CN106341417B - A method and system for accelerating HTTPS based on content distribution network - Google Patents

Abstract

The invention discloses an HTTPS acceleration method and system based on a content distribution network, which adopts an SSL acceleration board scheme to solve the problems of high performance bearing pressure and low transaction processing capacity caused by software-based SSL realization; the SSL acceleration board card is deployed on a server of a CDN edge node to realize centralized management of the certificate, one SSL acceleration board card can serve a plurality of clients to perform encryption and decryption, and the problems that each acceleration board card only binds specific client requests, resources are wasted, and management cost is high are solved.

Description

A method and system for accelerating HTTPS based on content distribution network

technical field

The invention relates to a website optimization method, in particular to a CDN (content distribution network)-based HTTPS acceleration method and system.

Background technique

The HTTPS security protocol is an HTTP channel with the goal of security. By adding the SSL layer under HTTP, it can realize transmission encryption and prevent important data such as user data and transaction data from being stolen. HTTPS plays a very critical role in protecting user privacy and preventing traffic hijacking, but at the same time, HTTPS will also reduce user access speed and increase the computing resource consumption of website servers.

In an SSL session, the most computationally intensive part is the SSL handshake phase. SSL has two main handshake types, one based on RSA and the other based on Deiffie-Hellman (DH). The RSA and DH public key algorithms use a lot of CPU and are the slowest part of the handshake. Hundreds of RSA encryptions per second can be performed on a laptop, compared to about 10 million symmetric encryptions per second for AES. The main work of this stage is to negotiate the session key, which is usually a symmetric key, which will be applied throughout the corresponding session; at the same time, the encryption and signature of the SSL handshake itself are the non-public keys contained in the certificate. Symmetric keys, the use of such asymmetric keys consumes more computing resources than symmetric keys.

Based on software-based SSL implementation, the server's processor is responsible for the initial key exchange of each session and the subsequent data encryption and decryption. This intensive calculation process will put great pressure on the server and greatly reduce other transaction processing capabilities. Therefore, the software-based SSL implementation is only suitable for managing a small amount of SSL traffic. The CDN network is characterized by a small scale of nodes and a small number of servers per node. However, there are many CDN nodes distributed geographically. For HTTPS acceleration in the CDN network, the software-based SSL implementation obviously cannot meet the acceleration requirements.

Based on the above status quo, CDN manufacturers have proposed hardware-based SSL acceleration solutions, such as SSL acceleration boards or SSL acceleration devices.

The SSL acceleration board can effectively share the pressure of the server CPU to handle SSL transactions. One or more coprocessors are used to implement SSL calculations. These coprocessors may use general-purpose CPUs, or custom-made ASIC chips and RISC instruction set chips. However, for each client visit, a server with an SSL accelerator card must be assigned to complete the handshake, encryption and decryption process, which wastes resources and also costs a lot of stand-alone management. In addition, each server must have a unique digital certificate, so many certificates are easy to leak, and there are security problems.

Secondly, the SSL acceleration device is an independent device embedded in the SSL acceleration board, which decrypts the encrypted traffic and sends the decrypted data information to the background server; in the opposite direction, it is responsible for encrypting the plaintext data sent by the background server and then It is forwarded to the client; the SSL acceleration device terminates the SSL session, and the background server can be completely released for data services or running applications. However, the overall cost of the SSL acceleration device is high, so it is not an ideal alternative.

Contents of the invention

Therefore, for the above-mentioned problems, the present invention proposes an HTTPS acceleration method and system based on Content Delivery Network (CDN for short), adopts the SSL acceleration board scheme, and solves the problem of high performance pressure of the software-based SSL implementation. The problem of inefficient transaction processing capability; the SSL acceleration board is deployed on the server of the edge node of the CDN network to realize centralized management of certificates, and one SSL acceleration board can serve multiple customers for encryption and decryption, which solves the problem Each accelerator board is only bound to a specific client request, resulting in waste of resources and high management costs.

In order to solve the above-mentioned technical problems, the technical solution adopted by the present invention is an HTTPS acceleration method based on a content distribution network. A CDN network edge node and a source server positioned at the back end; each CDN network edge node is respectively deployed with a session & cache server positioned at the front end and a unified verification server positioned at the back end; the HTTPS acceleration method comprises the following steps:

Step 1: The client initiates an HTTPS access request to the edge node of the CDN network; the edge node of the CDN network allocates a corresponding session & cache server through front-end load balancing, and performs a three-way handshake with the client;

Step 2: During the handshake process, the assigned session & cache server is responsible for HTTPS session management. The session & cache server interacts with the unified authentication server on the encryption and decryption of the private key and user certificate at the same time, and then returns to the client;

Step 3: After the handshake process is completed, the cache service of the session & cache server is normally carried out to provide CDN services for the client; for the data requested by the client, if it is cacheable data, it is directly obtained from the session & cache server, if If the data is not cacheable, it will be obtained from the source server.

Wherein, the unified verification server is provided with a user certificate and a private key, and integrates several SSL acceleration boards, and one or more unified verification servers correspond to a user certificate, and the unified verification server is used for processing encryption and decryption; Step 2 also includes the following process: if there are multiple clients, each client is mapped to a unified authentication server through the session & cache server, so that each client can share the hardware acceleration capability of the unified authentication server.

As a further solution, the HTTPS acceleration method also includes the following steps: the proportion of the unified verification server is deployed linearly with the traffic, the unified verification server is linearly expanded, and several SSL acceleration boards are inserted on each unified verification server. Respond to larger-scale SSL transaction processing requirements and handle fault handling.

The present invention also provides an HTTPS acceleration system based on a content distribution network. The content distribution network includes a CDN network management center and a DNS redirection analysis center located in the central part, a plurality of CDN network edge nodes located in the edge part, and a source located in the back end. Server; Each CDN network edge node is deployed with a session & cache server at the front end and a unified authentication server at the back end; the HTTPS acceleration system includes the following units:

The HTTPS access request initiation unit is used to execute: the client initiates an HTTPS access request to the edge node of the CDN network;

The three-way handshake initiation unit is used to execute: the CDN network edge node allocates a corresponding session & cache server through front-end load balancing, and performs three-way handshake with the client;

The three-way handshake processing unit is used to execute: during the handshake process, the assigned session & cache server is responsible for HTTPS session management, and the session & cache server interacts with the unified authentication server on the encryption and decryption of the private key and user certificate at the same time, and then returns client;

The HTTPS access response unit is used to perform: after the handshake process is completed, the cache service of the session & cache server is normally carried out to provide CDN services for the client; for the data requested by the client, if it is cacheable data, it is directly stored in the session & The cache server gets it, if it is uncacheable data, it gets it from the source server.

The present invention effectively combines the respective technical advantages of the SSL acceleration board and the edge nodes of the CDN network, and the difference from the existing solutions lies in:

(1) Use the SSL acceleration board to replace the encryption and decryption work of the ordinary edge server, so that the edge server is Offloaded and deployed to the unified verification server, which greatly reduces the CPU consumption of the ordinary edge server and improves the efficiency;

(2) Use one SSL accelerator card to serve the encryption and decryption work of several customers, from the original one-to-one service to one-to-N, which greatly saves costs for CDN manufacturers;

(3) From the original one SSL accelerator card that needs to manage one certificate to the current N customers using one SSL accelerator card, the certificates are managed in a centralized manner, which greatly reduces the amount of certificate management and greatly reduces the cost of stand-alone management;

(4) Among them, the unified verification server, in addition to doing encryption and decryption work by inserting the SSL acceleration board, can also deploy software on the unified verification server according to different needs of customers, such as the CDN server application certificate solution, Cloudflare's keyless-SSL The present invention can effectively support various schemes and the like; in realizing the interaction with the front-end server at the same edge node, this reduces the round-trip RTT between servers and improves the efficiency;

(5) The SSL acceleration board can be linearly expanded in the edge unified authentication server cluster to increase its transaction processing capability without affecting centralized management, which also saves expansion costs.

Description of drawings

FIG. 1 is a schematic diagram of client access in the present invention.

Detailed ways

The present invention will be further described in conjunction with the accompanying drawings and specific embodiments.

The invention provides an HTTPS acceleration method based on a content distribution network. The content distribution network includes a CDN network management center and a DNS redirection analysis center located in the central part, a plurality of CDN network edge nodes located in the edge part, and a source server located in the back end.

The CDN network management center and DNS redirection analysis center in the central part are responsible for global load balancing, and the equipment system is installed in the management center computer room.

The CDN network edge node is the carrier of CDN distribution, mainly composed of Cache (cache) and load balancer, etc. Each CDN network edge node is deployed with a session & cache at the front end and a unified authentication server (UAS) at the back end. Among them, there are multiple session & cache servers, which are responsible for HTTPS session management and interact with the back-end unified authentication server; after the interaction is completed, the role is changed to a cache server to provide CDN services for customers. In an optional example, the session & cache server uses configured OpenSSL and Nginx software to complete the above functions. There are multiple unified authentication servers, which include user certificates and private keys, and integrate several SSL acceleration boards (such as Intel or NAVIMN), which are the main processing servers for user encryption and decryption. For SSL accelerator boards, the throughput of a single card can usually reach 20Gbps, and the processing rates for 1024-bit RSA and 2048-bit RSA encryption and decryption are 35K-200Kqps and 6K-35Kqps respectively. Unified authentication servers can be running on Linux (RedHat/CentOS, Debian and Ubuntu, and others), other Unix operating systems (including FreeBSD) and Microsoft Windows servers. The user certificates on each unified verification server can be shared, that is to say, multiple unified verification servers can use the same certificate, or each unified verification server can correspond to a user certificate. The unified authentication server is stateless, allowing clients to use off-the-shelf hardware and deploying the proportion of the unified authentication server linearly with the traffic; by running multiple unified authentication servers and load balancing through DNS, the customer's site can be kept highly available of.

The source server contains cacheable data and non-cacheable data. The cacheable data is used to update the cache with the session & cache server, and the non-cacheable data is returned to the source for use after the client establishes a session with the edge node.

Based on the content distribution network, in conjunction with the schematic diagram of Fig. 1, the HTTPS acceleration method of the present invention includes the following processes:

Step 1: The client initiates HTTPS access, assigns a corresponding session & cache server through front-end load balancing, and initiates a three-way handshake (RSA/DH) process; where the client is a network end user, and may use the current popular browsing browsers (Chrome, Firefox, IE, etc.) to browse the web, the client 1, client 2, and client 3 in the figure refer to different websites to accelerate customer client representative visits, such as Sina.com, Tencent.com, NetEase, etc. Different websites accelerate customers;

Step 2: During the handshake process, the session & cache server interacts with the unified authentication server on the encryption and decryption of the private key and user certificate (depending on the implementation of different schemes), and then returns to the client; for multiple clients, through the session & The cache server maps each client to a unified verification server, so that each client can share the hardware acceleration capability of the unified verification server;

Step 3: After the handshake process is completed, the Cache service of the session & cache server is normally carried out, and the client uses the CDN service normally. For cacheable data, it is obtained directly from the server of the edge node, and for non-cacheable data, it is obtained from the source server;

Step 4: The number of unified authentication servers can be deployed linearly with the traffic. The proportion of unified authentication servers can be expanded. When expansion is required, the unified authentication server can be linearly expanded, and several SSL acceleration boards can be inserted on each server to cope with larger scale. SSL transaction processing requirements; or form a master and backup to deal with failures.

The present invention also provides an HTTPS acceleration system based on a content distribution network. The content distribution network includes a CDN network management center and a DNS redirection analysis center located in the central part, a plurality of CDN network edge nodes located in the edge part, and a source located in the back end. Server; Each CDN network edge node is deployed with a session & cache server at the front end and a unified authentication server at the back end; the HTTPS acceleration system includes the following units:

The HTTPS access request initiation unit is used to execute: the client initiates an HTTPS access request to the edge node of the CDN network;

The three-way handshake initiation unit is used to execute: the CDN network edge node allocates a corresponding session & cache server through front-end load balancing, and performs three-way handshake with the client;

The three-way handshake processing unit is used to execute: during the handshake process, the assigned session & cache server is responsible for HTTPS session management, and the session & cache server interacts with the unified authentication server on the encryption and decryption of the private key and user certificate at the same time, and then returns Client; if there are multiple clients, each client is mapped to a unified authentication server through the session & cache server, so that each client can share the hardware acceleration capability of the unified authentication server.

The HTTPS access response unit is used to perform: after the handshake process is completed, the cache service of the session & cache server is normally carried out to provide CDN services for the client; for the data requested by the client, if it is cacheable data, it is directly stored in the session & The cache server gets it, if it is uncacheable data, it gets it from the source server.

Among them, a user certificate and a private key are provided on the unified verification server, and several SSL acceleration boards are integrated, and one or more unified verification servers correspond to a user certificate, and the unified verification server is used for processing encryption and decryption; The number can be deployed linearly with the flow rate of the unified authentication server. When expansion is required, the unified authentication server can be linearly expanded, and several SSL acceleration boards can be inserted on each server to meet larger-scale SSL transaction processing requirements; or Form a master and backup to handle failures.

In the embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, and other media that can store program codes.

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still understand the foregoing The technical solutions recorded in each embodiment are modified, or some of the technical features are replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. A method for accelerating HTTPS based on a content distribution network, characterized in that: the content distribution network includes a CDN network management center and a DNS redirection analysis center located at the central part, a plurality of CDN network edge nodes located at the edge and a backend Source server; each CDN network edge node is deployed with a session & cache server at the front end and a unified authentication server at the back end; The HTTPS acceleration method comprises the following steps: Step 1: The client initiates an HTTPS access request to the edge node of the CDN network; the edge node of the CDN network allocates a corresponding session & cache server through front-end load balancing, and performs a three-way handshake with the client; Step 2: During the handshake process, the assigned session & cache server is responsible for HTTPS session management. The session & cache server interacts with the unified verification server on the encryption and decryption of the private key and user certificate at the same time, and then returns to the client. The unified verification The server is used to process encryption and decryption, and a user certificate and private key are provided on the unified verification server, and one or more unified verification servers correspond to a user certificate; Step 3: After the handshake process is completed, the cache service of the session & cache server is normally carried out to provide CDN services for the client; for the data requested by the client, if it is cacheable data, it is directly obtained from the session & cache server, if If the data is not cacheable, it will be obtained from the source server. 2. The HTTPS acceleration method according to claim 1, characterized in that: the unified verification server integrates several SSL acceleration boards. 3. The HTTPS acceleration method according to claim 2, characterized in that: said step 2 also includes the following process: if there are multiple clients, each client is mapped to a unified authentication server by the session & cache server On the server, each client can share the hardware acceleration capability of the unified verification server. 4. The HTTPS acceleration method according to claim 1, 2 or 3, characterized in that: the HTTPS acceleration method also includes the following steps: the proportion of the unified verification server is deployed linearly with the flow rate, and the unified verification server is linearly expanded, every A number of SSL acceleration boards are plugged into a unified authentication server to deal with larger-scale SSL transaction processing requirements and troubleshooting. 5. A kind of HTTPS acceleration system based on content distribution network, this content distribution network comprises CDN network management center and DNS redirection analysis center located in central part, a plurality of CDN network edge nodes located in edge part and source server located in back end; The edge nodes of the CDN network are respectively deployed with a session & cache server at the front end and a unified authentication server at the back end; The HTTPS acceleration system includes the following units: The HTTPS access request initiation unit is used to execute: the client initiates an HTTPS access request to the edge node of the CDN network; The three-way handshake initiation unit is used to execute: the CDN network edge node allocates a corresponding session & cache server through front-end load balancing, and performs three-way handshake with the client; The three-way handshake processing unit is used to execute: during the handshake process, the assigned session & cache server is responsible for HTTPS session management, and the session & cache server interacts with the unified authentication server on the encryption and decryption of the private key and user certificate at the same time, and then returns Client, the unified verification server is used to process encryption and decryption, the unified verification server is provided with user certificates and private keys, and one or more unified verification servers correspond to a user certificate; The HTTPS access response unit is used to perform: after the handshake process is completed, the cache service of the session & cache server is normally carried out to provide CDN services for the client; for the data requested by the client, if it is cacheable data, it is directly stored in the session & The cache server gets it, if it is uncacheable data, it gets it from the source server. 6. The HTTPS acceleration system according to claim 5, characterized in that: the unified authentication server integrates several SSL acceleration boards. 7. The HTTPS acceleration system according to claim 6, wherein: the three-way handshake processing unit also performs the following operations: if there are multiple clients, each client is mapped to a server by the session & cache server On the unified verification server, each client can share the hardware acceleration capability of the unified verification server. 8. The HTTPS acceleration system according to claim 5 or 6 or 7, characterized in that: the proportion of the unified verification server is deployed linearly with the flow rate, the unified verification server is linearly expanded, and each unified verification server is plugged in Several SSL acceleration boards are used to handle larger-scale SSL transaction processing requirements and handle fault handling.