Selective TLS Session Injection for CDN Edge Servers

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

CDN service providers face challenges in securely transmitting data without accessing customers' private TLS keys and ensuring data authenticity, as customers require secure content delivery without decrypting sensitive information within the CDN infrastructure.

Innovation Solution

The technique allows selective delegation of data streams to CDN edge servers for authentic content transmission, enabling the CDN to inject cached data without decrypting arbitrary data, using TLS session manipulation to manage access and visibility, including decryption upgrades and one-time write grants, all under customer control.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the CDN terminates TLS sessions and decrypts data, then data transmission efficiency is improved, but security and data authenticity are compromised

Engineering Contradiction:
Improvedata transmission efficiencyVSAvoiddata authenticity
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent introduces a CDN edge server as an intermediary that can selectively decrypt and inject cached content into TLS sessions without having access to the customer's private key. The edge server acts as a mediator between the client and origin server, allowing efficient content delivery while maintaining security through the use of pre-shared keys and cryptographic proof mechanisms.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the TLS session management into different components: the CDN edge server handles TLS termination and content injection for cached items, while the origin server maintains full control over private keys and non-cached content. This segmentation allows the CDN to improve transmission efficiency for specific content without compromising overall security.

Inventive Principle:
Principle #1Segmentation

2Ease of operation

If the CDN accesses private TLS keys, then TLS session management is simplified, but key security and customer control are compromised

Engineering Contradiction:
ImproveTLS session managementVSAvoidkey exposure risk
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the private key management function from the CDN edge server and keeps it exclusively with the origin server. The CDN edge server is given only the public key and pre-shared keys necessary for selective content injection, while the private key remains securely stored at the origin. This extraction eliminates key exposure risk while maintaining simplified TLS session management for cached content.

Inventive Principle:
Principle #2Taking out (Extraction)

3Adaptability or versatility

If the CDN decrypts all data streams, then content delivery flexibility is improved, but processing overhead and security risks increase

Engineering Contradiction:
Improvecontent delivery flexibilityVSAvoidprocessing overhead
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements partial decryption where the CDN edge server decrypts only the specific portions of data streams that correspond to cached content identifiers. Instead of decrypting entire data streams, the edge server performs selective decryption based on content fingerprints or identifiers, reducing processing overhead while maintaining content delivery flexibility.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP2992639B1Splicing into an active TLS session without a certificate or private key
Publication Date: 2019.07.31 AKAMAI TECHNOLOGIES INC
  • EP2992639B1 patent drawingFigure 1~2
  • EP2992639B1 patent drawingFigure 3

AI summary

An origin server selectively enables an intermediary (e.g., an edge server) to shunt into and out of an active TLS session that is on-going between a client and the origin server. The technique allows for selective pieces of a data stream to be delegated from an origin to the edge server for the transmission (by the edge server) of authentic cached content, but without the edge server having the ability to obtain control of the entire stream or to decrypt arbitrary data after that point. The technique enables an origin to authorize the edge server to inject cached data at certain points in a TLS session, as well as to mathematically and cryptographically revoke any further access to the stream until the origin deems appropriate.