Partial Proxy for Encrypted Handshake Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In consumer home networks, traffic manipulators lack the processing power to act as full proxies for verifying encrypted handshakes, especially with TLS 1.3, and installing root certificates on diverse client devices is logistically complicated and invasive.
Innovation Solution
A traffic manipulator acts as a partial proxy, cloning the client's introductory message to initiate a conditional handshake, deriving a secret key, and verifying the server's certificate without installing root certificates on client devices, thereby reducing computational requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traffic manipulator acts as a full proxy to verify encrypted handshakes, then certificate verification capability is improved, but processing power requirements increase significantly
Solution Approach 1:
The patent implements a partial proxy approach where the traffic manipulator performs only the essential verification functions (observing handshakes, validating certificates) rather than fully relaying all traffic. This reduces processing power requirements while maintaining certificate verification capability, directly resolving the contradiction between reliability and power consumption.
Solution Approach 2:
The patent extracts the certificate verification function from the full proxy role, allowing the traffic manipulator to perform only certificate validation without handling all traffic relay operations. This separation reduces the processing burden while preserving the essential security verification capability.
2Reliability
If root certificates are installed on client devices to enable verification, then security verification is improved, but device complexity and installation logistics worsen
Solution Approach 1:
The patent introduces the traffic manipulator as an intermediary that performs certificate verification centrally rather than requiring each client device to have root certificates installed. This eliminates the need for complex certificate distribution and management across diverse devices while maintaining security verification capabilities.
Solution Approach 2:
The traffic manipulator serves multiple functions: it acts as an observer of handshakes, a validator of certificates, and a security enforcement point. This multi-functionality consolidates verification capabilities at the network level, eliminating the need for individual device certification and reducing overall system complexity.
Data Source
AI summary
Methods, apparatus, systems and articles of manufacture are disclosed to verify encrypted handshakes. An example apparatus includes a message copier to clone a client introductory message, the client introductory message is included in a first handshake for network communication between a client and a server, a connection establisher to initiate a second handshake between the apparatus and the server based on the cloned client introductory message, and a decrypter to, in response to the second handshake, decrypt a certificate sent by the server.