TLS Termination Point Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers face challenges in securely managing digital certificates and private keys for content servers, especially when intermediate entities like TLS termination points are more accessible to attackers, making it difficult to maintain secure communication links.
Innovation Solution
Implementing a cryptographic service that manages and decrypts cryptographic keys on behalf of the TLS termination point, eliminating the need for the TLS termination point to store or access private keys directly, and using a cryptographic accelerator for cryptographic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the TLS termination point stores digital certificates and private keys locally to facilitate TLS decryption and re-encryption, then cryptographic operations can be performed efficiently, but the security of private keys is compromised due to the increased accessibility of intermediate entities to attackers
Solution Approach 1:
The patent extracts the private key storage and management function from the TLS termination point and places it in a dedicated key management system. The TLS termination point only stores public keys and certificate information, while private keys are kept secure in a separate system that provides cryptographic services on-demand.
Solution Approach 2:
The patent introduces a key management system as an intermediary between the TLS termination point and the private keys. This intermediary handles all cryptographic operations requiring private keys through secure communication channels, allowing the TLS termination point to perform decryption without having direct access to private keys.
2Ease of operation
If the TLS termination point retains copies of content server's private keys to exchange master secrets with clients, then TLS handshaking is simplified, but the attack surface is increased making key exposure more likely
Solution Approach 1:
The patent removes private key retention from the TLS termination point's responsibilities. Instead of keeping private keys locally for simplified handshaking, the system extracts this function to a secure key management infrastructure that provides cryptographic services without exposing private keys to the termination point.
Solution Approach 2:
The key management system acts as an intermediary that enables TLS handshaking operations without requiring the TLS termination point to possess private keys. The intermediary handles sensitive key operations through secure channels, maintaining operational simplicity while reducing exposure to attacks.
3Speed
If cryptographic operations are performed directly on the TLS termination point using local private keys, then processing speed is improved, but the risk of key compromise increases due to the intermediate entity's accessibility
Solution Approach 1:
The patent extracts private key handling from the TLS termination point to a dedicated key management system. The termination point maintains cryptographic processing capability by receiving encrypted data and sending results to the key management system, which performs operations using secure private key access without compromising key security.
Solution Approach 2:
The key management system serves as an intermediary that enables fast cryptographic processing while maintaining key security. It receives processing requests from the TLS termination point, performs operations using securely stored private keys, and returns results through secure channels, balancing speed and security requirements.
Data Source
AI summary
The present document describes systems and methods that utilize a cryptographic service for establishing a cryptographically protected communication session, such as a TLS connection, between a client computer system and a TLS termination point. The cryptographic service retains cryptographic material associated with a server that is represented by the TLS termination point. The TLS termination point uses the cryptographic service to perform cryptographic operations associated with establishing and maintaining the cryptographically protected communication session. The cryptographic service may be provided by the server itself, a cryptographic server, or a cryptographic accelerator such as an HSM. In some embodiments, the cryptographic service tokenizes unencrypted data to be provided to the TLS termination point. If a cryptographic accelerator is used, the cryptographic accelerator may include facilities to accelerate asymmetric cryptographic operations as well as symmetric cryptographic operations.