Dynamic bypass of TLS connections matching exclusion list in DPI-SSL in a NAT deployment
View Patent ↗The present invention provides the initiation of a transport layer security (TLS) session between a client device and a server using a firewall without interruption. The present invention holds a TLS hello message received from the client device until after the server has been validated. A firewall consistent with the present invention does not interrupt a transport layer control (TCP) connection that was established between the client device and the firewall before the TLS hello message was received by the firewall.
1. A method for establishing a transport layer security (TLS) session, the method comprising:
receiving at a firewall a first TLS hello message transmitted from a client device;
holding the first TLS hello message at the firewall until a server addressed in the first TLS hello message has been validated, wherein validation of the server includes:
transmitting a second TLS hello message from the firewall to the server, wherein the second TLS hello message transmitted from the firewall to the server is not identical to the first TLS hello message transmitted from the client device, and
comparing information in a certificate received from the server with information stored at the firewall;
overwriting the first TLS hello message held at the firewall in response to an additional TLS hello message being received at the firewall while the first TLS hello message is being held;
holding the additional TLS hello message at the firewall until after the server addressed in the first TLS hello message has been validated;
transmitting the additional TLS hello message to the server in response to the first TLS hello message having been overwritten and upon validating the server, wherein the additional TLS hello message transmitted to the server is transmitted in response to the first TLS hello message held at the firewall having been overwritten, and wherein the transmission initiates a TLS session without interrupting a transmission control protocol (TCP) connection between the client device and the firewall; and
transparently passing subsequent TCP messages transmitted between the client and the server after validating the server.
2. The method of claim 1 , wherein prior to receiving the first client hello message the firewall:
receives a first TCP synchronize message from the client device;
transmits a first TCP synchronize message to the server;
receives a first TCP synchronize acknowledgement message from the server;
transmits a first TCP synchronize acknowledgement message to the client device;
receives a first TCP acknowledgement from the client device, wherein the TCP acknowledgement received from the client device establishes a first TCP connection between the client device and the firewall; and
transmits a first TCP acknowledgement to the server, wherein the transmitting of the first TCP acknowledgement to the server establishes a first TCP connection between the firewall and the server.
3. The method of claim 2 , wherein the messages received from the client device do not provide an internet protocol (IP) address of the firewall, and the first client hello message does not include at least one of a domain name service (DNS) hostname, a common name associated with the server, and a domain name.
4. The method of claim 1 , wherein prior to validating the certificate the firewall:
inspects the received TLS client hello message by a deep packet inspection secure socket layer (DPI-SSL) parser;
receives a TLS server certificate message from the server; and
inspects the received TLS server certificate message by the DPI-SSL parser.
5. The method of claim 1 , wherein prior to the transmission to the server, the firewall:
resets a first TCP connection between the firewall and the server, wherein the resetting of the first TCP connection terminates the first TCP connection between the firewall and the server;
transmits a second TCP synchronization message to the server;
receives a second TCP synchronization acknowledgement from the server; and
transmits a second TCP acknowledgement to the server, wherein the transmitting of the second TCP acknowledgement message to the server establishes a second TCP connection between the firewall and the server.
6. The method of claim 5 , wherein communications between the firewall and the server are communicated over a TCP port of the firewall and a TCP port of the server on an outbound interface of the firewall according to an network address translation (NAT) mapping that abstracts the real IP address of the client from the server.
7. The method of claim 6 , wherein:
the TCP port of the firewall and the TCP port of the server are stored in a first association that binds the TCP port of the firewall and the TCP port of the server with a first TCP connection between the firewall and the server,
the first association stored in the firewall is deleted when the first TCP connection is terminated, and
a second TCP port of the firewall and the TCP port of the server are stored in a second association that binds the second TCP port of the firewall and the TCP port of the server with the second TCP connection between the firewall and the server.
8. The method of claim 7 , wherein the first association and the second association are stored in a hash table.
9. The method of claim 1 , wherein the information compared when validating the server is at least one of a domain name service (DNS) hostname, a common name, and a domain name.
10. The method of claim 1 , further comprising classifying the TLS session between the client device and the server as bypass before the TCP messages between the client device and the server are transparently passed between the client device and the server.
11. The method of claim 1 , wherein the information compared when validating the server is stored in at least one of a dynamic exclusion list and a user defined exclusion list.
12. The method of claim 11 , further comprising adding the information compared when validating the server to the dynamic exclusion list when the information is not currently in the dynamic exclusion list.
13. The method of claim 11 , wherein the dynamic exclusion list is a data structure stored in a local cache memory in the firewall.
14. The method of claim 11 , further comprising:
receiving a subsequent TLS client hello message after the TLS session has been interrupted, the subsequent TLS client hello message received from at least one of the client device and another client device, and the subsequent TLS client hello message including the common name and an IP address of the server;
identifying that the common name is listed in the at least one of the dynamic exclusion list and the user defined exclusion list, wherein the identification re-initiates the TLS session; and
transparently passing TCP messages transmitted between the at least one of the client device and the another client device and the server after identifying that the common name is listed in the at least one of the dynamic exclusion list and the user defined exclusion list.
15. The method of claim 11 , further comprising:
receiving a subsequent TLS client hello message after the TLS session has been interrupted from at least one of the client device and another client device, the subsequent TLS client hello message including the common name and a different server IP address;
identifying that the common name is listed in the at least one of the dynamic exclusion list and the user defined exclusion list, wherein the TLS session is re-initiated; and
transparently passing TCP messages transmitted between the at least one of the client device and the another client device and the server after identifying that the common name is listed in the dynamic exclusion list.
16. The method of claim 11 , further comprising:
receiving a subsequent TLS client hello message on a subsequent new TCP connection between at least one of the client device and another client device, the subsequent TLS client hello message including the common name;
holding the subsequent TLS hello message at the firewall until a server addressed in the subsequent TLS hello message has been validated, wherein validation of the server includes:
transmitting another TLS hello message from the firewall to the server;
comparing information in a certificate received from the server with information stored at the firewall;
transmitting the subsequent TLS hello message to the server, wherein
transmitting the subsequent TLS hello message initiates a TLS session without interrupting a transmission control protocol (TCP) connection between the client device and the firewall; and
transparently passing subsequent TCP messages transmitted between the client and the server after validating the server.
17. The method of claim 1 , further comprising:
classifying the TLS session between the client device and the server as bypass prior to transparently passing the subsequent TCP messages between the client and the server,
storing the compared information when validating the server in at least one of a dynamic exclusion list and a user defined exclusion list, and
copying the compared information to the dynamic exclusion list after classifying the TLS session to bypass when the information is not currently in the dynamic exclusion list.
18. The method of claim 1 , wherein the passed through TCP messages are forwarded through the firewall between the client and the server.
19. The method of claim 1 , further comprising comparing information in the transmitted message with the information in the certificate, wherein the transmitted message is validated when the information in the additional client hello message matches the information in the certificate.