TLS Connection Abandonment via Transparent De-insertion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems that employ man-in-the-middle (MITM) proxies for SSL/TLS traffic inspection face inefficiencies due to their inability to abandon TLS connections once initiated, leading to unnecessary resource consumption even when further inspection is not required.
Innovation Solution
A network-based appliance mechanism that allows for transparent de-insertion from the client-server path during the handshake process, enabling the MITM to abandon TLS connections without interfering with the session, by mimicking the client and configuring a new SSL instance to resume the original connection if inspection is not needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the MITM proxy continues to maintain TLS connections for inspection even when not required, then the inspection capability is preserved, but system resources (CPU, memory) are consumed unnecessarily
Solution Approach 1:
The patent implements dynamic connection management where the MITM proxy can transition between active inspection mode and abandoned mode. The connection state is no longer static but can be dynamically adjusted based on real-time policy evaluation, allowing the system to optimize resource usage while maintaining inspection capability when needed.
Solution Approach 2:
The patent enables the MITM proxy to discard (abandon) TLS connections that no longer require inspection, freeing up system resources. The proxy can selectively terminate connections based on policy decisions made during the handshake process, thereby recovering CPU and memory resources that would otherwise be consumed by maintaining unnecessary encrypted sessions.
2Loss of energy
If the MITM proxy abandons the TLS connection early in the handshake, then resource consumption is reduced, but the handshake message integrity and authentication may be compromised
Solution Approach 1:
The patent performs policy evaluation and connection abandonment decisions during the TLS handshake process, before the connection is fully established. By making the decision to abandon or continue inspection early in the handshake, the system avoids the computational overhead of completing unnecessary key exchanges and session setup, while still maintaining protocol integrity for connections that proceed.
Solution Approach 2:
The MITM proxy acts as an intermediary that mediates between the client and server during the TLS handshake. It can selectively intervene to continue or terminate the handshake based on policy, ensuring that when connections are abandoned, it is done in a controlled manner that maintains message integrity and authentication for connections that proceed while freeing resources for those that don't.
3Reliability
If the MITM proxy inspects all TLS traffic, then comprehensive security coverage is achieved, but processing overhead and latency increase
Solution Approach 1:
The patent implements selective inspection where different TLS connections receive different treatment based on their specific characteristics and policy rules. Rather than uniformly inspecting all traffic, the system applies local quality control by evaluating each connection individually and applying inspection only where necessary, thereby improving overall processing efficiency while maintaining security coverage for relevant traffic.
Solution Approach 2:
The patent applies partial inspection action by performing policy evaluation during the handshake phase and potentially abandoning connections before full inspection would occur. This partial action approach allows the system to achieve adequate security coverage for connections that require inspection while avoiding the excessive processing overhead of inspecting all connections, thereby improving productivity.
Data Source
AI summary
A network-based appliance includes a mechanism to enable the appliance to extract itself from man-in-the-middle (MITM) processing during a client-server handshake and without interrupting that connection. The mechanism enables the appliance to decide (e.g., based on a rule match against a received server certificate) to stop performing MITM during the handshake and thus to de-insert itself transparently, i.e., without interfering or signaling to either end of the session that this operation is occurring. Once the connection is abandoned in the manner, the appliance ignores additional traffic flow and thus can free up processing resources (CPU, memory, and the like) that would otherwise be required to decrypt the connection (even if no further inspection or rewrite processing would be expected to occur).