Proxy Emulated Client Certificates for SSL Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL protocols face challenges in authentication when proxies intercept encrypted communication between clients and servers, as they often cannot verify client certificates without private keys, leading to bypassing of inspection and inability to filter inappropriate content.
Innovation Solution
A proxy provides an emulated client or server certificate, which can be signed by a trusted CA or the client's private key, allowing authentication and filtering of SSL communication while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption is used to protect communication between client and server, then security against eavesdropping is improved, but the ability of proxies to filter and inspect communication is worsened
Solution Approach 1:
The patent introduces a proxy server as an intermediary that establishes separate SSL connections with both the client and the server. The proxy acts as a mediator that can decrypt and inspect traffic by having its own certificate trusted by both endpoints, enabling filtering while maintaining end-to-end encryption semantics
Solution Approach 2:
The patent creates a copy of the original SSL connection through the proxy. The proxy establishes duplicate SSL connections (client-proxy and proxy-server) that mirror the original communication path, allowing inspection of encrypted traffic without breaking the security model
2Ease of operation
If proxies break SSL connections into two separate sessions to enable filtering, then filtering capability is improved, but authentication reliability is worsened due to inability to verify client certificates without private keys
Solution Approach 1:
The proxy server acts as an intermediary authentication authority that receives and verifies client certificates from the client, then presents its own certificate to the server. This allows the proxy to perform authentication verification without needing access to the client's private key
Solution Approach 2:
The patent copies the authentication verification function from the server to the proxy. The proxy performs the same certificate verification that the server would perform, allowing authentication to occur in the first SSL session (client-proxy) without requiring private key access
Data Source
AI summary
Various techniques are described to authenticate the identity of a proxy in a client-proxy-server configuration. The configuration may have a client-side and a server-side SSL session. In the server-side session, if the proxy has access to the private keys of the client, the proxy may select a client certificate from a collection of client certificates and send the selected certificate to the server to satisfy a client authentication request of the server. If the proxy does not have access to the private keys, the proxy may instead send an emulated client certificate to the server. Further, the client certificate received from the client may be embedded within the emulated client certificate so as to allow the server to directly authenticate the client, in addition to the proxy. An emulated client certificate chain may be formed instead of an emulated client certificate. Similar techniques may be applied to the client-side session.