Encrypted self-identification using a proxy server
Some database systems may implement encrypted connections to improve the security of incoming server traffic. The systems may implement the encrypted connections using encryption keys known to both a proxy server and a server (e.g., a database server). For example, a proxy server may encrypt one or more communications between the proxy server and a user device, such as self-identifying information for the user device, using a known encryption key. The user device may, in turn, attempt to establish an encrypted connection with the server using the encrypted communications. Because the encryption key is known to both the server and the proxy server, the server may decrypt the encrypted communications and subsequently establish an encrypted connection with the user device based on the decrypted communications.
1. A method for establishing an encrypted connection between a user device and a server, comprising:
transmitting a query message from the user device to a proxy server, wherein the query message comprises identification information of the user device, wherein the identification information of the user device comprises an Internet Protocol (IP) address, a Transmission Control Protocol (TCP), or other communication protocol;
receiving an encrypted message from the proxy server at the user device, wherein the encrypted message comprises ciphertext corresponding to the identification information of the user device based on an encryption key that is known to the proxy server and the server;
transmitting the encrypted message from the user device to the server, wherein the server is configured to decrypt the encrypted message using the encryption key;
establishing an encrypted connection between the user device and the server, wherein the encrypted connection is based at least in part on the identification information of the user device; and
re-establishing the encrypted connection between the user device and the server using a re-generated encryption key based at least in part on second identification information of the user device different than the identification information of the user device.
2. The method of claim 1 , wherein transmitting the encrypted message comprises:
transmitting a connection request message from the user device to the server, wherein the connection request message comprises the encrypted message located in a header of the connection request message, and wherein the encrypted connection is established based at least in part on a comparison between the identification information of the user device in the encrypted message and identification information for an originator of the connection request message.
3. The method of claim 2 , wherein the connection request message comprises a Hypertext Transfer Protocol (HTTP) request message.
4. The method of claim 2 , further comprising:
encrypting the connection request message.
5. The method of claim 4 , wherein the encrypted message and the encrypted connection request message are encrypted using different encryption keys, wherein the proxy server and the server have access to an encryption key for the encrypted connection request message.
6. The method of claim 1 , wherein the encrypted message is transmitted to one or more additional proxy servers, wherein each of the one or more additional proxy servers is configured to transmit the encrypted message to the server.
7. The method of claim 1 , wherein the encrypted connection is established based at least in part on the decryption of the encrypted message using the encryption key.
8. The method of claim 1 , wherein the query message comprises a cryptographic nonce, a timestamp, or both.
9. The method of claim 1 , further comprising:
re-generating the encrypted message using the encryption key, wherein the encrypted message is re-generated based at least in part on a change in the identification information of the user device.
10. A method for establishing an encrypted connection between a server and a user device, comprising:
receiving a query message at a proxy server from the user device, wherein the query message comprises identification information of the user device, wherein the identification information of the user device comprises an Internet Protocol (IP) address, a Transmission Control Protocol (TCP), or other communication protocol;
generating an encrypted message by the proxy server using an encryption key that is known to the proxy server and the server wherein the encrypted message comprises ciphertext corresponding to the identification information of the user device;
transmitting the encrypted message from the proxy server to the user device;
receiving the encrypted message from the user device at the server;
decrypting the encrypted message at the server using the encryption key; and
re-generating the encrypted message using a regenerated encryption key based at least in part on a change in the identification information of the user device.
11. The method of claim 10 , further comprising:
determining whether the query message is modified between the user device and the proxy server, wherein generating the encrypted message is based at least in part on the determination.
12. The method of claim 10 , wherein the ciphertext is located within a header of the encrypted message.
13. The method of claim 10 , further comprising:
re-generating the encrypted message using the encryption key, wherein the encrypted message is re-generated based at least in part on a change in the identification information of the user device.
14. The method of claim 13 , further comprising:
generating the encrypted message using a second encryption key, wherein the second encryption key is different than the encryption key.
15. The method of claim 10 , wherein the query message is received from the user device based at least in part on the identification information of the user device being a known characteristic.
16. The method of claim 10 , wherein receiving the encrypted message comprises:
receiving a connection request message from the user device at the server, wherein the connection request message comprises the encrypted message located in a header of the connection request message, the method further comprising:
establishing an encrypted connection between the user device and the server based at least in part on a comparison between the identification information of the user device in the encrypted message and identification information for an originator of the connection request message.
17. An apparatus for establishing an encrypted connection between a user device and a server, comprising:
a processor;
memory in electronic communication with the processor; and
instructions stored in the memory and operable, when executed by the processor, to cause the apparatus to:
transmit a query message from the user device to a proxy server, wherein the query message comprises identification information of the user device, wherein the identification information of the user device comprises an Internet Protocol (IP) address, a Transmission Control Protocol (TCP), or other communication protocol;
receive an encrypted message from the proxy server at the user device, wherein the encrypted message comprises ciphertext corresponding to the identification information of the user device based on an encryption key that is known to the proxy server and the server;
transmit the encrypted message from the user device to the server, wherein the server is configured to decrypt the encrypted message using the encryption key;
establish an encrypted connection between the user device and the server, wherein the encrypted connection is based at least in part on the identification information of the user device; and
re-establish the encrypted connection between the user device and the server using a regenerated encryption key based at least in part on second identification information of the user device different than the identification information of the user device.
18. The apparatus of claim 17 , wherein the instruction stored in the memory operable to cause the apparatus to transmit the encrypted message comprise instructions operable to cause the apparatus to:
transmit a connection request message from the user device to the server, wherein the connection request message comprises the encrypted message located in a header of the connection request message, and wherein the encrypted connection is established based at least in part on a comparison between the identification information of the user device in the encrypted message and identification information for an originator of the connection request message.
19. An apparatus for establishing an encrypted connection between a server and a user device, comprising:
a processor;
memory in electronic communication with the processor; and
instructions stored in the memory and operable, when executed by the processor, to cause the apparatus to:
receive a query message at a proxy server from the user device, wherein the query message comprises identification information of the user device, wherein the identification information of the user device comprises an Internet Protocol (IP) address, a Transmission Control Protocol (TCP), or other communication protocol;
generate an encrypted message by the proxy server using an encryption key that is known to the proxy server and the server, wherein the encrypted message comprises ciphertext corresponding to the identification information of the user device;
transmit the encrypted message from the proxy server to the user device;
receive the encrypted message from the user device at the server;
decrypt the encrypted message at the server using the encryption key; and
re-generate the encrypted message using a regenerated encryption key based at least in part on a change in the identification information of the user device.