Dynamic Decryption Mode Selection for Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication methods face inefficiencies in managing both perfect forward secrecy (PFS) and non-PFS sessions, particularly due to performance penalties associated with active proxying, which can compromise the benefits of PFS and increase the risk of session key attacks.
Innovation Solution
A computer-implemented method that dynamically selects between active and passive decryption modes based on the most probable mode from past sessions, validating the chosen mode and switching only if it satisfies an impact criterion, thereby optimizing decryption performance by predicting retry times and active session durations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If active proxying is used to decrypt PFS sessions, then security benefits are maintained, but performance penalty increases due to doubled network RTT and cryptographic operations
Solution Approach 1:
The system dynamically switches between active and passive decryption modes based on session type detection. For PFS sessions, active proxying is used to maintain security benefits. For non-PFS sessions, passive decryption is used to avoid performance penalties. This dynamic adaptation resolves the contradiction by applying the appropriate mode depending on the session characteristics.
Solution Approach 2:
The system changes the decryption mode parameter based on the session type. By detecting whether a session uses PFS or non-PFS and adjusting the decryption approach accordingly, the system optimizes performance while maintaining security where needed. This parameter change allows the middlebox to adapt its behavior to minimize overhead.
2Productivity
If passive decryption is used for non-PFS sessions, then performance is improved, but security is compromised due to loss of forward secrecy
Solution Approach 1:
The system applies different decryption qualities to different session types. For PFS sessions, active proxying with full security measures is applied. For non-PFS sessions, passive decryption with reduced security measures is applied. This local differentiation allows optimization of performance where security is less critical while maintaining security where it matters most.
3Reliability
If active proxying is used for all sessions, then security is maintained, but network RTT is doubled and cryptographic operations increase
Solution Approach 1:
The system segments traffic into PFS and non-PFS sessions based on session type detection. Different decryption approaches are applied to each segment: active proxying for PFS sessions to maintain security, and passive decryption for non-PFS sessions to reduce RTT. This segmentation allows the system to optimize for different requirements in different traffic segments.
4Ease of operation
If session key exportation is used, then decryption is enabled, but risk of session key theft increases
Solution Approach 1:
The system uses an intermediary approach where the middlebox establishes its own session keys with the server rather than exporting session keys. This intermediary key establishment mechanism enables decryption capability while avoiding the direct exposure of session keys to potential attackers, thus reducing theft risk.
Data Source
AI summary
A computer-implemented method and a computer system are provided for selecting active or passive decryption mode when observing network traffic between a downstream client and an upstream server. The method includes selecting a decryption mode in an initial stage of setting up a secure session based on a determination of a most probable decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when the client initiates a transport layer connection before the transport layer connection or the secure session is established. The method further includes validating the selected decryption mode at least once during the secure session based on whether the selected decryption mode is actually and/or is probably supported based on security algorithms supported by the client and/or server, and switching the decryption mode based on a result of validating the selected decryption mode.