Firewall TLS Session Bypass for DPI-SSL NAT Deployments

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Legacy firewall implementations interrupt the TCP connection between a client device and a firewall when initiating a TLS session, causing unnecessary delays and potential fatal errors in applications, as they terminate the connection to refresh or establish a new one.

Innovation Solution

The firewall holds the TLS hello message until it validates the server credentials, then initiates a TLS session by sending a new TLS client hello message, allowing the TCP connection between the client device and the firewall to remain intact, thus avoiding interruption and enabling seamless TLS session establishment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the firewall terminates the TCP connection to refresh or establish a new one when initiating a TLS session, then the TLS session can be established, but the connection interruption causes unnecessary delays and potential fatal errors in applications

Engineering Contradiction:

ImproveTLS session establishmentVSAvoidconnection interruption delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The firewall performs preliminary validation of server credentials and establishes the TLS session before terminating the TCP connection. By validating the server certificate and setting up the TLS tunnel in advance, the firewall ensures that when the connection needs to be refreshed, the TLS session is already established and can be maintained through the tunnel, avoiding interruption delays

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The firewall acts as an intermediary by establishing a separate TLS session with the server independent of the client-firewall TCP connection. The TLS tunnel created through the firewall allows the firewall to refresh the TCP connection without affecting the established TLS session, as the TLS handshake occurs through the firewall's mediation rather than directly between client and server

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If the firewall inspects messages using DPI-SSL software to identify cyber-threats, then security is improved, but the inspection process interrupts the TCP connection to validate credentials

Engineering Contradiction:

Improvecyber-threat detectionVSAvoidconnection continuity

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The firewall segments the security inspection process from the data transmission process. By separating the TLS handshake/validation phase (where DPI-SSL inspection occurs) from the established tunnel phase (where data flows uninterrupted), the firewall can perform thorough security checks without continuously interrupting the TCP connection once the TLS session is established

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The firewall performs all necessary security inspections and credential validations during the preliminary TLS handshake phase before the TCP connection is terminated or refreshed. By completing DPI-SSL inspection and server credential validation in advance, the firewall ensures that subsequent data transmission through the tunnel occurs without interruption, as the security checks are already completed

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9998425B2Dynamic bypass of TLS connections matching exclusion list in DPI-SSL in a NAT deployment

Publication Date: 2018.06.12 QUEST SOFTWARE INC

AI summary

The present invention provides the initiation of a transport layer security (TLS) session between a client device and a server using a firewall without interruption. The present invention holds a TLS hello message received from the client device until after the server has been validated. A firewall consistent with the present invention does not interrupt a transport layer control (TCP) connection that was established between the client device and the firewall before the TLS hello message was received by the firewall.