Security Gateway Interception of Untrusted Certificates

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies fail to adequately protect corporate data and computer environments from malicious activities involving untrusted security certificates, as users may unknowingly access secure websites with untrusted certificates, leaving networks vulnerable.

Innovation Solution

A security gateway intercepts secure data sessions between client and server devices, establishes a first secure session, and then a second secure session with the server, generates a gateway certificate if the server certificate is untrusted, and manages secure content transfer to apply security policies, ensuring interception and inspection of potentially malicious data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a security gateway intercepts secure data sessions to inspect content, then security inspection capability is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity inspection capabilityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security gateway acts as an intermediary between the client device and the untrusted server. It establishes a first secure session with the client and a second secure session with the server, intercepting data flows while maintaining security. The gateway generates a gateway certificate to facilitate this intermediary role, enabling content inspection without compromising the security sessions.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the secure communication into separate sessions: a first secure data session between the client and the security gateway, and a second secure data session between the server and the security gateway. This segmentation allows the gateway to inspect content while maintaining distinct security contexts for each communication path.

Inventive Principle:

Principle #1Segmentation

2Reliability

If the security gateway generates a gateway certificate for untrusted server certificates, then security policy enforcement is improved, but manufacturing precision (certificate management complexity) worsens

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidcertificate management complexity

Core Design Contradiction:

ReliabilityVSManufacturing precision

Solution Approach 1:

The security gateway performs preliminary actions by pre-establishing secure sessions and pre-generating gateway certificates before actual data transmission begins. The gateway intercepts the server's untrusted certificate and generates a corresponding gateway certificate in advance, enabling security policy enforcement before the client receives the untrusted certificate.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The gateway certificate serves as an intermediary credential that replaces the untrusted server certificate in the client's view. This intermediary certificate allows the client to trust the security gateway while the gateway maintains its own security context for policy enforcement.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Difficulty of detecting and measuring

If the security gateway intercepts and inspects all secure content, then detection of malicious activities is improved, but loss of time (inspection time) increases

Engineering Contradiction:

Improvedetection of malicious activitiesVSAvoidinspection time

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The security gateway applies partial inspection by selectively analyzing data based on security policies rather than inspecting all data uniformly. The gateway can prioritize inspection of high-risk content types or data matching specific criteria, reducing unnecessary inspection time while maintaining effective malicious activity detection.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS10116634B2Intercepting secure session upon receipt of untrusted certificate

Publication Date: 2018.10.30 A10 NETWORKS INC

AI summary

A method for intercepting, by a security gateway, a secure data session comprises the steps of establishing a first secure data session between a client device and a server device, intercepting the first secure data session by the security gateway, establishing a second secure data session between the server device and the security gateway, receiving a first secure session request from the client device, generating a second secure session request based on the first secure session request, receiving a server certificate from the server device, sending the second secure session request to the server device, receiving first secure content from the client device over the first secure data session, creating first encrypted secure content using the first secure content and the server certificate, and sending the first encrypted secure content to the server device over the second secure data session.