Transparent Application-Layer Packet Inspection Without TLS Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application layer inspection methods introduce latency and require architectural or code changes, especially when using a machine-in-the-middle approach for TLS termination and traffic inspection.
Innovation Solution
Perform application layer inspection in a transparent mode without requiring architectural changes by utilizing a PKI controller and KMS controller to retrieve private keys and certificates for decapsulation and decryption, enabling out-of-band or in-band inspection without TLS termination between client and server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine-in-the-middle arrangement is used for TLS termination and traffic inspection, then application layer inspection capability is achieved, but latency is introduced and architectural changes are required
Solution Approach 1:
The patent extracts the TLS termination function from the traditional machine-in-the-middle Reverse Proxy and relocates it to the client-side. The client application directly terminates TLS using its own private key, eliminating the need for a central inspection machine and the associated latency. This allows the server to receive already-decrypted traffic without adding inspection overhead.
Solution Approach 2:
The patent introduces a new intermediary mechanism where the client application acts as its own TLS terminator and inspection point. Instead of traffic flowing through a central Reverse Proxy, the client application itself performs the TLS termination and application layer inspection locally, eliminating the intermediary machine that caused latency.
2Reliability
If machine-in-the-middle arrangement is used for TLS termination and traffic inspection, then application layer inspection capability is achieved, but code changes are required for legacy applications
Solution Approach 1:
The patent enables each client application to perform its own TLS termination and inspection independently. The client application uses its own private key to terminate TLS and inspect traffic locally, eliminating the need for centralized machine-in-the-middle architecture and associated code changes to legacy applications.
Solution Approach 2:
The patent inverts the traditional inspection architecture by moving TLS termination from the server-side Reverse Proxy to the client-side application. Instead of the server inspecting traffic after TLS termination, the client application performs TLS termination and inspection before traffic reaches the server, eliminating the need for server-side code changes.
3Productivity
If out-of-band inspection is used, then performance impact is reduced, but deep inspection of encrypted data is not available
Solution Approach 1:
The patent performs TLS termination and decryption as a preliminary action at the client application before traffic reaches the server. The client application uses its own private key to decrypt traffic locally, making the data available for deep inspection without requiring out-of-band inspection methods that cannot deeply inspect encrypted data.
Data Source
AI summary
Systems and methods are provided for requesting, at a service configured on a server, a public key infrastructure (PKI) generated certificate using a PKI agent, where the PKI agent stores a private key and the generated certificate in a key management service (KMS). An application layer security controller communicatively coupled to the server registers the service to enable the application layer to inspect packets. The PKI agent transmits version information for the certificates to the application layer security controller, and the PKI agent updates the certificates and keys in the KMS. The service and an application layer datapath component change the routing of packets using an overlay network and inspect at least one of the packets. The application layer datapath component decapsulates at least one packet by using the private keys and certificates retrieved from the KMS, and performs application inspection of the decapsulated packet.