Encrypted Handshake Filtering via Surrogate Key Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing use of encrypted communication protocols, such as DNS over HTTPS and TLS with encrypted handshakes, poses a challenge for traditional traffic filtering methods, as they prevent intermediaries from inspecting and filtering encrypted traffic.
Innovation Solution
A method and system that intercept and decrypt the encrypted section of a client handshake message using a surrogate decryption key, allowing access policy enforcement by identifying the remote content server and determining if access is allowed, and then modifying the handshake message with the genuine encryption key for continued communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encrypted communication protocols (DNS over HTTPS, TLS with encrypted handshakes) are used to protect user privacy, then user privacy is improved, but traffic filtering capability deteriorates
Solution Approach 1:
The patent introduces a surrogate key as an intermediary element that enables the traffic filter to decrypt and inspect encrypted handshake messages without directly compromising the end-to-end encryption between client and server. The surrogate key acts as a mediator that allows controlled access to encrypted traffic for security filtering purposes while preserving user privacy for legitimate communications.
2Reliability
If conventional traffic filtering methods are used to block malicious content, then computer security is improved, but user privacy deteriorates due to inspection of encrypted traffic
Solution Approach 1:
The patent applies preliminary action by decrypting and filtering the handshake message before the actual encrypted communication session is established. This allows security filtering to occur at the handshake stage when the surrogate key is still valid, without requiring decryption of the entire communication session, thus preserving user privacy during the actual data transfer.
3Ease of operation
If encrypted handshake messages are decrypted for access policy enforcement, then access control capability is improved, but encryption security deteriorates
Solution Approach 1:
The patent segments the encryption security into two distinct layers: the surrogate key encryption layer used for access control during handshake, and the genuine encryption key layer used for secure communication. This segmentation allows access policy enforcement on the handshake message without compromising the security of the actual communication encryption, as the surrogate key is specifically designed for filtering purposes only.
Data Source
AI summary
Described systems and methods protect client devices such as personal computers and IoT devices against harmful or inappropriate Internet content. When a client uses an encrypted handshake to hide the identity of the end server, e.g., in applications implementing an encrypted client hello (ECH), some embodiments employ a modified DNS server to provide a surrogate key to the client instead of the genuine handshake key. A traffic filter executing for instance on a network gateway may then intercept and decrypt the handshake and apply an access policy to selectively allow or deny access to the respective end server. When access is allowed, the traffic filter may re-encrypt the server identifier using the genuine handshake key before forwarding the handshake to its destination. Communication privacy is maintained since the illustrated methods only decrypt the handshake, and not the actual payload.