Transparent Proxy for Encrypted Session Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional firewalls are unable to deeply inspect or modify encrypted traffic, such as VoIP and SIP traffic, due to their inability to decrypt it, which compromises security and NAT functionality, allowing illegitimate traffic to pass through.
Innovation Solution
An intermediate proxy device intercepts client-server security session requests, establishes proxy-server and client-proxy security sessions using a trusted proxy certificate, creating a dynamic certificate to transparently proxy the security session, enabling deep packet inspection and NAT services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewalls are used to inspect traffic, then security inspection capability is improved, but encrypted traffic cannot be inspected due to inability to decrypt
Solution Approach 1:
An intermediary proxy device is introduced between the client and server to establish separate encrypted sessions with each party. The proxy device acts as a mediator that can decrypt and re-encrypt traffic, enabling firewall inspection capabilities to function on encrypted sessions without requiring the original communicating parties to change their encryption protocols or keys.
2Productivity
If all secured traffic is allowed to traverse firewalls without inspection, then traffic flow is maintained, but illegitimate and harmful traffic may pass through freely
Solution Approach 1:
The proxy device serves as a trusted intermediary that terminates encrypted sessions from both client and server, allowing the firewall to inspect the decrypted traffic payload. This enables the firewall to identify and block illegitimate or harmful traffic while maintaining transparent operation to the original communicating parties, thus preserving traffic flow for legitimate communications.
3Measurement precision
If firewalls perform deep packet inspection on encrypted traffic, then inspection accuracy is improved, but encryption security is compromised without proper decryption capability
Solution Approach 1:
The encrypted communication path is segmented into three separate segments: client-to-proxy encrypted channel, proxy-to-server encrypted channel, and a middle section where the proxy device decrypts and re-encrypts traffic. This segmentation allows deep packet inspection to occur in the middle segment under controlled conditions while maintaining encryption security in the outer segments, achieving both inspection accuracy and encryption protection.
4Adaptability or versatility
If NAT functionality is applied to encrypted traffic, then address translation is improved, but NAT operations fail when signaling is encrypted
Solution Approach 1:
The proxy device acts as an intermediary that terminates encrypted signaling sessions from both client and server, exposing unencrypted signaling to the firewall for NAT operations. This allows standard NAT functionality to operate on the signaling traffic without requiring complex modifications to handle encrypted payloads, while the proxy device maintains the encrypted data paths between client and server.
Data Source
AI summary
In one embodiment, a server and a client are configured to trust a certificate of an intermediate proxy device. The proxy device may then intercept a client-server security session request message sent from the client to the server. In response, the proxy device initiates a proxy-server security session with the server and obtains server security information from the server. Then, the proxy device initiates a client-proxy security session with the client using the trusted proxy certificate, and obtains client security information from the client. Upon obtaining the client security information, the proxy device creates a dynamic certificate using the obtained client security information and the trusted proxy certificate, and establishes the initiated proxy-server security session with the dynamic certificate. The proxy device then establishes the initiated client-proxy session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.