SSL/TLS Inspector Channel ID Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for supporting Channel ID in TLS connections during SSL inspection are limited by the need for local caching, which leads to complexity, poor scalability, and eventual storage issues, causing security vulnerabilities due to the inability to forward original identifiers and maintain secure connections.
Innovation Solution
A method where an SSL/TLS inspector generates a secret, derives a random seed value from the public key, creates a new private and public key pair using elliptic curve algorithms, and transforms the Channel ID communication, allowing secure forwarding without the need for local caching, thereby maintaining secure connections and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a local cache is used to store identifier mappings during SSL inspection, then client authentication can be maintained, but the system complexity increases and scalability deteriorates
Solution Approach 1:
The patent extracts the identifier mapping functionality from a centralized cache and distributes it across multiple SSL inspection appliances. Each appliance independently maintains its own mapping data, eliminating the need for complex centralized cache management and synchronization mechanisms while preserving client authentication capabilities.
Solution Approach 2:
The patent segments the identifier mapping function across multiple independent SSL inspection appliances rather than relying on a single centralized cache. This segmentation allows each appliance to operate independently with its own mapping data, reducing overall system complexity and improving scalability.
2Reliability
If a local cache is used for storing identifier mappings, then authentication can be maintained, but scalability is limited due to expensive and complicated cache synchronization between appliances
Solution Approach 1:
The patent segments the identifier mapping functionality across multiple independent SSL inspection appliances, allowing each to operate autonomously. This eliminates the need for expensive and complicated cache synchronization mechanisms, enabling the system to scale horizontally by simply adding more independent appliances to the network.
3Quantity of substance
If a fixed-size cache is used for storing identifier mappings, then memory usage is controlled, but the total amount of TLS connections intercepted is limited
Solution Approach 1:
The patent segments the identifier mapping storage across multiple SSL inspection appliances, effectively distributing the cache capacity. This allows the system to intercept a much larger total number of TLS connections by simply adding more appliances, as each appliance contributes its own cache capacity to the overall system capability.
Solution Approach 2:
The patent creates a scalable architecture where multiple SSL inspection appliances can perform the same identifier mapping function simultaneously. This multi-functionality allows the system to handle arbitrary numbers of TLS connections by adding more appliances, effectively removing the productivity limit imposed by fixed-size caches.
4Quantity of substance
If the cache runs out of space, then old records must be flushed to store new records, but this creates security holes
Solution Approach 1:
The patent segments the cache across multiple independent SSL inspection appliances, effectively creating a distributed cache system. This eliminates the need to flush old records when the cache is full, as the system can simply route new connections to different appliances with available cache space, thereby maintaining security without arbitrary cache eviction.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This solution enables secure and scalable TLS connection management by transforming Channel ID communications, ensuring continuous secure client identification without the limitations of local caching, thus enhancing security and performance.
Implementation Method 1
deriving, by the SSL/TLS inspector, a random seed value for a private key using a one-way hash algorithm that incorporates the secret and the public key value of the Channel ID communication
Implementation Method 2
generating, by the SSL/TLS inspector, the new private key using an elliptic curve algorithm; generating, by the SSL/TLS inspector, the new public key using an elliptic curve algorithm
Implementation Method 3
receiving, from the client, a Channel ID communication comprising a public key generated using the Elliptic Curve Diffie-Hellman key agreement protocol
Data Source
AI summary
Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for transforming a Channel ID communication, the method comprising: generating, by a SSL/TLS inspector, a secret; receiving, from a client, a Channel ID communication comprising a public key value; deriving, by the SSL/TLS inspector, a random seed value for a private key using the secret and the public key value of the Channel ID communication; generating, by the SSL/TLS inspector, a new private key based upon the random seed value; deriving, by the SSL/TLS inspector, a new public key based upon the new private key; generating, by the SSL/TLS inspector, a transformed Channel ID communication based upon the new private key and the new public key; and forwarding, by the SSL/TLS inspector, the transformed Channel ID communication to a server.