TLS Proxy Fallback for Encrypted Client Hello Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Encrypted Client Hello (ECH) TLS extension hides the true hostname of the destination host, making it difficult for proxies to identify malicious destinations, thereby allowing attackers to establish communication easily and compromising client security.
Innovation Solution
A proxy system that maintains visibility by intercepting client messages and triggering a fallback connection when ECH is used, allowing it to identify the true destination and enforce security policies based on category database entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If ECH TLS extension is used to hide the true hostname, then client privacy is improved, but proxy visibility deteriorates
Solution Approach 1:
The patent segments the TLS handshake process into two parts: the initial ECH-encrypted connection establishment for privacy protection, and a subsequent fallback connection phase where the proxy can intercept and inspect traffic. This segmentation allows both client privacy and proxy visibility to coexist by operating at different stages of the communication process.
Solution Approach 2:
The patent introduces a fallback connection mechanism as an intermediary layer between the client and the destination server. When the proxy detects ECH usage, it triggers a fallback connection that routes traffic through the proxy, allowing the proxy to maintain visibility and security control while the client continues to benefit from ECH privacy protection during the initial handshake.
2Loss of information
If ECH is used to encrypt client hello, then client privacy is improved, but malicious destination detection deteriorates
Solution Approach 1:
The patent applies preliminary action by having the proxy detect and identify the true destination hostname during the initial ECH handshake phase, before the client establishes encrypted communication with potentially malicious destinations. The proxy uses this advance knowledge to prepare security policies and trigger fallback connections that will block or inspect traffic to identified malicious destinations.
Solution Approach 2:
The patent implements a feedback mechanism where the proxy continuously monitors ECH traffic, identifies destinations using the disclosed methods, and uses this information to dynamically update security policies and trigger appropriate fallback connections. This feedback loop ensures that the proxy can adapt to new malicious destinations while maintaining client privacy through ECH.
3Reliability
If fallback connection is triggered, then proxy visibility is improved, but connection establishment time increases
Solution Approach 1:
The patent applies partial action by triggering fallback connections only for specific destinations that are identified as requiring security inspection, rather than forcing fallback connections for all ECH traffic. This selective approach maintains proxy visibility for suspicious destinations while allowing direct ECH connections for trusted destinations, thereby minimizing the overall impact on connection establishment time.
Data Source
AI summary
An embodiment of the present invention describes means by which a proxy can maintain visibility between a client and a server when the client initiates a Transport Layer Security connection with Encrypted Client Hello (ECH). The proxy uses intelligence data has the ability to identify connections between clients and servers that are utilizing the Encrypted Client Hello extension to Transport Layer Security (TLS) Protocol Version 1.3 and triggers the client to fallback to utilizing a new connection that does not utilize ECH. This preserves the proxy's ability to determine the true destination of the client and identify the risks and characteristics of the request and response and act based on the administrator's authored policy.