Network Node Encrypted SNI Traffic Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The encryption of Server Name Indication (SNI) in TLS 1.3 and QUIC protocols limits the ability of network operators to differentiate and classify traffic, impacting use cases such as Sponsored Data, Quality of Service, and Traffic Optimization.
Innovation Solution
A method for network nodes to handle encrypted SNI by requesting and receiving information identifying the application from an application function, allowing classification and appropriate traffic management, even when SNI is encrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic encryption is implemented using TLS 1.3 or QUIC protocols, then user privacy and security are improved, but the ability to differentiate and classify traffic by network operators deteriorates
Solution Approach 1:
The patent segments the traffic identification process into two parts: the network operator performs initial classification based on available encrypted information (IP addresses, ports, protocol types), and the application function performs secondary identification by decrypting and analyzing the encrypted SNI field. This segmentation allows both encryption to be maintained and traffic classification to be performed at different levels.
Solution Approach 2:
The patent introduces an intermediary mechanism where the application function acts as a mediator between the encrypted traffic and the network operator. The application function receives the encrypted SNI, decrypts it using its private key, identifies the application, and returns this information to the network operator, enabling traffic classification without compromising the encrypted communication channel.
2Reliability
If the Server Name Indication is encrypted to protect privacy, then security is improved, but network operators cannot identify the logical server or application
Solution Approach 1:
The patent applies preliminary action by having the application function prepare and store the mapping between encrypted SNI values and application identifiers before traffic classification is needed. When traffic arrives, the system can quickly reference this pre-established mapping relationship rather than performing complex decryption and analysis in real-time, reducing the difficulty of application identification.
3Reliability
If traffic differentiation is limited due to encrypted SNI, then encryption security is maintained, but network operator use cases such as Sponsored Data, QoS, and Traffic Optimization are impacted
Solution Approach 1:
The patent implements a feedback mechanism where the application function provides decrypted application identification information back to the network operator. This feedback loop enables the network operator to maintain encrypted security while still obtaining the necessary traffic classification information to support various use cases including Sponsored Data, QoS, and Traffic Optimization.
Data Source
AI summary
A network node for user data traffic handling (UPF), receives (52, 112) traffic for an application, wherein the traffic is to be sent to a logical server associated with the application, wherein the logical server resides on a network server (10.4), and wherein the application has a corresponding application function (AF). On detecting (53, 113) that the received traffic includes an encrypted server name indication such that the associated logical server cannot be identified, the network node requests (55, 115) from the corresponding application function information identifying the application. In response to receiving (62, 117) information identifying said application, the network node subsequently handles the traffic (63, 118) based on the identified application.