Ron Mraz
IBM Research
USA

Although there exist accelerator products to increase throughput of encrypted transactions produced by an Internet HTTP server, there are no current architectures that provide a truly coordinated and scalable solution for Secure Socket Layer (SSL) encrypted communications. This paper presents an architecture that facilitates high volume SSL Internet serving, scaling from thousands to millions of independently active SSL sessions. Reliability, availability, serviceability, and on-line error recovery requirements for such an application are also addressed.

Our approach is to offload SSL set-up protocol activity that was traditionally executed by Transaction Engines (and dedicated co-processors), to a scalable array of SSL Handshake Protocol specific servers. This significantly reduces utilization on the Transaction Engines since SSL session set-up is a CPU intensive operation. Additionally, the actual encryption/decryption processing is offloaded as well, to a dedicated and scalable array of In-Line Encryption Engine(s). The In-Line Encryption Engine is architected such that requests and responses flowing to and from the Transaction Servers are in clear text. A benefit of this arrangement is that Transaction Engines (as well as Web Accelerator Proxies) will retain the ability to cache web objects, while firewalls will retain the ability to perform packet level inspection of all traffic directed to the transaction engines. Such features have been sacrificed in prior SSL implementations.

Read Paper (in PDF)