Proxy Server Encryption Key Relay for Content Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of TLS (Transport Layer Security) for HTTPS prevents intermediate devices from caching content, leading to increased bandwidth and peering costs for content providers, as they cannot utilize content caches effectively.
Innovation Solution
A method and system where a proxy establishes a secure connection with a content server, receives security parameters, and uses them to establish a secure connection with a client, allowing the proxy to perform transmission encryption and cache content, without requiring private certificates from the content server, enabling caching and reducing the content server's load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS encryption is employed for secure content transmission, then content integrity is improved, but the ability to cache content at intermediate devices is lost
Solution Approach 1:
The patent introduces a proxy server as an intermediary between the content server and the client. The proxy establishes its own TLS connection to the content server, receives security parameters (including encryption keys) from the server, and then uses these parameters to establish a separate TLS connection with the client. This intermediary approach allows the proxy to decrypt and cache content while maintaining end-to-end encryption transparency.
Solution Approach 2:
The patent changes the encryption parameters by having the content server provide security parameters (encryption keys, certificates) to the proxy over a secure channel. The proxy then uses these parameters to establish encrypted connections with clients. This parameter transmission approach enables the proxy to perform decryption and caching operations while maintaining security, resolving the contradiction between encryption and caching capability.
2Reliability
If TLS encryption is used, then security is improved, but bandwidth costs and peering costs increase due to inability to utilize caches
Solution Approach 1:
The proxy performs preliminary actions by establishing a TLS connection with the content server in advance, obtaining security parameters, and caching content before client requests arrive. When clients request content, the proxy can serve cached copies, avoiding the need to repeatedly fetch content from the content server over the expensive backhaul connection. This preliminary caching action significantly reduces bandwidth costs while maintaining security through the initial encrypted connection.
3Reliability
If the content server performs encryption directly, then security control is improved, but device complexity and load on the content server increase
Solution Approach 1:
The patent extracts the encryption/decryption functionality from the content server and relocates it to the proxy server. The content server's role is reduced to providing security parameters (keys, certificates) to the proxy over a secure connection, while the actual encryption and decryption operations are performed by the proxy. This extraction reduces the computational load and complexity of the content server while maintaining security control through centralized parameter management.
Data Source
AI summary
It is presented a method performed in a proxy. The method comprises the steps of: establishing a first secure connection between the proxy and a content server; forwarding messages between a client and the content server to establish a second secure connection between the client and the content server; receiving security parameters from the content server over the first secure connection, the security parameters being associated with the second secure connection; obtaining the content; and transmitting the content to the client using an encryption key derived from the security parameters.