Proxy Device TLS Handshake Traffic Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls struggle to inspect and apply policy decisions to encrypted network traffic, requiring resource-intensive decryption and facing regulatory restrictions, especially in secure communications where they cannot view network traffic in its entirety without first decrypting messages.
Innovation Solution
A proxy device intercepts the initial message of a handshaking procedure, extracts server name identification information, and applies policies based on this information without decrypting the message data, allowing or denying connections and controlling traffic without decrypting, thereby conserving network and computational resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If the firewall decrypts encrypted network traffic to inspect and apply policy decisions, then the firewall can view and control network traffic, but resource consumption increases and regulatory restrictions are violated
Solution Approach 1:
The patent extracts only the necessary identification information (SNI extension) from the encrypted TLS handshake process, allowing the firewall to identify and apply policies to specific traffic without decrypting the entire encrypted payload. This selective extraction maintains traffic visibility while avoiding the computational overhead of full decryption.
Solution Approach 2:
The firewall performs policy evaluation during the TLS handshake phase, before the actual encrypted data transmission begins. By intercepting and analyzing the SNI extension in the initial handshake messages, the firewall can make policy decisions upfront without needing to decrypt subsequent data traffic.
2Loss of information
If the firewall decrypts encrypted network traffic to inspect and apply policy decisions, then the firewall can view and control network traffic, but regulatory restrictions are violated
Solution Approach 1:
The firewall extracts only the minimal necessary information (SNI extension) from the encrypted traffic to apply policies, avoiding full decryption. This approach maintains compliance with regulations that restrict decryption of sensitive traffic while still enabling policy enforcement based on server identification.
3Ease of operation
If the firewall performs deep packet inspection on encrypted traffic, then the firewall can apply policy decisions, but decryption is required which consumes resources
Solution Approach 1:
Instead of performing deep packet inspection that requires decryption, the firewall extracts the SNI extension from the TLS handshake process. This provides sufficient information for policy decisions without the need for resource-intensive decryption of the encrypted payload.
4Productivity
If the firewall allows traffic to pass through before applying policy decisions, then encrypted traffic can flow, but the firewall cannot inspect the traffic content
Solution Approach 1:
The firewall performs inspection of the SNI extension during the TLS handshake phase, before allowing the encrypted data traffic to flow. This preliminary inspection provides traffic inspection capability without blocking productivity, as the policy decisions are made upfront based on server identification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Traffic control techniques are provided for intercepting an initial message in a handshaking procedure for a secure communication between a first device and a second device at a proxy device. Identification information associated with the second device is extracted from the initial message. A policy is applied to communications between the first device and second device based on the identification information.