TLS Proxy Retransmission Mapping for Memory Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices face challenges in inspecting TLS/SSL traffic due to unknown cryptographic keys, leading to resource-intensive storage of re-encrypted records, which limits capacity and increases computing resources usage.
Innovation Solution
A network device decrypts and re-encrypts data on the fly, storing only meta-info entries in a retransmission mapping, allowing for retransmission without storing re-encrypted records, thus conserving resources and increasing capacity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network devices store re-encrypted records for TLS/SSL inspection, then security inspection capability is improved, but memory capacity and computing resource usage increase
Solution Approach 1:
The patent extracts only the essential metadata from the re-encrypted records and stores it in a retransmission mapping data structure, while the actual re-encrypted records are stored in the TLS inspection cache. This separation allows the system to maintain security inspection capability while reducing memory usage by not duplicating full record storage
Solution Approach 2:
The system pre-processes TLS/SSL records by decrypting them using cached cryptographic keys before re-encryption, and stores the decrypted content in the TLS inspection cache along with metadata in the retransmission mapping. This preliminary action enables efficient retransmission without full decryption processing, improving both security inspection capability and memory efficiency
2Reliability
If network devices store re-encrypted records for TLS/SSL inspection, then security inspection capability is improved, but computing resource usage increases
Solution Approach 1:
The system performs decryption and re-encryption operations in advance, storing the results in the TLS inspection cache with associated metadata. When retransmission is needed, the system retrieves pre-processed data from cache rather than performing full decryption processing again, significantly reducing computing resource usage while maintaining security inspection capability
Solution Approach 2:
The system creates simplified copies of the essential record information in the form of metadata entries in the retransmission mapping data structure. These metadata copies contain sufficient information for efficient record retrieval and verification without requiring storage or processing of the full re-encrypted records, reducing computing resource usage
Data Source
AI summary
A network device may decrypt a record received from a source device and associated with an encrypted session. The network device may process the decrypted record. The network device may encrypt the record to generate an encrypted payload. The network device may store an entry in a retransmission mapping that includes a decryption key used to decrypt the record and an encryption key used to encrypt the record. The network device may transmit the encrypted payload in a first TCP packet toward the destination device. The network device may receive retransmitted data and may determine, based on the record entry, that the retransmitted data is associated with the record. The network device may decrypt, using the decryption key, the retransmitted data and may re-encrypt, using the encryption key, the decrypted record. The network device may transmit, toward the destination device, the encrypted payload in a second TCP packet.