SSL Intermediary Device with Service Fingerprint Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure Socket Layer (SSL) communications are vulnerable to attacks, such as man-in-the-middle (MITM) attacks, due to the unreliable certificate trust model, where SSL certificates can be forged or stolen, and the private key compromised, leading to compromised security.
Innovation Solution
A system and method that includes a device intermediary between clients and servers, generating service fingerprints for virtual servers, which include DNS aliases, port numbers, and IP addresses, and transmitting these to a web service for verification, using agents to check for mismatches that indicate potential attacks, and monitoring protocols like BGP to detect malicious traffic routes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL certificates are issued by certificate authorities to provide communication security, then the reliability of SSL communications is improved, but the system becomes vulnerable to attacks where certificates can be forged or stolen by malicious parties
Solution Approach 1:
The system performs preliminary verification actions before establishing SSL connections. Agents proactively check service fingerprints (DNS aliases, IP addresses, port numbers) against expected values before the actual connection is made, preventing compromised certificates from being accepted. This preliminary check resolves the contradiction by maintaining security reliability while blocking forged certificates in advance.
Solution Approach 2:
The system implements a feedback mechanism where agents continuously monitor and report the actual service fingerprints of servers to a central web service. This feedback loop allows the system to detect discrepancies between expected and actual certificate bindings, enabling real-time identification of compromised certificates or MITM attacks while maintaining overall system security.
2Productivity
If the certificate trust model is used to verify server identity, then SSL connections can be established efficiently, but the model becomes unreliable when private keys are stolen or certificates are compromised
Solution Approach 1:
The system introduces an intermediary verification layer between the client and server. Instead of relying solely on the traditional certificate authority model, agents act as intermediaries that independently verify service fingerprints and report back to clients. This intermediary mechanism maintains connection efficiency while enhancing trustworthiness by adding an additional verification step that is independent of potentially compromised certificates.
Solution Approach 2:
Service fingerprints are verified in advance before SSL connections are established. Agents check whether the server's DNS aliases, IP addresses, and port numbers match the expected values associated with the SSL certificate. This preliminary verification maintains productivity by preventing connection delays while improving reliability by blocking connections to servers with compromised or stolen certificates.
3Object-affected harmful factors
If additional verification measures such as service fingerprint checking are implemented, then security against MITM attacks is improved, but the complexity of the SSL communication system increases
Solution Approach 1:
The verification system is segmented into independent agents that operate autonomously. Each agent is responsible for checking specific service fingerprints (DNS, IP, port) against expected values. This segmentation reduces overall system complexity by dividing the verification task into manageable, independent units rather than requiring a single complex verification mechanism.
Solution Approach 2:
A centralized web service acts as an intermediary that manages the complex verification logic. Agents simply report observed service fingerprints to the web service, which compares them against expected values and determines whether connections should be allowed. This intermediary approach hides the complexity of verification rules from individual agents while maintaining strong security protection against MITM attacks.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The disclosure is directed to a system for improving security of SSL communications. The system can include an device intermediary between one or more servers, one or more clients, a plurality of agents, and a web service. The servers can be configured to receive SSL connections and issue SSL certificates. The device can include a virtual server associated with a respective one of the servers, such that the SSL certificate of the respective server is transmitted through the device. The device can generate service fingerprints for the one or more servers. Each service fingerprint can include information corresponding to an SSL certificate of the virtual server, one or more DNS aliases for a virtual IP address of the respective virtual server, one or more port numbers serving the SSL certificate, and an IP address serviced by the device. The device also can transmit the service fingerprints to a web service.