function is a TLS pseudorandom function (PRF).

6. The method as described in claim 1 further including establishing a persistent connection from the first server to the second server.

7. The method as described in claim 1 wherein the ephemeral value is a random number.

8. An apparatus in an overlay network edge server, comprising:
at least one hardware processor;
computer memory holding computer program instructions executed by the hardware processor, the computer program instructions during a Transport Layer Security (TLS) or Secure Sockets Layer (SSL) handshake from a client to perform the following ordered operations: (i) select an ephemeral value, (ii) apply a one-way function to the ephemeral value to generate a server random value, (iii) return to the client the server random value and a public certificate holding a public key of a key pair; (iv) receive from the client an encrypted pre-master secret and a client random value; (v) forward to a cryptographic server the encrypted pre-master secret, a random value received from the client, and the ephemeral value; (vi) purge the ephemeral value; (vii) receive from the cryptographic server a master secret, the master secret having been generated at the cryptographic server by ordered sub-steps of: (a) applying the one-way function to the ephemeral value to re-compute the first server random value, (b) decrypting the encrypted pre-master secret using a private key of the key pair to recover the pre-master secret, and then (c) applying a given function to the client random value, the server random value, and the pre-master secret to generate the master secret; and (viii) complete the TLS/SSL handshake to the client using the master secret received from the cryptographic server.

9. The apparatus as described in claim 8 wherein the computer program instructions compute a pair of symmetric keys from the master secret.

10. The apparatus as described in claim 8 wherein the computer program instructions receive derivative data computed at the cryptographic server from the master secret.

11. The apparatus as described in claim 8 wherein the computer program instructions establish and maintain a persistent connection to the cryptographic server.

12. The apparatus as described in claim 8 wherein the ephemeral value is a random number.

13. An apparatus in an overlay network cryptographic server, comprising:
at least one hardware processor;
computer memory holding computer program instructions executed by the hardware processor, the computer program instructions during a Transport Layer Security (TLS) or Secure Sockets Layer (SSL) handshake from a client to an edge server to perform the following ordered operations:
(i) receive from the edge server an encrypted pre-master secret, a random value received at the edge server from the client, and an ephemeral value, the ephemeral value having been generated at the edge server in response to receipt of a TLS/SSL handshake request and used to compute a server random value, the server random value having been generated at the edge server by applying a one-way function to the ephemeral value, the server random value having been used by the client together with a public key of a key pair to generate the pre-master secret, the ephemeral value having been purged from memory of the edge server following its transmission from the edge server;
(ii) generate a master secret by ordered sub-steps of: (a) applying the one-way function to the ephemeral value to re-create the server random value, (b) decrypting the encrypted pre-master secret using a private key of the key pair to recover the pre-master secret, and then (c) applying a given function to the client random value, the server random value, and the pre-master secret; and
(iii) return the master secret to the edge server to enable the edge server to complete the TLS/SSL handshake to the client.

14. The apparatus as described claim 13 wherein the computer program instructions maintain a persistent connection to the edge server.

Assignees

• Akamai Tech Inc

Inventors

• Gero Charles E
• Lisiecki Philip A

Classifications

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L2209/76

  Proxy, i.e. using intermediary entity to perform cryptographic operations · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title