ATLS Bootstrap for Devices Behind TLS Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices face challenges in establishing a secure connection to cloud services when deployed on secure networks that use TLS interception proxies, as these proxies can break the network layer TLS connection, preventing successful bootstrapping and management.
Innovation Solution
The implementation of Application Layer Transport Layer Security (ATLS) allows devices to establish a secure connection to cloud services by transporting TLS records in HTTP message bodies, bypassing TLS interception proxies and enabling zero-touch secure bootstrapping by leveraging cloud services to authenticate and obtain necessary credentials for local domain access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS interception proxies are deployed on secure networks to intercept all Internet traffic, then network security is improved, but devices are prevented from establishing secure connections to cloud services, blocking successful bootstrapping
Solution Approach 1:
The patent introduces an Application Layer TLS (ATLS) intermediary that operates above the network layer to establish secure connections. Instead of using traditional TLS at the transport layer which is intercepted by proxies, the invention uses HTTP/HTTPS as a carrier to transport TLS records at the application layer, allowing secure communication to pass through TLS interception proxies without being blocked.
Solution Approach 2:
The patent moves the TLS connection from the network/transport layer to the application layer, effectively changing the dimensional level at which security operations occur. By embedding TLS records within HTTP message bodies, the solution operates in a different protocol layer dimension that is not subject to transport layer TLS interception, thereby bypassing the proxy blocking mechanism while maintaining security.
2Reliability
If traditional TLS connections are used for device bootstrapping, then secure communication is established, but TLS interception proxies break the connection, preventing access to cloud services
Solution Approach 1:
The ATLS mechanism uses HTTP/HTTPS as an intermediary carrier to transport TLS records. This intermediary layer allows the secure TLS communication to be encapsulated within standard web protocols that are permitted through TLS interception proxies, maintaining both security and compatibility with proxy environments simultaneously.
Solution Approach 2:
The patent changes the operational parameters of TLS by moving it from transport layer to application layer, and by transporting TLS records within HTTP message bodies instead of using direct TCP connections. This parameter change in protocol layer and transport mechanism enables compatibility with TLS interception proxy environments while preserving secure communication capabilities.
3Reliability
If manual configuration is used for device provisioning on secure networks, then devices can be set up, but the process is difficult, time-consuming, expensive and complex
Solution Approach 1:
The patent enables devices to perform self-service bootstrapping by automatically establishing ATLS connections to cloud services. The device autonomously retrieves credentials, certificate authority information, and configuration data without requiring manual intervention, thereby eliminating the time-consuming and complex manual provisioning process while ensuring reliable device setup.
Solution Approach 2:
The invention implements preliminary action by pre-configuring devices with manufacturer certificates and enabling them to automatically perform bootstrapping operations upon first power-up. The device is prepared in advance with necessary security credentials, allowing it to independently establish secure connections and retrieve operational parameters without waiting for manual configuration.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes establishing an application layer transport layer security (ATLS) connection between a network device and a cloud server by sending, from the network device, TLS records in transport protocol (e.g., HTTP) message bodies to the cloud server, the ATLS connection transiting at least one transport layer security (TLS) proxy device, receiving, from the cloud server via the ATLS connection, an identifier for a certificate authority, establishing a connection with the certificate authority associated with the identifier and, in turn, receiving from the certificate authority credentials to access an application service different from the cloud server and the certificate authority, and connecting to the application service using the credentials received from the certificate authority.