TLS Proxy Visibility via ECH Fallback Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Encrypted Client Hello (ECH) TLS extension hides the true hostname of the destination host, making it difficult for proxies to identify malicious destinations, thereby allowing attackers to establish communication easily, compromising client security.
Innovation Solution
A proxy system that intercepts client messages and triggers a fallback connection when ECH is detected, maintaining visibility by using intelligence data to identify and enforce security policies based on unencrypted hostnames, ensuring compliance with access control rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If ECH TLS extension is used to hide the true hostname, then client privacy is improved, but proxy visibility deteriorates
Solution Approach 1:
The patent segments the TLS connection establishment into two phases: an initial ECH-encrypted connection for privacy protection, and a fallback unencrypted connection for proxy visibility. The proxy system intercepts the initial connection attempt and triggers a fallback to an unencrypted TLS connection, allowing the proxy to inspect the hostname while the client still benefits from ECH privacy on the primary connection path.
Solution Approach 2:
The proxy acts as an intermediary between the client and the server. It intercepts the ECH TLS connection attempt, detects the encrypted hostname, and triggers a fallback mechanism that redirects traffic through an unencrypted TLS connection. This intermediary role allows the proxy to maintain visibility into the hostname while preserving client privacy on the encrypted connection path.
2Object-affected harmful factors
If fallback connection is triggered when ECH is detected, then proxy visibility is maintained, but connection complexity increases
Solution Approach 1:
The proxy system performs preliminary detection of ECH TLS extensions during the initial connection handshake. By detecting the encrypted hostname early in the TLS negotiation process, the proxy can proactively trigger the fallback mechanism before the encrypted connection is fully established, simplifying the overall connection management by avoiding complex decryption and inspection operations.
3Object-affected harmful factors
If unencrypted TLS connection is used for fallback, then proxy inspection capability is improved, but security is worsened
Solution Approach 1:
The patent applies different security qualities to different parts of the connection architecture. The primary connection path uses ECH encryption for maximum security and privacy, while the fallback connection path uses unencrypted TLS for proxy visibility. This local differentiation allows each connection path to be optimized for its specific purpose without compromising the overall security model.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An embodiment of the present invention describes means by which a proxy can maintain visibility between a client and a server when the client initiates a Transport Layer Security connection with Encrypted Client Hello (ECH). The proxy uses intelligence data has the ability to identify connections between clients and servers that are utilizing the Encrypted Client Hello extension to Transport Layer Security (TLS) Protocol Version 1.3 and triggers the client to fallback to utilizing a new connection that does not utilize ECH. This preserves the proxy's ability to determine the true destination of the client and identify the risks and characteristics of the request and response and act based on the administrator's authored policy.