Encrypted SNI Filtering Using Plaintext Hostname Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to enforce communication policies when domain names in TLS-secured packets are encrypted using ESNI, as they cannot read the encrypted Server Name Indication (SNI) values, compromising network protection and policy enforcement.
Innovation Solution
Cybersecurity applications detect encrypted hostnames, resolve them to plaintext, and apply packet-filtering rules based on cyber threat intelligence (CTI) to protect networks and enforce policies, using methods like eSNI Domain Name Correspondence Lists (EDCL) and DNS-QUERY-TRACKER systems to determine the plaintext domain names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS encryption is used to secure communications, then security against eavesdropping is improved, but the ability to enforce communication policies and filter malicious traffic deteriorates
Solution Approach 1:
The system performs preliminary actions by establishing correspondence between encrypted SNI values and plaintext domain names before policy enforcement is needed. EDCLs and DNS-QUERY-TRACKER systems pre-resolve encrypted hostnames to plaintext equivalents, enabling subsequent policy enforcement without breaking encryption during active communication.
Solution Approach 2:
The patent introduces intermediary mechanisms (EDCLs and DNS-QUERY-TRACKER systems) that act as mediators between the encrypted TLS traffic and the policy enforcement system. These intermediaries translate encrypted SNI values into actionable plaintext domain names without exposing the actual encrypted communication content, thus maintaining security while enabling policy enforcement.
2Loss of information
If encrypted SNI values are used to protect privacy, then privacy preservation is improved, but the ability to detect and filter malicious domain names deteriorates
Solution Approach 1:
The system performs preliminary resolution of encrypted SNI values to plaintext domain names using EDCLs and DNS-QUERY-TRACKER systems before security filtering is applied. This allows the system to detect malicious domain names in their plaintext form while the actual communication remains encrypted, thus preserving privacy during transmission while enabling effective threat detection.
Solution Approach 2:
The patent introduces intermediary systems that temporarily translate encrypted SNI values into plaintext for security analysis purposes only. These intermediaries enable malicious traffic detection by providing plaintext domain names to filtering systems, while the actual communication traffic remains encrypted, thus balancing privacy preservation with security monitoring.
3Reliability
If domain names are encrypted in TLS packets, then security against malicious actors is improved, but network packet filtering effectiveness deteriorates
Solution Approach 1:
The system performs preliminary translation of encrypted SNI values to plaintext domain names using pre-computed EDCLs and DNS-QUERY-TRACKER systems before packet filtering is applied. This allows accurate matching of encrypted traffic against security policies and threat intelligence databases while maintaining encryption during the actual communication, thus preserving both security and filtering accuracy.
Solution Approach 2:
The patent introduces intermediary translation mechanisms that convert encrypted SNI values into plaintext equivalents for the purpose of accurate packet filtering. These intermediaries enable precise matching against security policies and threat databases without requiring the actual communication to be unencrypted, thus maintaining both encryption security and filtering precision.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A packet-filtering system described herein may be configured to filter packets with encrypted hostnames in accordance with one or packet-filtering rules. The packet-filtering system may resolve a plaintext hostname from ciphertext comprising an encrypted Server Name Indication (eSNI) value. The packet-filtering system may resolve the plaintext hostname using a plurality of techniques. Once the plaintext hostname is resolved, the packet-filtering system may then use the plaintext hostname to determine whether the packets are associated with one or more threat indicators. If the packet-filtering system determines that the packets are associated with one or more threat indicators, the packet-filtering system may apply a packet filtering operation associated with the packet-filtering rules to the packets.