TLS Proxy Engagement with Encrypted Handshaking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing TLS proxy systems face challenges in gracefully engaging or disengaging from encrypted handshaking processes, especially with the introduction of TLS Protocol Version 1.3, which encrypts certificate handshake messages and Server Name Indication, making it difficult for middle proxies to determine whether to engage or disengage without disrupting client-server connections and violating regulatory requirements.
Innovation Solution
The solution involves intercepting and storing initial encrypted handshaking messages at a proxy device, then sending modified messages to establish secure connections between the proxy and the server, allowing the proxy to determine whether to remain engaged or disengage based on policy decisions, while maintaining transparency to the client and minimizing disruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If the proxy intercepts and decrypts TLS traffic for inspection, then traffic monitoring capability is improved, but connection stability deteriorates due to breaking and re-establishing connections
Solution Approach 1:
The proxy performs preliminary actions by establishing the second encrypted connection with the server before breaking the first connection with the client. This sequence allows the proxy to prepare the replacement connection in advance, minimizing disruption to client-server communication while maintaining traffic inspection capability.
Solution Approach 2:
The proxy acts as an intermediary by maintaining active connections with both client and server simultaneously during the transition period. This mediator role allows seamless handoff where the proxy temporarily holds both connection ends, ensuring continuous communication flow while switching from direct client-server connection to proxied connection.
2Loss of information
If the proxy establishes a second connection to inspect traffic, then traffic monitoring capability is improved, but device complexity increases due to maintaining multiple simultaneous connections
Solution Approach 1:
The connection management system is made dynamic by allowing the proxy to flexibly create, maintain, and terminate multiple connections based on inspection requirements. The system dynamically adjusts connection states - establishing second connections when inspection is needed, and gracefully tearing them down when not needed, optimizing resource usage while maintaining inspection capability.
3Adaptability or versatility
If the proxy breaks existing connections to disengage, then adaptability to policy requirements is improved, but operational problems increase for unaware clients and servers
Solution Approach 1:
The proxy performs preliminary connection establishment with the server before disconnecting the client connection. This preliminary action ensures that when the proxy needs to disengage, the server-side connection is already in place, allowing smooth handoff without causing operational problems for the server or disrupting service continuity.
Solution Approach 2:
The proxy rapidly transitions from active inspection mode to disengagement mode by quickly establishing the direct client-server connection and then promptly breaking its own intermediary connections. This rushing through the disengagement process minimizes the time clients and servers are aware of the proxy's presence, reducing operational disruptions.
Data Source
AI summary
Techniques are presented herein for engagement and disengagement of Transport Layer Security proxy services with encrypted handshaking. In one embodiment, a first initial message of a first encrypted handshaking procedure for a first secure communication session between a first device and a second device is intercepted at a proxy device. The first initial message includes first key exchange information for encrypting the first encrypted handshaking procedure. A copy of the first initial message is stored at the proxy device. A second initial message of a second encrypted handshaking procedure for a second secure communication session between the proxy device and the second device is sent from the proxy device to the second device. The second initial message includes second key exchange information for encrypting the second encrypted handshaking procedure. The proxy device determines, based on the second encrypted handshaking procedure, whether to remain engaged or to disengage.