Client Certificate Delegation for SSL Inspection with PFS

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Network traffic management apparatuses are unable to effectively analyze or provide services for SSL connections between client and server devices, especially when using Perfect Forward Secrecy (PFS) encryption, due to limitations in existing SSL tunneling and ProxySSL methods, which restrict their ability to inspect payload data and utilize intelligence for services like load balancing and security.

Innovation Solution

A method for client certificate delegation, where a network traffic management apparatus receives a request from a client device, validates the certificate, extracts relevant data, generates a delegate certificate signed by a trusted certificate authority, and sends it to the server, enabling the apparatus to establish SSL connections and inspect payload data while supporting PFS-capable ciphers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SSL tunneling is used to establish end-to-end SSL sessions, then client devices can pass certificates to server devices, but network traffic management apparatuses cannot analyze data above OSI layer 4 or provide proxy functions

Engineering Contradiction:
Improveend-to-end SSL session establishmentVSAvoidpayload data analysis capability
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent introduces a certificate delegation mechanism where the network traffic management apparatus acts as an intermediary. It receives the client's original certificate, validates it, extracts relevant data, generates a delegate certificate, and presents it to the server. This intermediary approach allows the apparatus to maintain SSL session intelligence and analyze payload data while still enabling secure end-to-end communication between client and server.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Productivity

If ProxySSL is used to allow network traffic management apparatus to decrypt and inspect payload data, then payload analysis is enabled, but it does not support all cipher suites especially PFS encryption

Engineering Contradiction:
Improvepayload data inspection capabilityVSAvoidcipher suite compatibility
Core Design Contradiction:
ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent employs a copying approach by creating a delegate certificate that replicates the essential authentication information from the original client certificate. Instead of attempting to decrypt PFS-encrypted traffic directly (which requires breaking the encryption), the apparatus copies the certificate data, validates it, and uses this copied information to authenticate the client to the server while maintaining the ability to inspect payload data through other means.

Inventive Principle:
Principle #26Copying

3Reliability

If network traffic management apparatus does not have client private key, then client certificate security is maintained, but apparatus cannot re-sign certificate to present to server device

Engineering Contradiction:
Improvecertificate securityVSAvoidcertificate presentation capability
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent segments the certificate functionality into two distinct parts: the original client certificate used for client-apparatus authentication, and a newly generated delegate certificate used for apparatus-server authentication. This segmentation allows the apparatus to maintain security by never possessing the client's private key, while still enabling certificate presentation to the server through the delegate certificate that contains only the necessary public key information and attributes.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP3220604B1Methods for client certificate delegation and devices thereof
Publication Date: 2018.11.07 F5 NETWORKS INC
  • EP3220604B1 patent drawingFigure 1
  • EP3220604B1 patent drawingFigure 2
  • EP3220604B1 patent drawingFigure 3

AI summary

Methods, non-transitory computer readable media, and network traffic management apparatuses that receive a request from a client device to access an application. The request comprises an original certificate. A determination is made when the certificate is valid. Data is extracted from one or more fields of the certificate, when the determining indicates that the user certificate is valid. A delegate certificate comprising the data and signed by a certificate authority trusted by a server device hosting the application is generated. The delegate certificate is sent to the server device. With this technology, network traffic management apparatuses can secure SSL connections using PFS-capable ciphers, while also inspecting payload data in network traffic exchanged between client and server devices in order to provide intelligent services in the network.