OTT Application Identification via TLS SNI Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to identify and categorize applications and services, especially over encrypted HTTPS connections, which hinders enterprises and ISPs in monitoring usage and predicting future network capacity demands.
Innovation Solution
A combination of packet analysis techniques is employed to determine the identity of applications or services, involving IP address/domain name mapping, DNS query inspection, TLS handshake analysis, and Server Name Indication (SNI) field utilization, to handle both unencrypted HTTP and encrypted HTTPS traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS encryption is used to protect HTTP connections, then security and privacy are improved, but the ability to identify and categorize applications is worsened
Solution Approach 1:
The patent extracts the Server Name Indication (SNI) field from the TLS handshake process to use for application identification. By taking out this specific information element from the encryption protocol, the system can identify applications without compromising the overall encryption security, thus resolving the contradiction between security and identification capability
Solution Approach 2:
The SNI field acts as an intermediary that enables application identification while maintaining TLS encryption. This mediator allows the monitoring system to obtain necessary identification information without decrypting the actual application data, thus preserving both security and identification capability
2Measurement precision
If network analysis is performed at ISP locations to identify SaaS applications, then measurement capability is improved, but device complexity and implementation difficulty are worsened
Solution Approach 1:
The system leverages the SNI field that is already generated by the client's own TLS handshake process. By utilizing this self-generated information, the monitoring system achieves application identification without requiring complex decryption capabilities or deep packet inspection infrastructure, thus reducing implementation complexity while maintaining measurement precision
3Measurement precision
If traditional packet inspection methods are used for HTTPS traffic, then identification accuracy for unencrypted HTTP is maintained, but identification capability for encrypted HTTPS is lost
Solution Approach 1:
The patent creates a universal identification method that works for both unencrypted HTTP and encrypted HTTPS traffic. By using the SNI field from TLS handshakes, the system maintains its ability to identify HTTP applications while gaining the capability to identify HTTPS applications, thus achieving multi-functionality and resolving the adaptability issue
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet from a HTTP, HTTPS or QUIC connection request received in a network monitoring device. Determine if one or more entries are present in the received connection request have an IP address that matches a known server IP address. A determination is then made as to whether if the received connection request is one of a HTTP, HTTPS or QUIC connection request, and if this cannot be determined than determine if a subject field in the received connection request is available. And determine if a candidate domain name is available from IP cache created from one or more of the above steps if a subject field is not available in the received connection request. Identify and categorize OTT applications associated with the received connection request if it is determined: the connection is either a HTTP, HTTPS or QUIC connection type; a subject field is available; or a candidate domain name is available utilizing a lookup table that is periodically updated with new OTT applications.