Intermediate Network Entity Bypassing Certificate Pinning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intermediate network entities (INEs) in communication networks face challenges in establishing secure connections due to certificate pinning, where clients reject SSL handshakes when the certificate presented by an INE differs from the expected server certificate, leading to failed secure communications.
Innovation Solution
A method and apparatus for controlling secure communications in a network involving a client, server, and INE, where the INE analyzes client and server identifiers from the 'Client Hello' message to determine if an end-to-end secure connection should be established, and if not, forwards the request to the server, allowing secure communication to proceed even if the client uses certificate pinning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an intermediate network element mediates secure traffic by creating SSL tunnels, then traffic mediation capability is improved, but secure connection establishment fails when the client uses certificate pinning
Solution Approach 1:
The system performs preliminary analysis of the client hello message to determine whether the client uses certificate pinning before attempting to establish an SSL connection. This advance detection allows the INE to prepare appropriate handling strategies, preventing connection failures by anticipating certificate verification issues.
Solution Approach 2:
The INE acts as an intermediary that intelligently mediates between clients using certificate pinning and servers. By analyzing client capabilities and conditionally establishing SSL connections, the INE enables traffic mediation for pinning-enabled clients while maintaining direct connections for pinning-disabled clients, thus resolving the contradiction between mediation capability and connection reliability.
2Reliability
If the client verifies the server certificate using certificate pinning, then security verification is improved, but connection establishment fails when the certificate differs from the stored genuine certificate
Solution Approach 1:
The system performs preliminary analysis of the client hello message to detect certificate pinning usage before the SSL handshake begins. This early detection allows the INE to conditionally establish connections, preserving both the security verification benefits of certificate pinning and the connection establishment success by avoiding scenarios where pinning would fail.
3Adaptability or versatility
If the INE establishes an end-to-end secure connection with the client, then secure communication mediation is improved, but connection establishment fails when the client expects a different certificate
Solution Approach 1:
The INE performs preliminary analysis of the client hello message to determine whether the client uses certificate pinning and identifies the expected server identifier. This advance knowledge allows the INE to conditionally establish SSL connections only when appropriate, maintaining both mediation adaptability and handshake reliability by avoiding connections that would fail due to certificate mismatches.
Solution Approach 2:
The INE intelligently mediates SSL connection establishment by analyzing client capabilities and making conditional decisions. For clients using certificate pinning, the INE determines whether to establish or forward connections based on expected certificate matches, thus maintaining both mediation versatility and connection reliability simultaneously.
Data Source
AI summary
There is presented a method and apparatus for controlling secure communications in a communications network. An intermediate network element (INE) receives a request from a client to establish a secure connection between the client and a first server. The received request is analysed to determine a client identifier. The INE determines, based on the client identifier whether to attempt to establish a secure connection between the client and the INE. Responsive to a determination not to attempt to establish a connection, the received request is forwarded on to a second server. Responsive to a determination to attempt to establish a connection, a message comprising information for the client to use in establishing a secure connection with the INE is sent to the client.