Terminating SSL connections without locally-accessible private keys

A method to secure a communication, comprising:

• receiving a handshake request that includes an encrypted secret data value, the secret data value having been generated at a client;
• proxying the encrypted secret data value over a secure connection to a computational entity at which a decryption key may be applied to the encrypted secret data value to recover the secret data value;
• receiving from the computational entity, over the secure connection, the secret data value;
• and
• using the secret data value to generate a key to be used for encrypting a connection back to the client.

A system, comprising:

• at least one machine in a first network-accessible location and that includes an RSA proxy server software program that executes on hardware;
• at least one machine in a second network-accessible location and that includes an RSA proxy client software program that executes on hardware;
• the RSA proxy server software program and the RSA proxy client software program each including code to establish and maintain a secure connection there-between;
• the RSA proxy client software program adapted to receive and forward to the RSA proxy server software program over the secure connection an encrypted pre-master secret associated with a new SSL handshake request from a client;
• the RSA proxy server software program adapted to receive the encrypted pre-master secret forwarded from the RSA proxy client software program and to decrypt the encrypted pre-master secret using a decryption key that is maintained at the RSA proxy server software program and not otherwise accessible to the RSA proxy client software program;
• the RSA proxy server software program further adapted to return a decrypted pre-master secret to the RSA proxy client software program over the secure connection;
• the RSA proxy client software program receiving the decrypted pre-master secret and using it to generate a symmetric key to complete the new SSL handshake.

Apparatus, comprising:

• a processor;
• computer memory holding program code adapted to be executed by the processor, the program code comprising:
• code to establish a secure connection to a client component of a proxy server;
• code to receive from the client component of the proxy server an encrypted pre-master secret associated with a new SSL handshake request, the SSL handshake request having been received at the client component of the proxy server from a client, the encrypted pre-master secret being received via the secure connection;
• code to decrypt the encrypted pre-master secret using a decryption key that is not otherwise accessible to the client component of the proxy server;
• and
• code to return a decrypted pre-master secret to the client component of the proxy server via the secure connection.