Security Gateway Bypass for Certificate Validation Errors

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Security gateways face resource exhaustion and denial of service vulnerabilities when handling encrypted data sessions, particularly due to varying cipher resource requirements and server-chosen ciphers that are not supported by the crypto module, leading to processing delays and potential security breaches.

Innovation Solution

Implementing a method for the security gateway to dynamically bypass secure sessions, allowing them to avoid resource exhaustion by establishing a bypass secure session when the crypto module lacks capacity, and using a TCP proxy to relay data packets without decryption or encryption, thereby maintaining secure communication while optimizing resource usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the security gateway uses hardware-based crypto module for encryption and decryption, then processing performance is improved, but resource exhaustion occurs when the crypto module lacks capacity to support new secure sessions

Engineering Contradiction:

Improveprocessing performanceVSAvoidresource exhaustion vulnerability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The security gateway dynamically switches between hardware-based crypto module and software-based encryption based on the current capacity and resource availability of the crypto module. When the crypto module has sufficient capacity, hardware encryption is used for high performance. When capacity is exhausted or unavailable, the system transitions to software-based encryption to maintain session continuity and prevent denial of service attacks.

Inventive Principle:

Principle #15Dynamics

2Reliability

If the security gateway inspects all secure sessions, then security policy enforcement is improved, but processing delay increases due to software-based encryption fallback

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidprocessing delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The security gateway applies partial inspection by selectively examining only those secure sessions that can be processed by the hardware crypto module within available resources. Sessions that would require software-based encryption due to crypto module exhaustion are bypassed or handled with reduced inspection depth, ensuring critical security checks are performed while avoiding excessive processing delays.

Inventive Principle:

Principle #16Partial or excessive action

3Adaptability or versatility

If the security gateway supports multiple ciphers, then adaptability is improved, but resource exhaustion occurs when server-chosen ciphers are not supported by the crypto module

Engineering Contradiction:

Improvecipher supportVSAvoidresource exhaustion

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The security gateway introduces an intermediary cipher negotiation mechanism that acts as a mediator between the client and server. When the server selects a cipher not supported by the hardware crypto module, the gateway intervenes to negotiate an alternative cipher that is hardware-supported, or falls back to software-based encryption for that specific session, preventing resource exhaustion while maintaining broad cipher compatibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10389538B2Processing a security policy for certificate validation error

Publication Date: 2019.08.20 A10 NETWORKS INC

AI summary

Disclosed herein are systems and methods for a security gateway to process secure network sessions where there is a server certificate validation error. In various embodiments, varying security policies can be applied to the secure network sessions, including intercepting of network data, bypass of the security gateway, or termination of the secure sessions.