Cloud Proxy SSL/TLS Handshake for Multi-Domain IP Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional SSL implementations in cloud environments face challenges with name-based virtual hosting, requiring separate IP addresses for each virtual host due to the lack of Server Name Indication (SNI) support in all browsers and operating systems, leading to scalability issues and increased resource utilization.

Innovation Solution

A cloud-based proxy service that negotiates secure sessions using a single IP address by including the Server Name Indication (SNI) extension in the SSL/TLS handshake, allowing multiple domains to share the same IP address and enabling the use of a single digital certificate with Subject Alternate Name (SAN) extensions, which includes multiple domains, thereby supporting name-based virtual hosting.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If traditional SSL is used without SNI support, then compatibility with older browsers and operating systems is improved, but separate IP addresses are required for each virtual host causing scalability issues

Engineering Contradiction:

ImprovecompatibilityVSAvoidIP address allocation

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

Multiple virtual hosts share a single IP address by combining their SSL/TLS handshakes into a unified process where the server identifies the intended host based on the Host header field after the handshake completes, eliminating the need for separate IP addresses per virtual host

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The SSL/TLS handshake process is made dynamic by allowing the server to determine the destination host during the handshake based on the Host header field, enabling flexible host identification without requiring SNI extension support from clients

Inventive Principle:

Principle #15Dynamics

2Device complexity

If separate IP addresses are assigned to each virtual host, then SSL/TLS handshake simplicity is maintained, but resource consumption and scalability are worsened

Engineering Contradiction:

Improvehandshake procedureVSAvoidIP address consumption

Core Design Contradiction:

Device complexityVSQuantity of substance

Solution Approach 1:

A single IP address serves multiple virtual hosts by implementing name-based virtual hosting where the server distinguishes between different hosts using the Host header field during the SSL/TLS handshake, allowing one IP to perform multiple hosting functions

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Quantity of substance

If name-based virtual hosting is implemented without SNI, then IP address efficiency is improved, but the SSL/TLS handshake process becomes more complex

Engineering Contradiction:

ImproveIP address utilizationVSAvoidhandshake procedure

Core Design Contradiction:

Quantity of substanceVSDevice complexity

Solution Approach 1:

The server performs preliminary actions by receiving and processing the Host header field during the SSL/TLS handshake to identify the destination host before completing the secure session establishment, enabling name-based virtual hosting without requiring SNI extension

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11546175B2Detecting and isolating an attack directed at an IP address associated with a digital certificate bound with multiple domains

Publication Date: 2023.01.03 CLOUDFLARE INC

AI summary

An attack is detected on a first IP address and a determination is made that the first IP address is associated with a primary digital certificate that is bound with multiple different domains. For each of these domains, a secondary certificate is accessed that is bound only to that domain and that secondary certificate is associated with a unique IP address such that each of the different domains has a unique IP address associated with its secondary certificate respectively. The attack is isolated to the domain the attack follows.