Abstract:Protecting the customer's SSL private key is the paramount issue to persuade the website owners to migrate their contents onto the cloud infrastructure, besides the advantages of cloud infrastructure in terms of flexibility, efficiency, scalability and elasticity. The emerging Keyless SSL solution retains on-premise custody of customers' SSL private keys on their own servers. However, it suffers from significant performance degradation and limited scalability, caused by the long distance connection to Key Server for each new coming end-user request. The performance improvements using persistent session and key caching onto cloud will degrade the key invulnerability and discourage the website owners because of the cloud's security bugs. In this paper, the challenges of secured key protection and distribution are addressed in philosophy of "Storing the trusted DATA on untrusted platform and transmitting through untrusted channel". To this end, a three-phase hierarchical key management scheme, called STYX1 is proposed to provide the secured key protection together with hardware assisted service acceleration for cloud-based content delivery network (CCDN) applications. The STYX is implemented based on Intel Software Guard Extensions (SGX), Intel QuickAssist Technology (QAT) and SIGMA (SIGn-and-MAc) protocol. STYX can provide the tight key security guarantee by SGX based key distribution with a light overhead, and it can further significantly enhance the system performance with QAT based acceleration. The comprehensive evaluations show that the STYX not only guarantees the absolute security but also outperforms the direct HTTPS server deployed CDN without QAT by up to 5x throughput with significant latency reduction at the same time.

STYX: A Hierarchical Key Management System for Elastic Content Delivery Networks on Public Clouds.

STYX: a trusted and accelerated hierarchical SSL key management and distribution system for cloud based CDN application.

A Way Of Key Management In Cloud Storage Based On Trusted Computing

QKPT: Securing Your Private Keys in Cloud with Performance, Scalability and Transparency

Protecting In-memory Data Cache with Secure Enclaves in Untrusted Cloud.

Keys in the Clouds: Auditable Multi-device Access to Cryptographic Credentials

Secure $K$k-Nn Query on Encrypted Cloud Data with Multiple Keys

Enjoy the Untrusted Cloud: A Secure, Scalable and Efficient SQL-like Query Framework for Outsourcing Data

When HTTPS Meets CDN: A Case of Authentication in Delegated Service

LSKV: A Confidential Distributed Datastore to Protect Critical Data in the Cloud

TH_Cloudkey: Fast, Secure and Lowcost Backup System for Using Public Cloud Storage

QShield: Protecting Outsourced Cloud Data Queries with Multi-User Access Control Based on SGX

An Anonymous Authentication Protocol With Delegation and Revocation for Content Delivery Networks

Low-Cost Distributed Key Management

SPX: Preserving End-to-End Security for Edge Computing

Secure Deduplication with Efficient and Reliable Convergent Key Management

TZ-KMS: A Secure Key Management Service for Joint Cloud Computing with ARM TrustZone

KeyD: Secure Key-Deduplication with Identity-Based Broadcast Encryption

Blindfold: Keeping Private Keys in PKIs and CDNs out of Sight

SCD2: Secure Content Delivery and Deduplication with Multiple Content Providers in Information Centric Networking

Shield: A Stackable Secure Storage System for File Sharing in Public Storage