Distributed SSL Processing via Client-Server Proxy Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL protocols prevent legitimate proxies, such as content filters or caches, from intercepting and processing SSL communications, as they are designed to ensure security by excluding any intermediate entities, which can hinder legitimate uses like acceleration and monitoring of SSL encrypted content.
Innovation Solution
A distributed SSL processing system using a client-side and server-side proxy that intercepts SSL transactions, enables secure communication between them, and splits SSL processing tasks to allow transparent operation to the server, enabling acceleration and monitoring while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL protocol is designed to ensure security by excluding intermediate entities, then security is improved, but legitimate proxies cannot intercept and process SSL communications
Solution Approach 1:
The patent segments the SSL processing function into two separate proxy components: a client-side proxy that intercepts communications from the client and a server-side proxy that communicates with the server. This segmentation allows each proxy to handle specific parts of the SSL transaction while maintaining overall security. The client-side proxy establishes an SSL connection with the client, while the server-side proxy establishes a separate SSL connection with the server, enabling legitimate interception and processing without compromising end-to-end security.
Solution Approach 2:
The patent introduces an intermediary mechanism where the client-side proxy and server-side proxy exchange cryptographic keys and session information through a secure channel. This intermediary approach allows the proxies to participate in the SSL communication stream while maintaining the security guarantees of the protocol. The server-side proxy acts as a mediator by receiving encrypted traffic from the server, decrypting it using keys obtained from the client-side proxy, and forwarding it to the client, thus enabling legitimate monitoring and acceleration functions.
2Productivity
If a server-side accelerator intercepts SSL connections and establishes secure connections with clients, then SSL processing capability is improved, but the server sees SSL packets generated at the accelerator making it non-transparent
Solution Approach 1:
The patent inverts the traditional architecture by placing the SSL processing capability at the client-side rather than the server-side. The client-side proxy establishes the SSL connection with the client and generates the SSL packets, while the server-side proxy simply forwards these packets to the server without modification. This inversion makes the server transparent because it only sees SSL packets that appear to originate from the client, eliminating the complexity of server-side SSL generation while maintaining full SSL processing capability.
Solution Approach 2:
The server-side proxy creates a copy of the SSL connection established by the client-side proxy. Instead of the server generating SSL packets, the client-side proxy generates them and the server-side proxy receives copies of these packets, decrypts them using the shared session keys, and forwards the decrypted content to the client. This copying mechanism enables the server to remain transparent while still allowing the proxy system to perform acceleration and monitoring functions on the SSL traffic.
3Adaptability or versatility
If proxies are used to act as caches, content filters, or virus filters, then legitimate monitoring and acceleration functions are improved, but SSL protocol prevents them from participating in the communication stream
Solution Approach 1:
The patent introduces dynamic behavior where the proxy system adapts its operation mode based on the SSL session state. The client-side proxy dynamically establishes SSL connections with clients, exchanges cryptographic keys with the server-side proxy, and adjusts its processing based on the session requirements. The server-side proxy dynamically receives encrypted traffic, decrypts it using session-specific keys, and forwards it appropriately. This dynamic adaptation allows proxies to perform caching, filtering, and acceleration functions while maintaining compliance with SSL security requirements throughout the communication lifecycle.
Data Source
AI summary
A secure communication protocol (e.g., SSL) transaction request from a client to a server is intercepted at a client-side proxy communicatively coupled to the client and logically deployed between the client and the server. The client-side proxy initiates a secure connection with the server and passes an attribute (e.g., a cryptographic key) associated with that secure connection to a server-side proxy communicatively coupled to the server and logically deployed between the client and the server. This enables the server-side proxy to engage in secure communications with the server in a transparent fashion.