Cloud Security System Identifying Certificate-Pinned Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile applications that employ certificate pinning fail to function in enterprise environments with SSL interception proxies, leading to user experience issues and security challenges, as they reject connections with untrusted certificates, making it difficult for IT administrators to selectively turn off SSL interception for trusted applications and domains.
Innovation Solution
A context-aware tunneling protocol is implemented within a cloud security system to monitor and profile certificate-pinned applications, allowing selective SSL interception by passively observing handshake messages and creating profiles to determine whether to allow, block, or quarantine connections based on predefined criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL interception proxy is deployed to secure enterprise networks, then security against SSL-based threats is improved, but certificate-pinned applications fail to function due to rejection of untrusted certificates
Solution Approach 1:
The system applies different SSL interception policies to different applications based on their certificate pinning characteristics. Certificate-pinned applications are identified through monitoring and profiling, and SSL interception is selectively disabled for these specific applications while maintaining it for others, thus preserving their functionality while keeping security for non-pinned apps
Solution Approach 2:
A cloud-based service acts as an intermediary between the SSL interception proxy and certificate-pinned applications. The service monitors handshake messages to identify pinned apps, communicates this information to the proxy, and enables the proxy to adjust its behavior accordingly, mediating between security requirements and application functionality
2Ease of operation
If SSL interception is turned off for certificate-pinned applications, then application functionality is restored, but security coverage is reduced
Solution Approach 1:
The system implements a feedback mechanism where the cloud service continuously monitors SSL handshake messages from applications, identifies which ones use certificate pinning, and provides this information back to the SSL interception proxy. This feedback loop enables dynamic policy adjustment, allowing the system to maintain security coverage for non-pinned apps while excluding only the identified pinned apps from interception
Solution Approach 2:
The system segments the application population into two groups: certificate-pinned applications and non-pinned applications. By monitoring handshake messages and creating profiles, the system identifies pinned apps and applies different SSL interception policies to each segment, thereby maintaining security coverage for the majority of apps while ensuring functionality for pinned ones
3Adaptability or versatility
If manual configuration of SSL interception exemptions is implemented, then control over trusted applications is achieved, but administrative overhead and complexity increase
Solution Approach 1:
The system implements self-service by automatically monitoring SSL handshake messages, identifying certificate-pinned applications, and configuring SSL interception policies without requiring manual administrator intervention. The cloud-based service autonomously profiles applications, detects pinning behavior, and communicates findings to the proxy, eliminating the need for administrators to manually maintain exemption lists
Data Source
AI summary
Systems and methods of identifying and processing certificate pinned applications through a cloud based security system include monitoring traffic associated with a connection; developing a profile of an application associated with the traffic based on the monitoring, wherein the profile comprises whether or not the application is a certificate pinned application which requires a predefined set of criterion to be matched against an advertised certificate; and selectively performing SSL interception of the connection in the cloud based security system based on the profile. The monitoring can include monitoring handshake messages between a client and a server to determine a handshake status and a certificate status.