SSL Termination via External RSA Proxy Key Offload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Insecure SSL termination points pose significant security risks due to the storage and use of private decryption keys, as they are the only location where the decryption of the encrypted pre-master secret occurs, making them vulnerable to compromise.
Innovation Solution
Implementing an RSA proxy service that offloads the decryption of the encrypted pre-master secret to an external server, where the decryption key is maintained, thereby preventing the need for the key to be stored on the SSL server, and using a mutually-authenticated SSL connection to forward the encrypted pre-master secret for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SSL server stores the private decryption key locally to decrypt the encrypted pre-master secret, then the SSL connection can be established, but the security risk increases due to potential compromise at the SSL termination point
Solution Approach 1:
The patent extracts the private decryption key from the SSL server environment and stores it externally in a secure key management system. The SSL server only holds the public key, while the private key resides in a separate, more secure location. This extraction eliminates the security vulnerability of storing private keys at SSL termination points while maintaining the ability to decrypt encrypted pre-master secrets through secure key management infrastructure.
Solution Approach 2:
The patent introduces a key management service as an intermediary between the SSL server and the private key. This mediator handles key storage, protection, and controlled access to decryption operations. The SSL server communicates with this intermediary to perform decryption without directly accessing or storing the private key, thus maintaining security while enabling functional operation.
2Object-affected harmful factors
If the private key is stored in a secure data center location rather than on the SSL server, then security is enhanced, but the system complexity increases due to the need for key management infrastructure
Solution Approach 1:
The patent implements a universal key management service that can serve multiple SSL servers and applications from a single secure infrastructure. This multi-functional system handles key storage, rotation, revocation, and decryption operations for various SSL termination points, reducing overall system complexity compared to maintaining separate key management for each server while still providing enhanced security through centralized control.
3Object-affected harmful factors
If the decryption operation is performed remotely rather than locally, then the private key does not need to be stored on the SSL server, but the communication overhead increases
Solution Approach 1:
The patent establishes pre-authenticated SSL connections between SSL servers and the remote key management service during initialization or idle periods. This preliminary action creates trusted communication channels in advance, so that when decryption operations are needed, the servers can quickly and securely communicate with the key management infrastructure without establishing new authentication handshakes, thereby reducing communication overhead while maintaining security.
Data Source
AI summary
An Internet infrastructure delivery platform (e.g., operated by a service provider) provides an RSA proxy “service” as an enhancement to the SSL protocol that off-loads the decryption of the encrypted pre-master secret (ePMS) to an external server. Using this service, instead of decrypting the ePMS “locally,” the SSL server proxies (forwards) the ePMS to an RSA proxy server component and receives, in response, the decrypted pre-master secret. In this manner, the decryption key does not need to be stored in association with the SSL server.