CDN Node Offloading SSL Handshake Private Key Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the Content Delivery Network (CDN) service architecture, service servers face challenges in providing secure SSL handshakes due to confidentiality requirements and high CPU resource consumption during SSL handshake processes, especially under high concurrency conditions.
Innovation Solution
A method and system where a CDN node determines the target service server and sends a private key processing request to a private key server, which processes the information using the target private key and sends the result back to the CDN node to continue the SSL handshake, thereby offloading private key processing and ensuring security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the service server performs SSL handshake directly with the terminal, then the security of data transmission is ensured, but the CPU processing resources are consumed significantly and the service server cannot provide the private key to the outside
Solution Approach 1:
The patent introduces a CDN node as an intermediary between the terminal and the service server. The CDN node performs the SSL handshake with the terminal using the service server's certificate and private key, while the service server never directly exposes its private key. This mediator approach maintains security (the service server's private key remains protected) while improving productivity (the CDN node handles the computationally intensive SSL handshake, freeing the service server for business logic)
Solution Approach 2:
The patent segments the SSL handshake process into two parts: certificate verification and key exchange. The CDN node handles the entire SSL handshake process including decrypting the premaster key with the service server's private key, while the service server only needs to provide its certificate. This segmentation allows the service server to maintain security by not exposing its private key while still enabling secure communication through the CDN node
2Reliability
If the service server processes private key operations during SSL handshake, then the SSL handshake can be completed, but the CPU processing resources are consumed significantly especially under high concurrency
Solution Approach 1:
The CDN node acts as an intermediary that performs the CPU-intensive private key operations (decrypting the premaster key or signing DH parameters) on behalf of the service server. The service server only needs to provide its certificate and public key, while the CDN node handles all private key processing. This reduces the service server's CPU consumption significantly while maintaining SSL handshake completion
Solution Approach 2:
The CDN node obtains a copy of the service server's certificate and public key to perform SSL handshakes. Instead of the service server processing each SSL handshake directly, the CDN node uses the copied credentials to handle multiple concurrent SSL handshakes independently, reducing the service server's computational burden while maintaining security through the original private key remaining on the service server
Data Source
AI summary
The present disclosure provides a method and system for performing an SSL Handshake. In the method, during an SSL handshake with a target terminal, a target CDN node determines a target service server accessed by the target terminal and obtains information to be processed by a private key; the target CDN node sends a private key processing request to a private key server corresponding to the target service server, the private key processing request carries the information to be processed and target private key processing type information; the private key server processes the information to be processed based on the target private key processing type information and a private key of the target service server and sends a processing result to the target CDN node so that the target CDN node may continue to perform the SSL handshake with the target terminal according to the processing result.