ZTNA TLS Tunneling Without Double Encryption Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing zero-trust network access (ZTNA) systems face inefficiencies due to double encryption, which is computationally expensive and costly, particularly in hardware devices like firewalls, and introduces latency and reduces performance.
Innovation Solution
Eliminate double encryption by overloading the subject name and issuer (SNI) in transport layer security (TLS) and using NULL encryption, determining the need for encryption based on security policies, and establishing either a null or non-null cipher tunnel accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If double encryption is used in ZTNA systems to protect traffic through multiple proxies and firewalls, then security is improved, but computational cost and latency increase significantly
Solution Approach 1:
The patent extracts the encryption function from the firewall component, allowing the firewall to forward traffic without decryption. Only the endpoint clients perform encryption/decryption operations, removing the computationally expensive decryption task from the firewall while maintaining security through endpoint-encrypted tunnels.
Solution Approach 2:
The patent segments the encryption responsibilities between different network components. Endpoint clients handle encryption before traffic enters the network, while firewalls and proxies simply forward the already-encrypted traffic without performing decryption, dividing the security function across multiple components.
2Difficulty of detecting and measuring
If double encryption is implemented to inspect traffic at firewalls, then traffic inspection capability is improved, but performance and throughput deteriorate
Solution Approach 1:
The patent removes the decryption function from firewalls, extracting it entirely from the network infrastructure. Firewalls forward encrypted traffic without processing, eliminating the performance bottleneck caused by decryption operations while maintaining the ability to inspect traffic at the endpoints where decryption naturally occurs.
Solution Approach 2:
The patent introduces endpoint clients as intermediaries that handle all encryption and decryption operations. These endpoint intermediaries protect traffic throughout the network journey without requiring network infrastructure components like firewalls to perform computationally intensive cryptographic operations.
3Reliability
If TLS encryption is applied at every proxy layer (L4, L5, L7), then security coverage is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent makes endpoint clients universal security devices that perform multiple functions: authentication, encryption, and traffic protection. This single endpoint-based solution replaces the need for multiple proxy layers with different encryption configurations, simplifying the overall system architecture.
Solution Approach 2:
Instead of having network infrastructure components (proxies, firewalls) perform encryption, the patent inverts the approach by having endpoint clients perform encryption. This reversal eliminates the need for complex multi-layer proxy configurations while maintaining comprehensive security coverage.
Data Source
AI summary
Techniques and architecture are described for eliminating double encryption in zero-trust network access authenticated sessions. The techniques include an endpoint client-based proxy of a network receiving, from a browser, a request to access a protected private service. The endpoint client-based proxy pauses access of the browser to the protected private service and establishes a transport layer security (TLS) connection between the endpoint client-based proxy and a zero-trust network access (ZTNA) gateway. The ZTNA gateway determines whether the protected private service uses a secure transport mechanism and establishes either a null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway or a non-null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway. The endpoint client-based proxy resumes access of the browser to the protected private service.