Network Appliance Decryption Policy Pre-Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network tools experience increased latency and decreased connection rates due to the need to tear down and re-establish connections when deciding not to decrypt data after a server connection has been established, negatively impacting network performance.
Innovation Solution
A network appliance intercepts data between a client and a server, applies a policy to a stored SSL or TLS certificate before initiating a secure connection, determining whether to decrypt data, thereby reducing the likelihood of needing to tear down and re-open connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network tool applies decryption policy after establishing server connection, then the tool can analyze network traffic with decryption capability, but the connection must be torn down and reopened causing increased latency and decreased connection rate
Solution Approach 1:
The patent applies the decryption policy to the server certificate before establishing the server connection, rather than after. This preliminary action allows the system to determine whether to decrypt traffic in advance, avoiding the need to tear down and reopen connections later, thus reducing latency while maintaining decryption capability when needed
2Ease of operation
If the network tool establishes connection before applying decryption policy, then the tool can proceed with connection setup, but frequent connection teardowns decrease connection rate and slow response to client
Solution Approach 1:
The patent performs the decryption policy evaluation on the server certificate before the connection is fully established. This preliminary determination prevents subsequent connection teardowns, thereby maintaining ease of connection establishment while significantly improving connection rate by avoiding repeated connection cycles
3Adaptability or versatility
If the network tool determines not to decrypt after connection establishment, then the tool can maintain connection for other purposes, but the connection teardown and reopening process negatively impacts network performance
Solution Approach 1:
The patent determines the decryption decision before establishing the server connection by applying the policy to the server certificate in advance. This eliminates the need for connection teardown even when decryption is not needed, maintaining connection flexibility while dramatically improving response time by preventing the teardown-reopen cycle
Data Source
AI summary
A network appliance receives a communication from a client device that includes a request to establish a network connection to a server. Prior to initiating a network connection between the network appliance and the server, the network appliance accesses a server certificate associated with the server. In response to a determination not to decrypt data transmitted between the client device and the server, the network appliance establishes a single connection between the network appliance and the server. The network appliance transmits encrypted data between the client device and the server only over the single connection.