Network Security Device Inspecting SSL Certificates for Invalid Keys

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for inspecting security certificates fail to detect and prevent the use of invalid certificates, particularly those with incorrectly generated private keys, unavailability of revocation information, and use of broken cryptographic algorithms, which can lead to security risks such as phishing and malware downloads.

Innovation Solution

A method for network security devices to scan messages between a server and a client for security certificates, detect suspicious certificates by checking for specific Object Identifiers (OIDs) like MD5withRSA and ns-cert-exts.comment, and abort sessions associated with these certificates, while sending invalid-certificate notices, ensuring that the OIDs are within the same trust chain and adhering to specific criteria such as comment length and ASCII character presence.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If standard verification mechanisms are used to validate certificates, then basic certificate validity is confirmed, but advanced security risks such as incorrectly generated private keys, unavailable revocation information, and broken cryptographic algorithms cannot be detected

Engineering Contradiction:

Improvecertificate validation reliabilityVSAvoidcertificate inspection precision

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent segments the certificate inspection process into multiple independent inspection stages: basic validity verification, private key generation verification, revocation information availability checking, and cryptographic algorithm validation. Each stage independently checks specific aspects of certificate security, allowing comprehensive detection of different types of certificate vulnerabilities without requiring full SSL connection decryption

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary inspection of certificate components (private keys, revocation information, cryptographic algorithms) before the SSL connection is fully established. By checking these critical security elements in advance during the handshake process, the system can identify and abort connections with invalid certificates before any sensitive data transmission occurs

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If SSL inspection decrypts the entire connection to inspect traffic, then complete traffic analysis is possible, but computational overhead and performance degradation occur

Engineering Contradiction:

Improvetraffic inspection completenessVSAvoidcomputational energy consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the critical cleartext portions of the SSL handshake (certificate requests, server responses, and relevant protocol messages) for inspection, rather than decrypting and analyzing the entire encrypted connection. This selective extraction of inspection-targeted data maintains security verification effectiveness while dramatically reducing computational overhead compared to full SSL decryption approaches

Inventive Principle:

Principle #2Taking out (Extraction)

3Measurement precision

If deeper inspection of the certificate chain is performed to detect invalid certificates, then detection accuracy improves, but processing time and complexity increase

Engineering Contradiction:

Improveinvalid certificate detection accuracyVSAvoidcertificate verification time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies local quality inspection by focusing verification efforts on specific critical components of the certificate chain rather than uniformly inspecting all certificate elements. The system selectively verifies private key generation, revocation information availability, and cryptographic algorithm validity only for certificates that require enhanced scrutiny, optimizing the balance between detection accuracy and processing efficiency

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8850576B2Methods for inspecting security certificates by network security devices to detect and prevent the use of invalid certificates

Publication Date: 2014.09.30 CHECK POINT SOFTWARE TECH LTD

AI summary

Disclosed are methods and media for inspecting security certificates. Methods include the steps of: scanning, by a network security device, messages of a security protocol between a server and a client system; detecting the messages having a security certificate; detecting suspicious security certificates from the messages; and aborting particular sessions of the security protocol associated with the suspicious certificates. Preferably, the step of scanning is performed only on messages of server certificate records. Preferably, the method further includes the step of sending an invalid-certificate notice to the server and the client system. Preferably, the step of detecting the suspicious certificates includes detecting a use of an incorrectly-generated private key for the certificates. Preferably, the step of detecting the suspicious certificates includes detecting an unavailability of revocation information for the certificates. Preferably, the step of detecting the suspicious certificates includes detecting a use of an invalid cryptographic algorithm for the certificates.