Load Balancer Session Key Distribution for Secure Network Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure communication channels between computing devices are vulnerable to unauthorized access, particularly when data requests are decrypted and re-encrypted by intermediate servers, which can expose data to third-party observers and increase latency due to multiple handshakes required for secure communication.
Innovation Solution
Establishing end-to-end secure communication channels by compartmentalizing responsibilities, where a shared session key is used across multiple computing devices, reducing the need for multiple handshakes and isolating intermediate servers from decryption processes, thereby minimizing exposure to unauthorized access and latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If intermediate servers decrypt and re-encrypt data requests, then data can be accessed and processed by the server, but data is exposed to third-party observers and security is compromised
Solution Approach 1:
The patent segments the cryptographic operations by separating the decryption function from the server and assigning it to the client device. The server only performs encryption and forwarding, while the client handles decryption and data processing. This segmentation ensures that the server never possesses decryption keys or exposed plaintext data, eliminating the security vulnerability while maintaining data access functionality.
2Reliability
If multiple handshakes are performed for secure communication between client and multiple servers, then each communication channel is secured, but latency increases due to repeated authentication processes
Solution Approach 1:
The patent implements preliminary action by establishing a single TLS handshake between the client and the load balancer that precedes all subsequent server communications. The load balancer forwards the encrypted request to the appropriate server without requiring additional handshakes. This preliminary authentication establishes trust for all downstream communications, eliminating repeated authentication overhead and reducing latency while maintaining security.
3Productivity
If a single session key is shared across multiple computing devices, then the number of handshakes is reduced and communication is streamlined, but access control and security management become more complex
Solution Approach 1:
The patent introduces the load balancer as an intermediary that manages the session key distribution and access control. The load balancer receives the session key from the client, determines which server should handle the request, and forwards the encrypted request to the appropriate server. This intermediary approach simplifies access rights management by centralizing key distribution logic while enabling efficient direct communication between clients and multiple servers without requiring complex peer-to-peer key management.
Data Source
AI summary
A computing device can obtain a session key for encrypting data that is communicated between a client device and the computing device. The computing device can receive, from the client device, an encrypted request for data. The encrypted request can be encrypted by the client device using the session key. The data requested can be stored on a second computing device. The computing device can send, to the second computing device, a copy of the session key and the encrypted request for data. The second computing device can decrypt the data using the session key and can also encrypt data responsive to the request using the session key.