Spoofed DNS Addresses for Granular Encrypted Traffic Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large network entities, managing access to individual services is difficult due to shared SSL certificates and addresses, making it challenging to block access to specific services without inadvertently blocking others, and decrypting requests is necessary to determine the destination, which can expose sensitive information.
Innovation Solution
The system uses spoofed addresses associated with domain names to manage secure network traffic, allowing requests to be selectively decrypted and handled without exposing sensitive information, enabling precise control over access to specific services without relying on SSL certificates or addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SSL certificates and addresses are shared across multiple services, then network security is maintained through established protocols, but it becomes difficult to manage access control to individual services
Solution Approach 1:
The patent segments the service identification process by introducing SNI (Server Name Indication) as a separate layer of information in the TLS handshake. This allows each service to be identified by its domain name in the SNI field rather than relying solely on shared IP addresses and SSL certificates, enabling granular access control per service while maintaining shared infrastructure
Solution Approach 2:
The patent introduces a DNS-based intermediary mechanism that maps domain names to services. The SNI field acts as an intermediary that carries service identification information through the encrypted TLS channel, allowing the gateway to identify and control access to individual services without decrypting the traffic or relying on certificate differentiation
2Measurement precision
If domain names are used to identify services, then precise service identification is achieved, but decrypting secure requests to determine destination exposes sensitive information
Solution Approach 1:
The patent performs service identification through the SNI field during the TLS handshake phase, before any application data is encrypted or transmitted. This preliminary identification allows the gateway to determine the destination service and apply access control policies without needing to decrypt the subsequent encrypted communication, thus preventing information exposure
Solution Approach 2:
The patent replaces the traditional mechanical approach of decrypting traffic to inspect content with a cryptographic approach using the SNI field. The SNI mechanism allows service identification through encrypted channels without requiring decryption, substituting a secure cryptographic solution for a vulnerable cryptographic breaking approach
3Ease of operation
If spoofed addresses are used for DNS resolution, then access control to specific services is enabled, but network traffic management complexity increases
Solution Approach 1:
The patent implements dynamic DNS resolution where the gateway can return different IP addresses for the same domain name based on the client's identity, location, or policy requirements. This dynamic behavior enables flexible access control while maintaining a unified domain name interface, managing complexity through automated policy-based decision-making rather than static configurations
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for managing encrypted network traffic using spoofed addresses. One example method includes receiving a request to resolve a domain name; determining that the domain name is included in a predetermined set of domain names; associating a spoofed address with the domain name; sending a response to the request to resolve the domain name, the response including the spoofed address; receiving a secure request for a resource, the secure request directed to the spoofed address; determining that the secure request is directed to the domain name based on the association between the spoofed address and the domain name; and selectively decrypting the secure request based at least in part on determining that the secure request is directed to the domain name.