loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
17th Annual Computer Security Applications Conference (ACSAC'01)
Secure Blue: An Architecture for a Scalable, Reliable, High Volume SSL Internet Server
New Orleans, Lousiana
December 10-December 14
ISBN: 0-7695-1405-7
R. Mraz, IBM T.J. Watson Research Center
Although there exist accelerator products to increase throughput of encrypted transactions produced by an Internet HTTP server, there are no current architectures that provide a truly coordinated and scalable solution for Secure Socket Layer (SSL) encrypted communications. This paper presents an architecture that facilitates high volume SSL Internet serving, scaling from thousands to millions of independently active SSL sessions. Reliability, availability, serviceability, and on-line error recovery requirements for such an application are also addressed.
Our approach is to offload SSL set-up protocol activity that was traditionally executed by Transaction Engines (and dedicated co-processors), to a scalable array of SSL Hand-shake Protocol specific servers. This significantly reduces utilization on the Transaction Engines since SSL session set-up is a CPU intensive operation. Additionally, the actual encryption/decryption processing is offloaded as well, to a dedicated and scalable array of In-Line Encryption Engine(s). The In-Line Encryption Engine is architected such that requests and responses flowing to and from the Trans-action Servers are in clear text. A benefit of this arrangement is that Transaction Engines (as well as Web Accelerator Proxies) will retain the ability to cache web objects, while firewalls will retain the ability to perform packet level inspection of all traffic directed to the transaction engines. Such features have been sacrificed in prior SSL implementations.
Citation:
R. Mraz, "Secure Blue: An Architecture for a Scalable, Reliable, High Volume SSL Internet Server," acsac, pp.0391, 17th Annual Computer Security Applications Conference (ACSAC'01), 2001
Usage of this product signifies your acceptance of the Terms of Use.