Selective TLS Session Injection for CDN Edge Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
CDN service providers face challenges in securely transmitting data without accessing customers' private TLS keys and ensuring data authenticity, as customers require secure content delivery without decrypting sensitive information within the CDN infrastructure.
Innovation Solution
The technique allows selective delegation of data streams to CDN edge servers for authentic content transmission, enabling the CDN to inject cached data without decrypting arbitrary data, using TLS session manipulation to manage access and visibility, including decryption upgrades and one-time write grants, all under customer control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the CDN terminates TLS sessions and decrypts data, then data transmission efficiency is improved, but security and data authenticity are compromised
Solution Approach 1:
The patent introduces a CDN edge server as an intermediary that can selectively decrypt and inject cached content into TLS sessions without having access to the customer's private key. The edge server acts as a mediator between the client and origin server, allowing efficient content delivery while maintaining security through the use of pre-shared keys and cryptographic proof mechanisms.
Solution Approach 2:
The patent segments the TLS session management into different components: the CDN edge server handles TLS termination and content injection for cached items, while the origin server maintains full control over private keys and non-cached content. This segmentation allows the CDN to improve transmission efficiency for specific content without compromising overall security.
2Ease of operation
If the CDN accesses private TLS keys, then TLS session management is simplified, but key security and customer control are compromised
Solution Approach 1:
The patent extracts the private key management function from the CDN edge server and keeps it exclusively with the origin server. The CDN edge server is given only the public key and pre-shared keys necessary for selective content injection, while the private key remains securely stored at the origin. This extraction eliminates key exposure risk while maintaining simplified TLS session management for cached content.
3Adaptability or versatility
If the CDN decrypts all data streams, then content delivery flexibility is improved, but processing overhead and security risks increase
Solution Approach 1:
The patent implements partial decryption where the CDN edge server decrypts only the specific portions of data streams that correspond to cached content identifiers. Instead of decrypting entire data streams, the edge server performs selective decryption based on content fingerprints or identifiers, reducing processing overhead while maintaining content delivery flexibility.
Data Source
Figure 1~2
Figure 3
AI summary
An origin server selectively enables an intermediary (e.g., an edge server) to shunt into and out of an active TLS session that is on-going between a client and the origin server. The technique allows for selective pieces of a data stream to be delegated from an origin to the edge server for the transmission (by the edge server) of authentic cached content, but without the edge server having the ability to obtain control of the entire stream or to decrypt arbitrary data after that point. The technique enables an origin to authorize the edge server to inject cached data at certain points in a TLS session, as well as to mathematically and cryptographically revoke any further access to the stream until the origin deems appropriate.