Intermediary Device Decoupling TCP and TLS Roles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing TLS connections between client devices located behind network security devices is challenging due to the limitation that TCP roles dictate TLS roles, causing a conflict with the TLS connection handshake protocol, which requires one TLS client and one TLS server.
Innovation Solution
Decoupling TCP roles from TLS roles by allowing the intermediary device to independently determine transport and security protocol roles for each client device, enabling flexible and extensible secure transport connections without being constrained by TCP role selection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP roles are used to determine TLS roles in connections between client devices behind NAT devices, then the TLS connection establishment follows the standard protocol, but the conflict arises because both devices are forced to act as TCP clients, making it impossible to establish a valid TLS connection which requires one client and one server
Solution Approach 1:
The patent segments the role determination process into two independent parts: TCP role selection and TLS role selection. The intermediary device allows each client device to independently select its TCP role (both as clients) while separately determining TLS roles (one as client, one as server) based on different criteria such as device characteristics or negotiation, thus resolving the conflict between TCP and TLS protocol requirements
Solution Approach 2:
The intermediary device acts as a mediator that decouples the TCP and TLS layer role assignments. It receives connection requests from both client devices, determines appropriate TLS roles independently from TCP roles, and coordinates the role assignment to ensure valid TLS connection establishment while maintaining NAT traversal requirements
2Object-affected harmful factors
If both client devices act as TCP clients to traverse NAT devices, then network security requirements are met, but the TLS protocol cannot be properly established because it requires asymmetric roles (one client, one server)
Solution Approach 1:
The patent separates the security function (TCP client role for NAT traversal) from the TLS protocol function (asymmetric client-server roles). This segmentation allows both devices to maintain TCP client roles for security and NAT compliance while independently assigning TLS roles that satisfy protocol requirements, thus resolving the contradiction between security constraints and protocol establishment
Solution Approach 2:
The patent introduces an additional dimension of role assignment by allowing role selection at the TLS layer that is independent from the transport layer (TCP) role selection. This dimensional separation enables devices to be TCP clients in the transport layer while having asymmetric TLS roles in the security layer, simultaneously satisfying both NAT security requirements and TLS protocol requirements
Data Source
AI summary
Methods and apparatuses, including computer program products, are described for establishing secure communications sessions between computing devices located behind network security devices. The method includes receiving, from a first client computing device, a request for a secure connection with a second client computing device, the request including a first transport protocol role and a first security protocol role associated with the first device. The method includes transmitting the request to the second device. The method includes receiving, from the second device, a response to the request including a second transport protocol role and a second security protocol role associated with the second device, transmitting the response to the first device, and establishing the secure connection between the first device and the second device, where the first and second security protocol roles are determined independently from the first and second transport protocol roles.