Encrypted Data Session Context Keys for In-Network Functionality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure TLS protocols assume all functionality resides at endpoints, preventing the use of in-network services that optimize network resource usage and protect clients and servers from security threats, and current solutions for integrating middleboxes into TLS sessions either weaken security or lack authentication and access control.
Innovation Solution
The method involves establishing an encrypted data session with context keys computed using a pseudo-random function, allowing computing network elements to perform specific actions on encrypted communication data by negotiating symmetric keys and providing certificates for authentication, enabling explicit control over in-network functionality while maintaining data integrity and authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS protocol is used to provide end-to-end encryption, then data confidentiality and authenticity are improved, but in-network functionality such as middleboxes for intrusion detection, content filtering, and caching cannot be utilized
Solution Approach 1:
The encrypted data stream is segmented into multiple contexts, each with its own encryption keys. This allows selective decryption of specific data portions at middleboxes while maintaining end-to-end encryption for other data portions, enabling in-network functionality without compromising overall data confidentiality.
Solution Approach 2:
Different portions of the data stream are encrypted with different keys based on their access requirements. This local differentiation allows middleboxes to access only the specific data contexts they need while other contexts remain encrypted, resolving the contradiction between confidentiality and in-network functionality.
2Productivity
If middleboxes are inserted into TLS sessions to provide in-network services, then network resource optimization and security protection are improved, but security is weakened due to lack of authentication and access control
Solution Approach 1:
The patent introduces context keys as intermediaries that mediate between the end-to-end encrypted stream and middlebox access requirements. These context keys enable authenticated middleboxes to selectively access specific data contexts while maintaining security controls, resolving the contradiction between enabling in-network services and maintaining security.
Solution Approach 2:
The system dynamically negotiates context keys and access permissions during the TLS handshake process. This dynamic approach allows security parameters to be adapted based on the specific middlebox requirements while maintaining overall security, enabling both network optimization and security protection.
3Measurement precision
If custom root certificates are used to enable middlebox authentication, then middlebox identity verification is improved, but client control over data sharing and detection of in-flight modifications is lost
Solution Approach 1:
The patent segments the encryption scheme into multiple context keys, each controlling access to specific data contexts. This segmentation gives clients fine-grained control over which data portions are shared with middleboxes, while still enabling middlebox identity verification through the key negotiation process, resolving the contradiction between verification precision and client control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, a system and computer program products for securely enabling in-network functionality over encrypted data sessions, the method comprising: establishing an encrypted data session between a client communication application (100) and a server communication application (200) over a communication network; receiving and/or transmitting, by the client communication application (100), in said established encrypted data session, at least one encrypted communication data (D) from/to said server communication application (200) through at least one computing network element (M); and performing, by the computing network element (M), different actions other than data packet forwarding from one communication application to the other on the encrypted communication data (D), wherein the encrypted communication data (D) comprises a plurality of data portions, or contexts, (CTX), each one being encrypted by a context key, and said different actions being specific for said computing network element (M) and for one or more of said plurality of contexts (CTX_X).