Methods and systems for efficient encrypted SNI filtering for cybersecurity applications

1. A packet filtering device comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the packet filtering device to:

receive one or more policies comprising a plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on one or more network threat indicators comprising a plurality of domain names associated with one or more threats;

receive, from a first device, a plurality of packets, wherein the plurality of packets comprises ciphertext comprising an encrypted server name indication (eSNI) value;

determine whether a plaintext hostname is resolvable from the ciphertext without decrypting the ciphertext;

determine, based on a determination that the plaintext hostname is resolvable from the ciphertext, whether the plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats; and

apply, based on a determination that the plaintext hostname matches a first domain name indicated by a first packet-filtering rule of the plurality of packet-filtering rules, a packet filtering operation to the plurality of packets.

2. The packet filtering device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

determine a destination network address associated with the plurality of packets;

query, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext; and

receive, based on querying the data structure, a response comprising the plaintext hostname associated with the ciphertext.

3. The packet filtering device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

determine a destination network address associated with the plurality of packets;

query, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext; and

receive, based on querying the data structure, a response comprising a plurality of hostnames associated with the destination network address, wherein the plurality of hostnames comprises the plaintext hostname.

4. The packet filtering device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

determine a destination network address associated with the plurality of packets;

query, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext;

receive, based on querying the data structure, a response that the plaintext hostname cannot be resolved from the destination network address;

transmit, to a first device that sent the plurality of packets, a response indicating retransmission of the plurality of packets with a plaintext server name indication (SNI); and

receive the retransmission of the plurality of packets with the plaintext SNI.

5. The packet filtering device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

receive, prior to receiving the plurality of packets, a DNS query request and an associated DNS query response;

store the DNS query in a data structure; and

query, based on receiving the plurality of packets with the ciphertext from the first device, the data structure to determine the plaintext hostname.

6. The packet filtering device of claim 1 , wherein the packet filtering operation comprises blocking the plurality of packets from continuing toward its intended destination, and the instructions, when executed by the one or more processors, cause the packet filtering device to:

send, to the first device, a response to the plurality of packets, wherein the response comprises at least one of: a TCP Reset (RST) message or a TLS handshake proxy message.

7. The packet filtering device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

receive a second plurality of packets, wherein the second plurality of packets comprises second ciphertext comprising a second eSNI value;

determine whether a second plaintext hostname is resolvable from the second ciphertext;

determine, based on a determination that the second plaintext hostname is resolvable from the second ciphertext, whether the second plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats; and

allow, based on a determination that the second plaintext hostname does not match a domain name indicated by any of the plurality of packet-filtering rules, the second plurality of packets to continue toward its intended destination.

8. The packet filtering device of claim 7 , wherein the second plurality of packets comprise one or more communications for creating a secure communication channel with the intended destination.

9. The packet filtering device of claim 1 , wherein the packet filtering device resides at a boundary that interfaces between a protected network and an unprotected network.

10. The packet filtering device of claim 1 , wherein the packet filtering operation comprises at least one of:

blocking the plurality of packets from continuing toward its intended destination;

allowing the plurality of packets to continue to its intended destination and forwarding a copy of the plurality of packets to a first proxy for monitoring; or

forwarding the plurality of packets to a second proxy.

11. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause a packet filtering device to:

receive one or more policies comprising a plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on one or more network threat indicators comprising a plurality of domain names associated with one or more threats;

receive, from a first device, a plurality of packets, wherein the plurality of packets comprises ciphertext comprising an encrypted server name indication (eSNI) value;

determine whether a plaintext hostname is resolvable from the ciphertext without decrypting the ciphertext;

determine, based on a determination that the plaintext hostname is resolvable from the ciphertext, whether the plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats; and

apply, based on a determination that the plaintext hostname matches a first domain name indicated by a first packet-filtering rule of the plurality of packet-filtering rules, a packet filtering operation to the plurality of packets.

12. The non-transitory computer-readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

determine a destination network address associated with the plurality of packets;

query, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext; and

receive, based on querying the data structure, a response comprising the plaintext hostname associated with the ciphertext.

13. The non-transitory computer-readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

determine a destination network address associated with the plurality of packets;

query, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext; and

receive, based on querying the data structure, a response comprising a plurality of hostnames associated with the destination network address, wherein the plurality of hostnames comprises the plaintext hostname.

14. The non-transitory computer-readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

determine a destination network address associated with the plurality of packets;

query, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext;

receive, based on querying the data structure, a response that the plaintext hostname cannot be resolved from the destination network address;

transmit, to a first device that sent the plurality of packets, a response indicating retransmission of the plurality of packets with a plaintext server name indication (SNI); and

receive the retransmission of the plurality of packets with the plaintext SNI.

15. The non-transitory computer-readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

receive, prior to receiving the plurality of packets, a DNS query request and an associated DNS query response;

store the DNS query in a data structure; and

query, based on receiving the plurality of packets with the ciphertext from the first device, the data structure to determine the plaintext hostname.

16. The non-transitory computer-readable medium of claim 11 , wherein the packet filtering operation comprises blocking the plurality of packets from continuing toward its intended destination, and the instructions, when executed by the one or more processors, cause the packet filtering device to:

send, to the first device, a response to the plurality of packets, wherein the response comprises at least one of: a TCP Reset (RST) message or a TLS handshake proxy message.

17. The non-transitory computer-readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, cause the packet filtering device to:

receive a second plurality of packets, wherein the second plurality of packets comprises second ciphertext comprising a second eSNI value;

determine whether a second plaintext hostname is resolvable from the second ciphertext;

determine, based on a determination that the second plaintext hostname is resolvable from the second ciphertext, whether the second plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats; and

allow, based on a determination that the second plaintext hostname does not match a domain name indicated by any of the plurality of packet-filtering rules, the second plurality of packets to continue toward its intended destination.

18. The non-transitory computer-readable medium of claim 17 , wherein the second plurality of packets comprise one or more communications for creating a secure communication channel with the intended destination.

19. The non-transitory computer-readable medium of claim 11 , wherein the packet filtering device resides at a boundary that interfaces between a protected network and an unprotected network.

20. The non-transitory computer-readable medium of claim 11 , wherein the packet filtering operation comprises at least one of:

blocking the plurality of packets from continuing toward its intended destination;

allowing the plurality of packets to continue to its intended destination and forwarding a copy of the plurality of packets to a first proxy for monitoring; or

forwarding the plurality of packets to a second proxy.

21. A method comprising:

receiving, by a packet filtering device, one or more policies comprising a plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on one or more network threat indicators comprising a plurality of domain names associated with one or more threats;

receiving, from a first device, a plurality of packets, wherein the plurality of packets comprises ciphertext comprising an encrypted server name indication (eSNI) value;

determining whether a plaintext hostname is resolvable from the ciphertext without decrypting the ciphertext;

determining, based on a determination that the plaintext hostname is resolvable from the ciphertext, whether the plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats; and

applying, based on a determination that the plaintext hostname matches a first domain name indicated by a first packet-filtering rule of the plurality of packet-filtering rules, a packet filtering operation to the plurality of packets.

22. The method of claim 21 , further comprising:

determining a destination network address associated with the plurality of packets;

querying, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext; and

receiving, based on the querying the data structure, a response comprising the plaintext hostname associated with the ciphertext.

23. The method of claim 21 , further comprising:

determining a destination network address associated with the plurality of packets;

querying, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext; and

receiving, based on the querying the data structure, a response comprising a plurality of hostnames associated with the destination network address, wherein the plurality of hostnames comprises the plaintext hostname.

24. The method of claim 21 , further comprising:

determining a destination network address associated with the plurality of packets;

querying, using the destination network address, a data structure to determine the plaintext hostname associated with the ciphertext;

receiving, based on the querying the data structure, a response that the plaintext hostname cannot be resolved from the destination network address;

transmitting, to a first device that sent the plurality of packets, a response indicating retransmission of the plurality of packets with a plaintext server name indication (SNI); and

receiving the retransmission of the plurality of packets with the plaintext SNI.

25. The method of claim 21 , further comprising:

receiving, prior to receiving the plurality of packets, a DNS query request and an associated DNS query response;

storing the DNS query in a data structure; and

querying, based on receiving the plurality of packets with the ciphertext from the first device, the data structure to determine the plaintext hostname.

26. The method of claim 21 , wherein the packet filtering operation comprises blocking the plurality of packets from continuing toward its intended destination, and the method further comprises:

sending, to the first device, a response to the plurality of packets, wherein the response comprises at least one of: a TCP Reset (RST) message or a TLS handshake proxy message.

27. The method of claim 21 , further comprising:

receiving a second plurality of packets, wherein the second plurality of packets comprises second ciphertext comprising a second eSNI value;

determining whether a second plaintext hostname is resolvable from the second ciphertext;

determining, based on a determination that the second plaintext hostname is resolvable from the second ciphertext, whether the second plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats; and

allowing, based on a determination that the second plaintext hostname does not match a domain name indicated by any of the plurality of packet-filtering rules, the second plurality of packets to continue toward its intended destination.

28. The method of claim 27 , wherein the second plurality of packets comprise one or more communications for creating a secure communication channel with the intended destination.

29. The method of claim 21 , wherein the packet filtering device resides at a boundary that interfaces between a protected network and an unprotected network.

30. The method of claim 21 , wherein the packet filtering operation comprises at least one of:

blocking the plurality of packets from continuing toward its intended destination;

allowing the plurality of packets to continue to its intended destination and forwarding a copy of the plurality of packets to a first proxy for monitoring; or

forwarding the plurality of packets to a second proxy.