TLS Proxy Seamless Engagement via Handshake Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing TLS proxy systems face challenges in seamlessly engaging and disengaging from network connections, particularly in scenarios where decryption is not permitted, leading to costly connection re-establishment and potential operational issues due to breaking established connections.
Innovation Solution
A technique that intercepts the initial message of a handshaking procedure, determines if TLS inspection is needed, and either establishes or maintains a secure connection without inspection, allowing seamless engagement or disengagement of TLS proxy services by modifying handshaking messages and completing or terminating proxy-server handshaking procedures accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS proxy intercepts and decrypts traffic for inspection, then security monitoring capability is improved, but connection stability deteriorates due to breaking established connections
Solution Approach 1:
The proxy device performs preliminary inspection of the SERVER_HELLO message during the TLS handshaking procedure before the connection is fully established. By determining whether TLS inspection is required in advance, the proxy can avoid breaking established connections while still providing security monitoring for connections that need inspection.
Solution Approach 2:
The proxy device dynamically adjusts its behavior based on the inspection requirements of each connection. For connections requiring TLS inspection, the proxy establishes a proxy connection and performs decryption. For connections not requiring inspection, the proxy allows direct client-server communication without interruption, making the system adaptable to different security needs.
2Reliability
If TLS proxy breaks and re-establishes connections for inspection, then security inspection capability is improved, but computational cost worsens
Solution Approach 1:
The proxy device performs the decision-making action in advance by inspecting the SERVER_HELLO message during the initial handshaking phase. This preliminary determination avoids the need to break and re-establish connections later, thereby reducing the computational overhead of connection management while maintaining security inspection capability.
3Adaptability or versatility
If TLS proxy enters transaction after direct connection is established, then privacy law compliance is improved, but connection overhead worsens
Solution Approach 1:
The proxy device performs preliminary inspection of the SERVER_HELLO message to determine whether TLS inspection is required before the connection is fully established. For connections requiring inspection (such as online banking transactions subject to privacy laws), the proxy establishes a proxy connection in advance. For connections not requiring inspection, the proxy allows direct communication, thereby reducing connection overhead while maintaining compliance with privacy laws.
Data Source
AI summary
Techniques are presented for seamless engagement and disengagement of Transport Layer Security proxy services. A first initial message of a handshaking procedure for a first secure communication session between a first device and a second device is intercepted at a proxy device. The first initial message of the handshaking procedure is saved at the proxy device. A second initial message of a second handshaking procedure for a second secure communication session between the proxy device and the second device is sent from the proxy device to the second device. It is determined from the second handshaking procedure that inspection of the first secure communication session is not to be performed by the proxy device. The first secure communication session is established without examination of the communication traffic by the proxy device.