WO2018059578A1

WO2018059578A1 - Https acceleration method and system based on content distribution network

Info

Publication number: WO2018059578A1
Application number: PCT/CN2017/104806
Authority: WO
Inventors: 苗辉; 江桂林; 杨洋; 林胜恩
Original assignee: 贵州白山云科技有限公司
Priority date: 2016-09-30
Filing date: 2017-09-30
Publication date: 2018-04-05
Also published as: CN106341417A; CN110808989B; CN106341417B; CN110808989A

Abstract

Embodiments of the present invention disclose an HTTPS acceleration method and system based on a content distribution network. The method comprises: step 1), a client end initiating an HTTPS access request to a CDN network border node, and the CND network border node allocating in balance a session and buffer server via a front-end load to perform three handshakes with the client end; step 2), during the handshaking process, the allocated session and buffer server performing HTTPS session management, and simultaneously performing interaction, by means of a private key and encryption/decryption of a user certificate, with a centralized authentication server, and returning a result of the interaction to the client end; and step 3), after completing the handshaking process, the session and buffer server launching a buffer service to provide the client end with a CDN service, wherein, if data requested by the client end is bufferable, the data is acquired directly from the session and buffer server, and if the data requested by the client end is non-bufferable, the data is acquired from a source server.

Description

HTTPS acceleration method and system based on content distribution network

The present application claims priority to Chinese Patent Application No. 201610873442.6, entitled "A HTTPS Acceleration Method and System Based on Content Distribution Network", filed on September 30, 2016, the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The embodiment of the invention relates to a website optimization method, and in particular to a content distribution network (CDN)-based HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) acceleration method and system.

Background technique

The HTTPS security protocol is a security-oriented HTTP channel. By adding an SSL layer under HTTP, transmission encryption can be implemented to prevent important data such as user data and transaction data from being stolen. HTTPS plays a key role in protecting user privacy and preventing traffic hijacking. But at the same time, HTTPS will also reduce user access speed and increase the computing resource consumption of the web server.

In the SSL session, the most computationally intensive part is the Secure Sockets Layer (SSL) handshake phase. SSL has two main types of handshakes, one based on RSA and one based on Deiffie-Hellman (DH). The public key algorithms of RSA and DH use a lot of CPU processing power and are the slowest part of the handshake. A laptop can perform hundreds of RSA encryptions per second, compared to approximately 10 million symmetric encryption AES per second. The main task of this phase is to negotiate the session key, which is usually a symmetric key, which will be applied throughout the corresponding session; at the same time, the encryption and signature of the SSL handshake itself is included in the certificate. A symmetric key that uses this asymmetric key to consume more computing resources than a symmetric key.

Based on the software-based SSL implementation, the server's processor is responsible for the initial key exchange of each session and subsequent data encryption and decryption. This intensive computing process puts the server under great pressure and greatly reduces other transaction processing capabilities. Therefore, the software-based SSL implementation is only applicable to scenarios that manage a small amount of SSL traffic. The CDN network is characterized by a small node size and a small number of servers per node. However, CDN nodes are distributed more and are geographically divergent. HTTPS acceleration in CDN networks, software-based SSL implementation can not meet the acceleration needs.

Based on the above situation, CDN vendors have proposed hardware-based SSL acceleration solutions, such as SSL acceleration boards. Or SSL acceleration device.

The SSL acceleration board can effectively share the pressure of the server CPU to handle SSL transactions. One or more coprocessors are used to implement SSL computing. These coprocessors may use general-purpose CPUs or custom ASIC chips and RISC instruction set chips. However, for each customer access, a server with an SSL acceleration board is assigned to complete the handshake, encryption and decryption process, which wastes resources and has a high stand-alone management cost. In addition, each server must have a unique digital certificate, so many certificates are easy to leak, there are security issues.

Secondly, the SSL acceleration device is an independent device embedded in the SSL acceleration board, decrypts the encrypted traffic, and sends the decrypted data information to the background server; in the opposite direction, it is responsible for encrypting the plaintext data sent by the background server. Forward it to the client; the SSL acceleration device terminates the SSL session, and the backend server can be completely freed for data services or running applications, but the overall cost of the SSL acceleration device is not an ideal alternative.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The embodiment of the invention provides an HTTPS acceleration method and system based on a content distribution network, which adopts an SSL acceleration board solution, and solves the problem that the performance of the software-based SSL implementation is under pressure and the transaction processing capability is inefficient; and the SSL is accelerated. The board is deployed on the server of the edge node of the CDN network to implement centralized management of the certificate, and an SSL acceleration board can serve multiple clients for encryption and decryption, which solves the problem that each acceleration board is only bound to a specific client request. The problem of wasted resources and high management costs.

The content distribution network-based HTTPS acceleration method provided by the embodiment of the present invention includes: the content distribution network includes a content distribution network CDN network management center located in a central part, and a domain name system DNS redirection analysis center, and multiple CDN network edges located at an edge portion a node and a source server located at the back end; each CDN network edge node respectively deploys a session & cache server at the front end and a unified authentication server at the back end;

The HTTPS acceleration method includes:

Step 1: The client initiates an HTTPS access request to the CDN network edge node; the CDN network edge node allocates a session & cache server to perform a three-way handshake with the client through load balancing of the front end;

Step 2: During the handshake process, the assigned session & cache server is responsible for HTTPS session management. The session & cache server interacts with the unified authentication server for encrypting and decrypting the private key and the user certificate, and returns the interaction result to the client;

Step 3: After the handshake process is completed, the session & cache server performs a cache service to provide a CDN service for the client; if the data requested by the client is cacheable data, it is directly obtained in the session & cache server, if not Cache data and get it from the source server.

The method may further include: providing a user certificate and a private key on the unified verification server, integrating at least one SSL acceleration board, and one or more unified verification servers corresponding to one user certificate, and the unified verification server is set to process plus Decrypt.

The above method may further include: if there are multiple clients, mapping each client to a unified authentication server through the session & cache server.

The method may further include: linearly deploying the proportion of the unified verification server with the traffic, linearly expanding the unified verification server, and inserting at least one SSL acceleration board on each unified verification server.

The method may further include: inserting multiple SSL acceleration boards on each unified authentication server, and different SSL acceleration boards form an active/standby relationship.

The embodiment of the present invention further provides an HTTPS acceleration system based on a content distribution network, where the content distribution network includes a CDN network management center and a DNS redirection analysis center located at a central portion, a plurality of CDN network edge nodes located at an edge portion, and a rear location. The source server of the end; each CDN network edge node separately deploys a session & cache server at the front end and a unified authentication server at the back end;

The HTTPS acceleration system includes the following units:

The HTTPS access request initiating unit is configured to execute: the client initiates an HTTPS access request to the CDN network edge node;

The three-way handshake initiation unit is configured to perform: the CDN network edge node allocates a corresponding session & cache server through the load balancing of the front end, and performs three-way handshake with the client; the three-way handshake processing unit is set to execute: during the handshake process, the allocation is performed. The good session & cache server is responsible for HTTPS session management. The session & cache server interacts with the unified authentication server for the encryption and decryption of the private key and the user certificate, and returns the interaction result to the client.

The HTTPS access response unit is set to execute: after the handshake process is completed, the session & cache server performs a cache service to provide a CDN service for the client; for the data requested by the client, if The data can be cached and obtained directly at the session & cache server. If it is non-cacheable, it is obtained from the source server.

The system may further include: a user certificate and a private key are provided on the unified verification server, and at least one SSL acceleration board is integrated, and one or more unified verification servers correspond to a user certificate, and the unified verification server is set to process plus Decrypt.

The system may further include: the three-way handshake processing unit is further configured to perform the following operations: if there are multiple clients, the clients are mapped to a unified authentication server through the session & cache server.

The above system may further include: the proportion of the unified verification server is linearly distributed with the traffic, and the unified verification server is linearly expanded, and each unified verification server is plugged with at least one SSL acceleration board.

The above system may further include: inserting multiple SSL acceleration boards on each unified authentication server, and different SSL acceleration boards form an active/standby relationship.

The embodiments of the present invention effectively combine the technical advantages of the SSL acceleration board and the CDN network edge node, and have the following advantages:

(1) Using the SSL acceleration board to replace the encryption and decryption work of the common edge server, so that the edge server can reduce the load and deploy the SSL acceleration board to the unified authentication server, which greatly reduces the CPU consumption of the common edge server and improves the efficiency.

(2) Using an SSL accelerator card to serve the encryption and decryption of several customers, from the original one-to-one service to one pair of N, which greatly saves costs for CDN vendors.

(3) From the original SSL acceleration card, a certificate needs to be managed. Up to now, N customers use an SSL acceleration board and the certificate is managed centrally, so that the management of the certificate is greatly reduced, and the management cost of the single machine is greatly reduced.

(4) The unified authentication server can perform encryption and decryption work by plugging in the SSL acceleration board. It can also deploy software on the unified authentication server according to different needs of customers, such as CDN server application certificate scheme and Cloudflare keyless-SSL scheme. The embodiments of the present invention can effectively support; realize the interaction with the front-end server at the edge node, reduce the round-trip RTT between servers, and improve the efficiency.

(5) The SSL acceleration board can be linearly extended in the edge unified authentication server cluster to increase its transaction processing capability without affecting centralized management and saving expansion costs.

DRAWINGS

The accompanying drawings are intended to provide a further understanding of the embodiments of the embodiments of the invention Improper limitations. In the drawing:

FIG. 1 is a schematic diagram of client access according to an embodiment of the present invention.

detailed description

The embodiments of the present invention will be further described with reference to the drawings and specific embodiments.

An embodiment of the present invention provides an HTTPS acceleration method based on a content distribution network, where the content distribution network includes a CDN network management center and a DNS redirection analysis center located in a central portion, a plurality of CDN network edge nodes located at an edge portion, and a source located at the back end. server.

The central part of the CDN network management center and the DNS redirection analysis center are responsible for global load balancing, and the equipment system is installed in the management center equipment room.

The CDN network edge node is a carrier for CDN distribution. It is mainly composed of a cache (Cache) and a load balancer. Each CDN network edge node deploys a session & cache at the front end and a unified authentication server (UAS) at the back end. Among them, the session & cache server is provided with multiple, responsible for HTTPS session management, and interacts with the back-end unified authentication server; after the interaction is completed, the role is changed to a cache server to provide CDN services for the client. In an optional example, the session & cache server performs the above functions using the configured OpenSSL and Nginx software. The unified authentication server is provided with multiple user certificates and private keys, and integrates several SSL acceleration boards (such as Intel or NAVIMN), which is the main processing server for user encryption and decryption. For the SSL acceleration board, the single card throughput can usually reach 20Gbps, and the 1024-bit RSA and 2048-bit RSA are encrypted and decrypted, and the processing rates are 35K-200Kqps and 6K-35Kqps, respectively. The unified authentication server can be run on Linux (RedHat/CentOS, Debian and Ubuntu, and others), other Unix operating systems (including FreeBSD) and Microsoft Windows servers. The user certificates on each unified authentication server can be shared, that is, multiple unified authentication servers can use the same certificate, or one unified authentication server can correspond to one user certificate. The unified authentication server is stateless, allowing the client to use off-the-shelf hardware and deploying a uniform authentication server scale with traffic; by running multiple unified authentication servers and load balancing through DNS, The customer's site can be kept highly available.

The source server contains cacheable data and non-cacheable data. The cacheable data is used to update the cache with the session & cache server. The non-cacheable data is used by the client after establishing a session with the edge node.

Based on the content distribution network, in conjunction with the schematic diagram of FIG. 1, the HTTPS acceleration method of the embodiment of the present invention includes the following steps:

Step 1: The client initiates HTTPS access, and allocates a corresponding session & cache server through the front-end load balancing to initiate a three-way handshake (RSA/DH) process. The client is a network terminal user and may use the current popular browsing. (Chrome, Firefox, IE, etc.) browse the webpage, the client 1, the client 2, and the client 3 in the figure respectively refer to the client representative access of different websites to accelerate the customer, such as Sina, Tencent, Netease, etc. Different websites accelerate customers;

Step 2: During the handshake process, the session & cache server interacts with the unified authentication server for the encryption and decryption of the private key and the user certificate (depending on different implementations), and returns the interaction result to the client; for multiple clients, The session & cache server maps each client to a unified authentication server, so that each client shares the hardware acceleration capability of the unified authentication server;

Step 3: After the handshake process is completed, the session & cache server performs the cache service to provide the CDN service for the client, and the client normally uses the CDN service. For the data requested by the client, if the data is cacheable, the server directly at the edge node Get, if it is non-cacheable data, get it from the source server.

Step 4: The number of unified authentication servers can be deployed linearly with the proportion of the traffic. When the expansion is required, the unified authentication server can be linearly extended, and at least one SSL acceleration board is inserted into each server to cope with the larger Scale SSL transaction processing requirements; or form an active/standby to handle fault handling.

The embodiment of the present invention further provides an HTTPS acceleration system based on a content distribution network, where the content distribution network includes a CDN network management center and a DNS redirection analysis center located at a central portion, a plurality of CDN network edge nodes located at an edge portion, and a rear location. The source server of the end; each CDN network edge node separately deploys a session & cache server at the front end and a unified authentication server at the back end; the HTTPS acceleration system includes the following units:

The three-way handshake initiation unit is configured to perform: the CDN network edge node allocates a corresponding session & cache server through the load balancing of the front end, and performs a three-way handshake with the client;

The three-way handshake processing unit is set to execute: during the handshake process, the assigned session & cache server is responsible for HTTPS session management, and the session & cache server simultaneously interacts with the unified authentication server for encryption and decryption of the private key and the user certificate, and interacts with each other. The result is returned to the client; if there are multiple clients, each client is mapped to a unified authentication server through the session & cache server, so that each client shares the hardware acceleration capability of the unified authentication server.

The HTTPS access response unit is set to execute: after completing the handshake process, the session & cache server performs a cache service to provide a CDN service for the client; for the data requested by the client, if the data is cacheable, directly in the session & cache server Get, if it is non-cacheable data, get it from the source server.

The unified authentication server is provided with a user certificate and a private key, and integrates a plurality of SSL acceleration boards, one or more unified authentication servers corresponding to one user certificate, the unified verification server is set to handle encryption and decryption; The number can be distributed with the linearity of the traffic to the proportion of the unified authentication server. When the expansion is required, the unified authentication server can be linearly extended, and several SSL acceleration boards are inserted into each server to cope with the larger-scale SSL transaction processing requirements; or Form the master and backup to deal with the fault handling.

(4) In addition to the encryption and decryption work, the unified authentication server can also deploy software on the unified authentication server according to different needs of customers, such as CDN server application certificate. The scheme, the keyless-SSL scheme of Cloudflare, etc. can be effectively supported by the embodiments of the present invention; the interaction with the front-end server at the edge node is realized, the round-trip RTT between servers is reduced, and the efficiency is improved.

A person skilled in the art should understand that the technical solutions of the present invention may be modified or equivalent, without departing from the spirit and scope of the present invention, and should be included in the scope of the claims.

Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and functional blocks/units of the methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components work together. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer. Moreover, it is well known to those skilled in the art that communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .

Industrial applicability

The embodiment of the present invention uses the SSL acceleration board to replace the encryption and decryption work of the common edge server, so that the edge server reduces the load and deploys the SSL acceleration board to the unified verification server, which greatly reduces the CPU consumption of the common edge server and improves the efficiency. Use an SSL accelerator card to serve the encryption and decryption of several customers, from the original one-to-one service to a pair of N, so for CDN vendors, Save costs. From the original SSL acceleration card, a certificate needs to be managed. Up to now, N customers use an SSL acceleration board and the certificate is managed centrally, so that the management of the certificate is greatly reduced, and the management cost of the single machine is greatly reduced.

Claims

An HTTPS acceleration method based on a content distribution network, comprising: the content distribution network comprises a content distribution network CDN network management center located in a central part, a domain name system DNS redirection analysis center, a plurality of CDN network edge nodes located at an edge portion, and a rear location The source server of the end; each CDN network edge node separately deploys a session & cache server at the front end and a unified authentication server at the back end;

The HTTPS acceleration method includes:

Step 1: The client initiates an HTTPS access request to the CDN network edge node; the CDN network edge node allocates a session & cache server to perform a three-way handshake with the client through load balancing of the front end;

Step 2: During the handshake process, the assigned session & cache server is responsible for HTTPS session management. The session & cache server interacts with the unified authentication server for the encryption and decryption of the private key and the user certificate, and returns the interaction result to the client.

Step 3: After the handshake process is completed, the session & cache server performs a cache service to provide a CDN service for the client; if the data requested by the client is cacheable data, it is directly obtained in the session & cache server, if not Cache data and get it from the source server.
The HTTPS acceleration method according to claim 1, wherein: the unified authentication server is provided with a user certificate and a private key, and at least one SSL acceleration board is integrated, and one or more unified authentication servers correspond to a user certificate, and the unified The authentication server is set to handle encryption and decryption.
The HTTPS acceleration method according to claim 2, wherein the step 2 further comprises the following process: if there are multiple clients, the clients are mapped to a unified authentication server through the session & cache server.
The HTTPS acceleration method according to claim 1 or 2 or 3, wherein the HTTPS acceleration method further comprises the steps of: linearly deploying the proportion of the unified verification server with the traffic, and linearly expanding the unified verification server, and each unified verification At least one SSL acceleration board is plugged into the server.
The HTTPS acceleration method according to claim 1 or 2 or 3, wherein the HTTPS acceleration method further comprises the steps of: inserting multiple SSL acceleration boards on each unified authentication server, and different SSL acceleration boards form a master-slave relationship. .
An HTTPS acceleration system based on a content distribution network, the content distribution network including CDN network management center and DNS redirection analysis center in the central part, multiple CDN network edge nodes in the edge part, and source servers located in the back end; each CDN network edge node deploys the session & cache server at the front end and the unified at the back end Verification server;

The HTTPS acceleration system includes the following units:

The HTTPS access request initiating unit is configured to execute: the client initiates an HTTPS access request to the CDN network edge node;

The three-way handshake initiation unit is configured to perform: the CDN network edge node allocates a corresponding session & cache server through the load balancing of the front end, and performs a three-way handshake with the client;

The three-way handshake processing unit is configured to perform: during the handshake process, the allocated session & cache server is responsible for HTTPS session management, and the session & cache server simultaneously interacts with the unified authentication server for encrypting and decrypting the private key and the user certificate, and interacts with each other. The result is returned to the client;

The HTTPS access response unit is set to execute: after completing the handshake process, the session & cache server performs a cache service to provide a CDN service for the client; for the data requested by the client, if the data is cacheable, directly in the session & cache server Get, if it is non-cacheable data, get it from the source server.
The HTTPS acceleration system according to claim 6, wherein: the unified authentication server is provided with a user certificate and a private key, and at least one SSL acceleration board is integrated, and one or more unified authentication servers correspond to a user certificate, and the unified The authentication server is set to handle encryption and decryption.
The HTTPS acceleration system according to claim 6, wherein the three-way handshake processing unit is further configured to perform the following operations: if there are multiple clients, mapping each client to one through the session & cache server Unified authentication on the server.
The HTTPS acceleration system according to claim 6, 7 or 8, wherein: the proportion of the unified verification server is linearly distributed with traffic, linearly expanding the unified verification server, and at least one SSL is inserted into each unified authentication server. Speed up the board.
The HTTPS acceleration system according to claim 6, 7 or 8, wherein: each of the unified authentication servers is connected to multiple SSL acceleration boards, and different SSL acceleration boards form an active/standby relationship.