Secure Edge Caching via Origin TLS Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
CDN customers are hesitant to share their private TLS keys with CDN service providers and require data to remain encrypted at all times within the CDN network, ensuring authenticity and security.
Innovation Solution
Implementing a secure content caching technique within edge network environments that maintains only encrypted copies of customer content, without the need for managing encryption keys, leveraging bulk encryption from the TLS layer and caching encrypted TLS segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If TLS termination is performed at the CDN edge, then content delivery acceleration is improved, but private key exposure and security risks increase
Solution Approach 1:
The patent extracts the private key management function from the CDN edge servers by implementing TLS termination at the origin server. Only the public key is deployed at the edge, while the private key remains securely isolated at the origin, eliminating key exposure risks while preserving acceleration benefits through encrypted content caching at the edge.
Solution Approach 2:
The patent introduces an intermediary mechanism where the origin server performs TLS termination and generates encrypted content representations, which are then cached and served by edge servers. This intermediary approach allows edge servers to accelerate content delivery without directly handling private keys or plaintext sensitive content.
2Speed
If encrypted content is cached at the edge, then content delivery speed is improved, but key management complexity increases
Solution Approach 1:
The patent extracts the encryption key management burden from edge servers by having the origin server perform all TLS termination and encryption operations. Edge servers only cache and serve pre-encrypted content representations, eliminating the need for them to manage encryption keys while maintaining fast content delivery.
Solution Approach 2:
The patent creates encrypted content representations (copies of the encrypted content) at the origin server, which are then cached and distributed by edge servers. This copying approach allows edge servers to deliver encrypted content quickly without needing to perform real-time encryption or manage cryptographic keys.
3Reliability
If TLS termination is moved to the origin server, then security is improved, but edge caching effectiveness may be reduced
Solution Approach 1:
The patent creates multiple encrypted content representations at the origin server that can be cached at edge locations. These copies enable effective edge caching while maintaining security, as the cached content remains encrypted and cannot be accessed without the appropriate decryption credentials that stay at the origin.
Solution Approach 2:
The patent changes the parameter of content encryption from being performed at the edge (with key exposure) to being performed at the origin (with key security). This parameter change maintains caching effectiveness by allowing encrypted content to be cached, while improving security through centralized key management at the origin server.
Data Source
AI summary
A technique to cache content securely within edge network environments, even within portions of that network that might be considered less secure than what a customer desires, while still providing the acceleration and off-loading benefits of the edge network. The approach ensures that customer confidential data (whether content, keys, etc.) are not exposed either in transit or at rest. In this approach, only encrypted copies of the customer's content objects are maintained within the portion of the edge network, but without any need to manage the encryption keys. To take full advantage of the secure content caching technique, preferably the encrypted content (or portions thereof) are pre-positioned within the edge network portion to improve performance of secure content delivery from the environment.