MitM TLS Session Inspection via Identifier Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security technologies face challenges in intercepting existing Transport Layer Security (TLS) connections without breaking them, leading to security breaches, poor scaling, and delayed inspection due to session timeouts and key loss, especially in production environments and for roaming users.
Innovation Solution
A Man in the Middle (MitM) computer is used to drop unknown or invalid session identifiers, forcing a full TLS handshake and obtaining new session keys, allowing passive inspection of TLS traffic without disrupting the connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a MitM computer waits for TLS session timeouts to inspect connections, then session keys remain secure, but inspection is delayed and scaling is poor
Solution Approach 1:
The MitM computer performs preliminary actions by storing session identifiers and sending notifications to clients before session timeouts occur. This allows the system to proactively prepare for inspection opportunities without waiting passively for timeouts, reducing inspection delays while maintaining security through controlled session management
2Productivity
If the MitM computer actively manages TLS sessions, then inspection capability is improved, but connection stability deteriorates due to session aborts
Solution Approach 1:
The MitM computer acts as an intermediary by introducing notification mechanisms that communicate with both clients and servers. Instead of directly aborting sessions, the system sends notifications that coordinate session management, allowing inspection capability improvement while maintaining connection stability through controlled, cooperative session transitions
3Productivity
If session identifiers are retained for reuse, then TLS handshake efficiency is improved, but MitM inspection capability is lost
Solution Approach 1:
The system implements feedback by monitoring whether retained session identifiers are recognizable to the MitM computer. When session identifiers are retained and recognizable, the system receives feedback that inspection capability is compromised, triggering notifications to clients to flush caches and obtain new session identifiers, thus restoring inspection capability while allowing efficient handshakes when inspection is not required
Data Source
AI summary
A Man in the Middle (MitM) computer receives a first session identifier from a client for a first communication session between the client and a server, and monitors Transport Layer Security (TLS) communication sessions between the client and the server, where the first session identifier is one of an unknown session identifier and an invalid session identifier. In response to receiving the first session identifier from the client, the MitM computer performs one of: requesting a second session identifier from the server for a second communication session if the first session identifier is an unknown session identifier; and transmitting, to the client, an instruction to flush a session cache in the client, where flushing the session cache in the client forces the client and the server to establish a full TLS handshake in order to obtain a session key if the first session identifier is an invalid session identifier.