SSL Certificate Validation via Suspicion Indications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SSL protocol's end-to-end encryption prevents enterprise firewalls from examining outgoing encrypted traffic, allowing malicious attacks to go undetected, and existing solutions like SSL stripping face performance, security, and legal issues.
Innovation Solution
A method involving examining digital certificates presented by server computers, compiling suspicion indications, and feeding them to a consequence engine to determine appropriate actions, without decrypting communications, thus avoiding the limitations of SSL stripping.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL end-to-end encryption is implemented to protect secure communications, then communication security is improved, but firewall examination capability deteriorates
Solution Approach 1:
The patent performs preliminary validation of SSL certificates at the firewall before encrypted traffic is established. By examining digital certificates, checking issuer trustworthiness, verifying domain matching, and assessing certificate status (revocation, expiration) before the SSL session begins, the firewall can block potentially malicious connections in advance without needing to decrypt the subsequent encrypted traffic.
Solution Approach 2:
The patent introduces an intermediary validation mechanism between the client and server that does not require decrypting their communication. The firewall acts as an intermediary that validates the SSL certificate presented by the server, checking its trustworthiness through multiple criteria (issuer trust, domain matching, revocation status, expiration). This intermediary validation layer provides security inspection capability while preserving end-to-end encryption for legitimate traffic.
2Difficulty of detecting and measuring
If SSL stripping is implemented to enable firewall examination of encrypted traffic, then security detection capability is improved, but system performance deteriorates
Solution Approach 1:
The patent extracts only the necessary validation information from the SSL handshake process without performing full decryption. By taking out and examining specific elements (digital certificate, issuer information, domain name, validity status) during the initial handshake phase, the firewall achieves security detection capability while avoiding the heavy computational burden of decrypting and inspecting the entire encrypted traffic stream.
3Difficulty of detecting and measuring
If SSL stripping is implemented to decrypt and examine traffic, then security inspection capability is improved, but legal compliance deteriorates
Solution Approach 1:
The patent performs security validation at the certificate level before encrypted communication begins, rather than requiring ongoing decryption of user communications. This preliminary action approach allows the firewall to inspect and validate security parameters (certificate authenticity, issuer trust, domain matching, revocation status) without violating user privacy or requiring access to encrypted communication content, thereby maintaining legal compliance.
Solution Approach 2:
The patent introduces an intermediary validation layer that operates on unencrypted metadata (digital certificates) rather than encrypted communication content. The firewall mediates the SSL handshake by validating certificate parameters without requiring access to or decryption of the actual communication payload, thus providing security inspection capability while respecting user privacy and maintaining legal compliance.
Data Source
AI summary
Computer-implemented methods, apparati, and computer-readable media for thwarting computer attacks. A method embodiment of the present invention comprises the steps of examining (52) a digital certificate (20) presented by a server computer (2); compiling (53) a set of suspicion indications (31) gleaned from said examining step (52); and feeding (54) said suspicion indications (31) to a consequence engine (30).