Certificate-Pinned Session Proxy for Encrypted Traffic Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based network security systems lack visibility into encrypted sessions using certificate-pinning protocols, preventing effective data loss prevention and security policy enforcement.
Innovation Solution
A method involving an endpoint routing client that buffers encrypted packets, extracts session keys, and decrypts traffic using an inspection proxy to enable security monitoring and policy enforcement for certificate-pinned applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate pinning is implemented for secure connections, then security against man-in-the-middle attacks is improved, but visibility into encrypted sessions for security monitoring is lost
Solution Approach 1:
The patent introduces a proxy server as an intermediary component that acts as a man-in-the-middle between the client and the cloud-based resource. The proxy server establishes separate TLS connections with both endpoints, obtaining certificates from each. By pinning both the resource's certificate and the proxy's own certificate, the system maintains security while enabling the proxy to decrypt and inspect encrypted traffic without breaking the security model.
2Reliability
If certificate pinning is used to prevent key distribution issues, then authentication security is improved, but the ability to proxy TCP connections is prevented
Solution Approach 1:
The patent segments the TLS connection into two separate connections: one between the client and the proxy, and another between the proxy and the cloud-based resource. Each connection has its own certificate pinning validation. This segmentation allows the proxy to independently manage and validate certificates for each connection, enabling TCP connection proxying while maintaining authentication security through certificate pinning.
3Reliability
If end-to-end encryption is implemented, then data security is improved, but data loss prevention and security policy enforcement capability is lost
Solution Approach 1:
The proxy server acts as an intermediary that terminates the encrypted connection from the client, decrypts the traffic, inspects it for security policies and data loss prevention rules, then re-encrypts and forwards it to the cloud-based resource. This intermediary approach maintains end-to-end encryption security while enabling DLP and security policy enforcement through the proxy's ability to decrypt and inspect the traffic.
Data Source
AI summary
The disclosed technology teaches a method for security monitoring in TLS or other certificate-pinned sessions by a cloud-based network security system. An endpoint routing client directs sessions through an inspection proxy by secure tunneling. A secure web gateway buffers encrypted packets in a new session with a cloud-based resource, detects a connection access request from a certificate-pinned application, requests and receives key extraction, and forwards keys to the security system. Traffic is buffered for decryption and forwarded without modification until the keys are available. The keys are applied to allow decryption and re-encryption, on a proxy basis, of traffic between the client and a cloud based system. The inspection proxy applies security policies, even to the TLS or other certificate-pinned session.