ECH Resolver Extracting SNI from Encrypted TLS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing proportion of encrypted web traffic poses challenges for security monitoring, as solutions like safe browsing and advanced content control features are broken by encryption methods such as the Encrypted Client Hello (ECH) extension to TLS, which encrypts the Server Name Indication (SNI) making it unextractable.
Innovation Solution
The solution involves using Internet Protocol (IP) related enrichment and classification to accurately map IP addresses to domains, enabling the extraction of SNI from encrypted Client Hello messages, and utilizing new DNS resource records like SVCB and CNAME aliasing to support alternative HTTPS endpoints, thereby maintaining security and privacy while allowing for web reputation checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted web traffic is used to protect security and privacy, then security and privacy are improved, but security monitoring capability deteriorates
Solution Approach 1:
The patent extracts the SNI information from the encrypted Client Hello message by utilizing the ECH resolver service. The resolver decrypts the SNI field using public keys obtained from DNS queries, allowing security monitoring systems to access the server name information without decrypting the entire TLS connection. This selective extraction maintains end-to-end encryption while enabling necessary security monitoring.
Solution Approach 2:
The ECH resolver acts as an intermediary between the client and server during the TLS handshake process. It receives the encrypted Client Hello, decrypts the SNI field using public keys from DNS records, and forwards the decrypted information to security monitoring systems. This intermediary enables security monitoring without compromising the encrypted communication channel between client and server.
2Loss of information
If ECH extension is implemented to encrypt SNI, then privacy is improved, but safe browsing and content control features are broken
Solution Approach 1:
The patent extracts SNI information from the encrypted ECH Client Hello message by using the ECH resolver service with public keys obtained from DNS queries. This extraction enables safe browsing and content control features to function by providing access to server name information while maintaining the encrypted communication channel, thus preserving privacy without breaking security features.
Solution Approach 2:
The system performs preliminary actions by obtaining public keys through DNS queries before the TLS handshake completes. The ECH resolver uses these pre-obtained public keys to decrypt the SNI field, enabling security monitoring and content control features to be activated in advance, ensuring safe browsing protection is available before full connection establishment.
3Difficulty of detecting and measuring
If IP address mapping to domains is used for monitoring, then security monitoring is improved, but precision deteriorates due to multiple domains sharing IP addresses
Solution Approach 1:
The patent extracts the specific SNI information from the encrypted Client Hello message, which directly identifies the intended domain. This extraction resolves the ambiguity caused by multiple domains sharing IP addresses, as the SNI field contains the precise domain name the client intends to connect to, enabling accurate domain identification for security monitoring.
Solution Approach 2:
The system changes the monitoring parameter from IP address-based identification to SNI-based identification. By extracting and using the SNI field from the ECH handshake, the system transitions from imprecise IP address mapping to precise domain name identification, significantly improving measurement precision for security monitoring purposes.
Data Source
AI summary
A computing device receives an IP address extracted from an encrypted client hello (ECH) enabled transport layer security (TLS) connection request from a client computing device and identifies, from a list of a plurality of hostnames, a set of hostnames matching the IP address. The device generates a reduced list of the set hostnames matching the IP address and generates a reduced list of the set of hostnames matching the IP address by removing hostnames that do not support an ECH extension of a TLS standard from the set of hostnames matching the IP address. Finally, the device retrieves reputation information related to one or more hostnames of the reduced list for protecting the client computing device and/or a computer network based on the reputation information.