Suporte e migração para a nuvem
Remote Private Key Offloading
Arvancloud’s “OpenSesame” is a solution for Remote Private Key offloading.
Protecting the private key is a crucial challenge for clients such as online financial services, brokers, banks, and Fintech startups who deal with essential data. Sometimes legal or even technical obstacles prevent these clients from disclosing their private keys to the CDN providers.
Understanding these challenges, Arvancloud has developed the OpenSesame solution to provide a secure connection based on TLS to guarantee the highest security and speed for these specific clients without getting their Private Key.
Arvancloud’s OpenSesame divides and carries out the majority of the TLS handshake process on Arvancloud’s edge servers. That part of this process related to reviewing the private key is referred to the origin server, where the private key is located.
As a result, by using OpenSesame, the financial and banking customers can use all Arvancloud services, including CDN, DDoS Protection, and secure connection based on TLS, without the need to disclose their private key to Arvancloud’s edge servers.
By implementing changes in Nginx and OpenSSL and developing the OpenSesame feature, Arvancloud has managed to handle the Private Key review remotely without the need to receive the private key from the client.
Using OpenSesame allows for establishing a secure connection between Arvancloud’s and the client’s origin servers where the client’s private key is not shared with anyone other than our edge servers.
Here’s how the OpenSesame feature works:
The user is connected to the closest Arvancloud edge server using Arvancloud’s Anycast server and sends the encrypted pre-master secret with the public key to the edge server.
Arvancloud’s edge server sends this message with its certificate to the origin server of the client, after which the origin server authenticates Arvancloud’s server, decrypts the encrypted message with the premaster secret, and sends the password to Arvancloud’s edge server through a safe tunnel.
The edge server can access the pre-master secret and acquire the session key; then, a secure connection is formed between the edge server and the user.
Arvancloud accelerates websites and facilitates users’ access to online content in the shortest possible time. This also applies to websites using Arvancloud’s OpenSesame.
In other words, the speed of accessing a website’s content, which uses Arvancloud’s OpenSesame feature, should be equal to the uploading speed of a website without this feature. The geographical distribution of Arvancloud’s servers in different data centers supports this requirement. As you can see in the image below, when not using CDN services, all requests from anywhere in the world are forwarded to the origin server of the website, and the geographical distance between the users and the website’s origin server critically affects the speed or the delay in access to the website content.
Using CDN services allows website content to be distributed on Arvancloud’s edge servers in various data centers. This means that the user’s request is responded to from the data center nearest to their geolocation, significantly reducing the possibility of delay.
The same process applies when using OpenSesame. It means the connection of website visitors is established with Arvancloud edge servers instead of the origin servers, so the users receive the response from the nearest data center. The only delayed connection is related to the connection between Arvancloud edge servers and the website’s origin server during the TLS Handshake.
As illustrated above, in the absence of Arvancloud CDN, a roundtrip was required in the TLS connection between the visitor and the website’s origin server. But our OpenSesame feature established the connection between the website visitor and Arvancloud’s edge server in the shortest possible time. Here, the TLS connection between Arvancloud’s edge server and the origin server only requires one trip that substantially shortens accessing the website content.
The one roundtrip is possible because of the permanent connection established between Arvancloud’s edge server and the website’s origin server. Arvancloud’s edge server saves this connection after its initial establishment and will continue to use it in the future.