Client Certificate Delegation for SSL Inspection with PFS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network traffic management apparatuses are unable to effectively analyze or provide services for SSL connections between client and server devices, especially when using Perfect Forward Secrecy (PFS) encryption, due to limitations in existing SSL tunneling and ProxySSL methods, which restrict their ability to inspect payload data and utilize intelligence for services like load balancing and security.
Innovation Solution
A method for client certificate delegation, where a network traffic management apparatus receives a request from a client device, validates the certificate, extracts relevant data, generates a delegate certificate signed by a trusted certificate authority, and sends it to the server, enabling the apparatus to establish SSL connections and inspect payload data while supporting PFS-capable ciphers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL tunneling is used to establish end-to-end SSL sessions, then client devices can pass certificates to server devices, but network traffic management apparatuses cannot analyze data above OSI layer 4 or provide proxy functions
Solution Approach 1:
The patent introduces a certificate delegation mechanism where the network traffic management apparatus acts as an intermediary. It receives the client's original certificate, validates it, extracts relevant data, generates a delegate certificate, and presents it to the server. This intermediary approach allows the apparatus to maintain SSL session intelligence and analyze payload data while still enabling secure end-to-end communication between client and server.
2Productivity
If ProxySSL is used to allow network traffic management apparatus to decrypt and inspect payload data, then payload analysis is enabled, but it does not support all cipher suites especially PFS encryption
Solution Approach 1:
The patent employs a copying approach by creating a delegate certificate that replicates the essential authentication information from the original client certificate. Instead of attempting to decrypt PFS-encrypted traffic directly (which requires breaking the encryption), the apparatus copies the certificate data, validates it, and uses this copied information to authenticate the client to the server while maintaining the ability to inspect payload data through other means.
3Reliability
If network traffic management apparatus does not have client private key, then client certificate security is maintained, but apparatus cannot re-sign certificate to present to server device
Solution Approach 1:
The patent segments the certificate functionality into two distinct parts: the original client certificate used for client-apparatus authentication, and a newly generated delegate certificate used for apparatus-server authentication. This segmentation allows the apparatus to maintain security by never possessing the client's private key, while still enabling certificate presentation to the server through the delegate certificate that contains only the necessary public key information and attributes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, non-transitory computer readable media, and network traffic management apparatuses that receive a request from a client device to access an application. The request comprises an original certificate. A determination is made when the certificate is valid. Data is extracted from one or more fields of the certificate, when the determining indicates that the user certificate is valid. A delegate certificate comprising the data and signed by a certificate authority trusted by a server device hosting the application is generated. The delegate certificate is sent to the server device. With this technology, network traffic management apparatuses can secure SSL connections using PFS-capable ciphers, while also inspecting payload data in network traffic exchanged between client and server devices in order to provide intelligent services in the network.