Firewall Bypass Using TLS Fingerprint Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewalls are not compatible with encrypted communications between client devices and servers due to their inability to decrypt and authenticate SSL sessions, leading to failed secure sessions and the impracticality of maintaining an ever-expanding exclusion list of trusted applications and browsers.
Innovation Solution
A method where a computing device intercepts TLS hello messages, generates fingerprints from client and server information, and matches them against stored data to bypass decryption processes, allowing secure communication without relying on extensive exclusion lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a firewall acts as a man in the middle to decrypt encrypted communications, then the firewall can inspect traffic, but the client device authentication fails because the modified certificate does not match stored certificates
Solution Approach 1:
The patent extracts the certificate validation step from the standard SSL/TLS handshake process. Instead of validating certificates through the firewall (which modifies them), the system obtains certificate information directly from the client device, bypassing the broken trust chain caused by firewall certificate modification.
Solution Approach 2:
The patent introduces a new intermediary mechanism - obtaining certificate information directly from the client device rather than through the firewall. This alternative information path mediates between the firewall's need to inspect traffic and the client's need for authentic certificate validation.
2Reliability
If a firewall maintains an exclusion list of trusted applications and browsers, then secure communication can be established, but the list becomes unmanageably large and computationally burdensome
Solution Approach 1:
The patent uses fingerprinting to create a compact representation (copy) of application and browser characteristics. Instead of maintaining exhaustive exclusion lists of individual applications and browsers, the system creates fingerprint templates that represent categories of trusted applications, dramatically reducing list size while maintaining security.
Solution Approach 2:
The patent changes the parameter space from individual application identifiers to fingerprint-based categorization. By transforming the matching criterion from exact application names to fingerprint patterns, the system reduces the complexity of the exclusion list while maintaining the ability to identify and trust legitimate applications.
3Reliability
If the firewall inspects every encrypted communication, then security is maintained, but computational resources are exhausted and new applications cannot be authenticated
Solution Approach 1:
The patent performs preliminary fingerprinting of client and server information during the initial TLS hello message exchange. By pre-computing and storing these fingerprints before actual communication begins, the system prepares authentication data in advance, enabling rapid matching and bypassing of decryption processes for future connections from the same applications.
Solution Approach 2:
The patent implements dynamic fingerprint matching that adapts to different applications and browsers. The system continuously learns and updates fingerprint templates based on observed traffic patterns, making the authentication process increasingly efficient over time while maintaining security against new applications.
Data Source
AI summary
Methods and apparatus consistent with the present disclosure may prevent a computer process from failing when a firewall located between a client device and a server identifies that a process at the firewall should be bypassed using fingerprint information associated with a connection attempt. When fingerprint information stored at a firewall matches previously received fingerprint information, the firewall may allow processes typically performed at the firewall to be bypassed, thereby, allowing communications to pass between the client device and the server without inspection. When that fingerprint information does not match previously received fingerprint information, the firewall may perform a process that causes the client device to fail the first connection attempt. Because of this, methods consistent with the present disclosure may allow communications from an application program to be passed through a firewall without relying on an ever growing list of trusted application programs.