SSL Handshake Parameter Reuse for Encrypted Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls face high resource usage and low performance due to the need to independently generate and manage encryption keys and parameters for SSL/TLS handshakes with clients and servers, leading to inefficient computation and security issues in inspecting encrypted packets.
Innovation Solution
A protection device sends a man-in-the-middle Diffie-Hellman parameter to both the client and server, generating session keys based on reused parameters, and performs decryption and encryption to inspect encrypted packets, reducing computation overheads and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall independently performs SSL handshake with client and server, then security inspection capability is improved, but computation workload increases and performance decreases
Solution Approach 1:
The patent introduces a key distribution center (KDC) as an intermediary between the firewall and the communication parties. The KDC generates and distributes session keys to the firewall, which then uses these keys to inspect encrypted traffic without performing full SSL handshakes. This mediator approach allows the firewall to maintain security inspection capability while offloading the computationally intensive key generation and management tasks to the KDC.
Solution Approach 2:
The patent extracts the key generation and management functions from the firewall and relocates them to a dedicated key distribution center. By separating these computationally intensive functions from the firewall's core inspection tasks, the system achieves both security inspection capability and improved firewall performance. The firewall only needs to perform decryption and re-encryption using provided keys, rather than managing the entire SSL handshake process.
2Reliability
If the firewall negotiates encryption keys with client and server, then encrypted packet inspection is enabled, but resource usage increases
Solution Approach 1:
The key distribution center serves as a mediator that handles all key negotiation and distribution tasks. The firewall receives pre-negotiated session keys from the KDC and uses them for decryption and re-encryption of traffic. This eliminates the need for the firewall to independently negotiate encryption keys with clients and servers, significantly reducing its resource usage while maintaining the ability to inspect encrypted packets.
Solution Approach 2:
The key distribution center automatically generates and distributes session keys to the firewall without requiring the firewall to actively negotiate with communication parties. This self-service approach to key management reduces the computational burden on the firewall, as it simply receives and uses the provided keys for inspection purposes without engaging in resource-intensive key negotiation protocols.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
This application provides an encrypted packet inspection method and a protection device, and pertains to the field of communication technologies. In this application, a process of performing SSL handshake between a protection device and a client device is associated with a process of performing SSL handshake between the protection device and a server. The protection device sends a same DH parameter to each of the client device and the server, and reuses DH parameters on the two sides when generating session keys, where the session key is used to decrypt an encrypted packet sent by the client device or the server, and encrypt plaintext data obtained after decryption and inspection. In embodiments of this application, a computation amount caused by DH parameter generation is reduced, and resource usage of a protection device such as a firewall is reduced. This greatly increases an SSL handshake speed, and improves performance of the protection device.