Transparent Proxy Graceful Conversion to Non-Security Mode
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communications systems face challenges in efficiently converting a security transparent proxy to a non-security transparent proxy without dropping existing secure sessions, as they require different encryption keys for each endpoint, leading to resource-intensive decryption and encryption processes.
Innovation Solution
Implementing a method that triggers key renegotiation on both sessions to use a single encryption key, allowing the proxy to seamlessly transition from decrypting and encrypting to simply forwarding packets without encryption, thus maintaining active sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security transparent proxy uses different encryption keys for each endpoint to maintain secure connections, then security is improved, but resource consumption increases due to decryption and encryption processes
Solution Approach 1:
The patent changes the encryption key parameter from multiple different keys to a single shared key. By renegotiating both sessions to use the same key, the proxy transitions from a security transparent proxy that decrypts and re-encrypts traffic to a non-security transparent proxy that can forward encrypted traffic directly, thereby reducing computational resource consumption while maintaining session continuity
Solution Approach 2:
The patent implements a dynamic transition mechanism where the proxy can switch between two operational modes: security transparent proxy mode (with decryption/encryption) and non-security transparent proxy mode (with direct forwarding). This dynamic adaptation allows the system to optimize resource usage by changing its behavior based on whether security inspection is required, resolving the contradiction between security and resource consumption
2Productivity
If a proxy converts from security to non-security mode, then resource efficiency is improved, but existing secure sessions may be dropped
Solution Approach 1:
The patent performs preliminary key renegotiation before the actual mode transition. By initiating key renegotiation on both sessions first to establish a shared key, the proxy prepares the necessary conditions for conversion. This preliminary action ensures that when the proxy switches to non-security mode, both sessions are already configured to use the same key, allowing seamless transition without dropping sessions
Solution Approach 2:
The patent maintains continuous session connectivity throughout the conversion process. By using key renegotiation mechanisms that preserve existing session contexts and by ensuring both sessions use the same key before transition, the proxy enables uninterrupted communication. The useful action of data transmission continues without interruption during the mode change, resolving the contradiction between resource efficiency and session continuity
Data Source
Figure 1~2
Figure 3
Figure 4A
AI summary
A graceful conversion of a security to a non-security transparent proxy is performed. A security transparent proxy is an intermediary between two end devices, with an established secure connection with each end device using different security keys. In response to a policy decision or other stimulus, the security transparent proxy is gracefully converted to a non-security transparent proxy such that it can forward, without decrypting and encrypting, the information received from a first endpoint on the first connection therewith to the second endpoint on the second connection therewith. This conversion is "graceful" in that it does not drop either of the two original sessions. In one embodiment, this graceful conversion is accomplished by triggering a key renegotiation on both of the two sessions such that the two connections will use the same encryption, key.