TLS Handshake Elliptic Curve Data Embedding for Perfect Forward Secrecy

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current VPN and proxy technologies, when masked as HTTPS traffic, are vulnerable to detection and can compromise user privacy and security, as they often rely on session resumption which lacks perfect forward secrecy and exposes keying material, making them susceptible to censorship and degradation of service.

Innovation Solution

The method involves generating new keying material during the TLS handshake, embedding elliptic curve data within TLS messages, and using it to establish secure connections with VPN or proxy servers, ensuring perfect forward secrecy without increasing connection time or CPU load, while masking the use of VPN services from external observers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of time

If session resumption is used to reduce connection time, then connection establishment speed is improved, but perfect forward secrecy is lost and keying material is exposed

Engineering Contradiction:

Improveconnection establishment timeVSAvoidperfect forward secrecy

Core Design Contradiction:

Loss of timeVSReliability

Solution Approach 1:

The patent performs preliminary actions during the TLS handshake by embedding elliptic curve data in advance within standardized message fields. This allows the keying material to be prepared and exchanged before the actual data transmission begins, achieving both fast connection establishment and perfect forward secrecy. The embedded elliptic curve data is processed during the initial handshake without requiring additional round trips.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent embeds elliptic curve data within existing TLS message structures, nesting the cryptographic material inside standardized fields like Client Hello or Server Hello. This nesting approach allows the additional security functionality to be integrated without increasing message size or requiring separate communication channels, thus maintaining connection speed while enhancing security.

Inventive Principle:

Principle #7Nested doll (Nesting)

2Reliability

If full TLS handshake with ECDHE key exchange is used to ensure perfect forward secrecy, then security is improved, but connection establishment time increases

Engineering Contradiction:

Improveperfect forward secrecyVSAvoidconnection establishment time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent merges the key exchange functionality into the existing TLS handshake messages by embedding elliptic curve data within standardized fields. This combination eliminates the need for separate key exchange messages or additional handshake rounds, achieving perfect forward secrecy through ECDHE while maintaining the original connection establishment timeline.

Inventive Principle:

Principle #5Merging (Combining)

3Loss of information

If VPN traffic is masked as HTTPS to hide usage, then privacy is improved, but detection resistance decreases when keying material is reused

Engineering Contradiction:

Improveuser privacyVSAvoiddetection vulnerability

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The patent changes the cryptographic parameters by generating new keying material through embedded elliptic curve data for each connection or session. This parameter change ensures that even though the traffic pattern resembles HTTPS, the underlying cryptographic material is unique and cannot be reused for detection or correlation attacks, thereby maintaining both privacy and detection resistance.

Inventive Principle:

Principle #35Parameter changes

4Reliability

If elliptic curve data is embedded in TLS messages to generate new keying material, then perfect forward secrecy is achieved, but message format complexity increases

Engineering Contradiction:

Improveperfect forward secrecyVSAvoidmessage format complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent makes the TLS handshake messages multi-functional by having them serve both their original purpose (establishing encrypted communication) and the additional purpose of conveying embedded elliptic curve data for key generation. This universality allows the same standardized message format to accomplish multiple cryptographic functions without requiring new message types or increasing format complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11470060B2Private exchange of encrypted data over a computer network

Publication Date: 2022.10.11 TWINGATE INC

AI summary

A handshake message includes a field containing random data that is filled with data used to derive keying material on the source and destination computers. The data may be elliptic curve data and may include a representation of the data used by the destination computer to verify that elliptic curve data is present. The data may additionally include data for deriving second keying material on a second destination computer that the first destination computer forwards to the second computer, receives a response, and returns data from the response as part of its own handshake message.