Virtual Encryption Patching via Multiple TLS Implementations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transport Layer Security (TLS) implementations are vulnerable to various attacks due to complex designs, multiple cipher suites, and cryptographic blocks, leading to bugs that can result in data breaches and significant downtime for servers, with vulnerabilities often remaining undetected for long periods.
Innovation Solution
A security gateway employing multiple Transport Layer Security Implementations (TLSIs) that can selectively disable vulnerable TLSIs, allowing secure communication to continue through remaining enabled TLSIs, effectively 'virtually patching' servers by rerouting traffic through unaffected implementations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single TLS implementation is used to secure communications, then the system is simple to manage and configure, but the system becomes vulnerable to attacks when that implementation contains bugs or security flaws
Solution Approach 1:
The system segments the TLS implementation functionality by maintaining multiple independent TLS implementations (e.g., OpenSSL, GnuTLS, NSS) within the gateway. Each implementation operates as a separate module that can be independently selected, enabled, or disabled based on security requirements, thereby distributing the security risk across multiple implementations rather than relying on a single vulnerable implementation.
Solution Approach 2:
The system dynamically changes the operational parameters of TLS implementations by enabling or disabling specific implementations based on detected security vulnerabilities. When a vulnerability is identified in one TLS implementation, the system modifies the configuration parameter (enabled/disabled state) to prevent usage of that implementation while maintaining service through alternative implementations.
2Reliability
If multiple TLS implementations are maintained for security redundancy, then the system can quickly patch vulnerabilities by disabling affected implementations, but the system complexity and resource consumption increase
Solution Approach 1:
The system performs preliminary actions by pre-configuring and maintaining multiple TLS implementations in advance before vulnerabilities are detected. This allows the system to have ready-to-use alternative implementations that can be immediately activated when a security vulnerability is identified in the currently used implementation, eliminating the need for time-consuming patching or installation processes during security incidents.
Solution Approach 2:
The gateway acts as an intermediary layer between clients and server applications, managing multiple TLS implementations centrally. This intermediary structure allows the gateway to transparently route traffic through different TLS implementations based on security conditions without requiring modifications to the server applications or client systems, thereby managing complexity in a centralized location.
3Reliability
If a vulnerable TLS implementation is patched by shutting down the server, then the security vulnerability is addressed, but significant downtime occurs affecting service availability
Solution Approach 1:
The system ensures continuity of useful action by maintaining multiple TLS implementations that can seamlessly take over when one implementation becomes vulnerable. The gateway continuously monitors the security status of each implementation and automatically switches to an alternative implementation without interrupting the secure communication service, thereby maintaining continuous operation without server shutdowns or significant downtime.
Solution Approach 2:
The system introduces dynamics by making the TLS implementation selection flexible and adaptive rather than static. The gateway dynamically selects which TLS implementation to use based on real-time security conditions, enabling automatic adaptation to new security threats without requiring manual intervention or system shutdowns.
4Adaptability or versatility
If TLS implementations support various versions, cipher suites, and cryptographic blocks, then the system provides broad compatibility and versatility, but the complexity increases making the implementation more bug-prone
Solution Approach 1:
The system uses copying by deploying multiple complete TLS implementation copies (different libraries such as OpenSSL, GnuTLS, NSS) within the gateway. Each copy provides full support for various TLS versions, cipher suites, and cryptographic blocks independently. This allows the system to maintain broad protocol compatibility through multiple independent copies rather than attempting to consolidate all functionality into a single complex implementation.
Data Source
AI summary
Techniques related to virtual encryption patching are described. A security gateway includes multiple Transport Layer Security Implementations (TLSI) that can be used for creating secure communications channels to carry application-layer traffic between one or more clients and one or more server applications. In some embodiments, upon determining that one of the multiple TLSIs contains a security vulnerability, that TLSI can be disabled, leaving one or more others of the multiple TLSIs enabled and available to be used to carry traffic of new connections between the clients and server applications.