Early TLS Handshake Termination via OTP Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Transport Layer Security (TLS) handshakes are computationally complex and can be burdensome during denial-of-service attacks, as they require full certificate validation before determining the authenticity of devices.
Innovation Solution
Implementing an early termination mechanism for TLS handshakes by using a one-time password (OTP) in the client hello message, which is generated based on a secret provided by a threat management facility. The gateway generates its own OTP for comparison, and if they match, the handshake continues; otherwise, the TCP connection is terminated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full TLS handshake with certificate validation is performed, then security is ensured, but server-side computational burden increases significantly during denial-of-service attacks
Solution Approach 1:
The patent applies preliminary action by performing OTP generation and comparison before the computationally expensive certificate validation step. The gateway generates an OTP based on a shared secret and compares it with the client-provided OTP in the ClientHello message. If they don't match, the connection is terminated early, preventing the server from wasting computational resources on full TLS handshakes with unauthorized devices.
Solution Approach 2:
The patent segments the TLS handshake process into two distinct phases: an initial authentication phase using OTP comparison, and a subsequent secure communication phase using full TLS. This segmentation allows the server to quickly filter out unauthorized clients in the first phase without committing to the full computational cost of TLS certificate validation for every connection attempt.
2Productivity
If early termination based on OTP comparison is implemented, then server-side demand is reduced, but handshake complexity increases due to additional authentication steps
Solution Approach 1:
The patent introduces an intermediary authentication mechanism using OTPs that mediates between the client and server before full TLS engagement. The OTP serves as a lightweight preliminary verifier that doesn't require the full certificate infrastructure, thus reducing server demand while adding only minimal complexity compared to standard TLS.
Solution Approach 2:
The OTP authentication mechanism is self-service in that both client and server independently generate OTPs using the same shared secret, eliminating the need for complex mutual authentication protocols. The client simply provides their OTP in the ClientHello, and the server validates it against its own generated OTP, creating a straightforward verification process.
Data Source
AI summary
A Transport Layer Security (TLS) handshake can be terminated early—i.e., before certificate validation—to reduce server-side demand, which can be particularly advantageous in counteracting Denial-of-Service (DOS) attacks and the like. To this end, an endpoint may provide a one-time password (OTP) in the client hello message during the initial steps of a TLS handshake or similar connection protocol. A gateway, upon receiving the client hello message, may generate its own OTP for comparison with the OTP in the client hello message. The endpoint and gateway may advantageously generate the OTP based on a secret provided by a threat management facility with a preexisting secure connection to the two entities. If the OTP provided in the client hello message and the OTP generated on the gateway are the same, then the TLS handshake may continue; otherwise, the Transmission Control Protocol (TCP) connection will be terminated by the gateway.