Thou Shall Not Pass: Gatekeeping Outbound TLS Connections

• URL: http://arxiv.org/abs/2605.31020v1
• Date: Fri, 29 May 2026 08:53:24 GMT
• Title: Thou Shall Not Pass: Gatekeeping Outbound TLS Connections
• Abstract summary: We analyze more than 50 million TLS handshakes over a two-week period at our research institution, Fondazione Bruno Kessler.<n>Servers are adopting the latest TLS advancements much faster than official guidelines can be updated to provide directives for them.<n>We present TLSGatekeeper, a real-time, network-based tool that transparently monitors handshakes, analyzes server parameters, and reports non-compliant connections.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Despite the widespread use of Transport Layer Security (TLS), its security guarantees are frequently compromised by outdated versions and misconfigurations. To analyze this problem, we collected more than 50 million TLS handshakes over a two-week period at our research institution, Fondazione Bruno Kessler, and analyzed three server-selected parameters against the recommendations of four TLS guidelines. Our analysis shows that while the use of insecure or outdated options is minimal, it remains persistent. More importantly, servers are adopting the latest TLS advancements much faster than official guidelines can be updated to provide directives for them. These findings, combined with the difficulty of configuring TLS clients due to their ephemeral, ubiquitous and server-dependent nature, leave users vulnerable to non-standard or outright insecure connections. To address this, we present TLSGatekeeper, a real-time, network-based tool that transparently monitors handshakes, analyzes server parameters, and, based on organizational policy, reports non-compliant connections without requiring client-side modifications. Unlike Next-Generation Firewalls, TLSGatekeeper preserves end-to-end privacy by validating only handshakes, and offers greater flexibility in defining undesired configurations. Our evaluation shows that TLSGatekeeper sustains traffic rates of up to 100 Gbps while preventing insecure connections, with an average added processing delay of 671 ns (TLS 1.3) and 795 ns (TLS 1.2) per handshake packet, making enforcement feasible at scale.

Related papers

• Session Attestation for Unmodified TLS Services in Confidential Virtual Machines [0.9825966924601678]
  We present SessionLatch, which provides session attestation while preserving all three.<n>A temporary latch holds client encrypted records while evidence exchange overlaps the application TLS handshake, then removes itself after verification.<n>SessionLatch reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments.
  arXiv  Detail & Related papers  (2026-09-09T03:36:24Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents [76.4694046738862]
  TokenWall is a runtime defense framework that acts as a semantic firewall over agent token flows.<n>We show that TokenWall reduces attack success rate to 12.5% while maintaining a 97.4% benign executable pass rate without human confirmation.
  arXiv  Detail & Related papers  (2026-07-09T12:18:40Z)
• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• SecureForge: Finding and Preventing Vulnerabilities in LLM-Generated Code via Prompt Optimization [61.91729298584227]
  We introduce SecureForge, an automated pipeline that audits security risks of frontier models and produces auditing-informed secure system prompts.<n>SecureForge first identifies benign prompts that produce statically detectable vulnerabilities, and then amplifies them into a large synthetic prompt corpus of diverse scenarios.<n>On frontier models, SecureForge yields a statistically significant improvement in both unit test success and output security, with output vulnerabilities reduced by up to 48%.
  arXiv  Detail & Related papers  (2026-05-08T18:40:47Z)
• SST-Guard: Detecting and Characterizing Server-Side Google Analytics in the Wild [48.894149803432605]
  We present SST-Guard, a browser-based system for detecting and blocking server-side Google Analytics (sGA)<n>SST-Guard aims to detect underlying artifacts of collection and sharing of these semantic values to any arbitrary endpoint.<n>We validate SST-Guard on Tranco top-10k websites, detecting 4.02% (403) sGA domains with over 93% accuracy across three modalities.
  arXiv  Detail & Related papers  (2026-04-30T06:50:14Z)
• Bidirectional TLS Handshake Caching for Constrained Industrial IoT Scenarios [2.479074862022315]
  BiTHaC realizes bidirectional TLS handshake caching by exploiting that significant parts of repeated TLS handshakes, especially certificates, are static.<n>We show that we can reduce the bandwidth consumption of TLS handshakes by up to 61.1% and the computational overhead by up to 8.5%, while incurring only well-manageable memory overhead and preserving the strict security guarantees of TLS.
  arXiv  Detail & Related papers  (2025-08-05T11:00:41Z)
• LURK-T: Limited Use of Remote Keys With Added Trust in TLS 1.3 [6.262801814917709]
  LURK-T is a provably secure framework which allows for limited use of remote keys with added trust in TLS 1.3.<n>We efficiently decouple the server side of TLS 1.3 into a LURK-T Crypto Service (CS) and a LURK-T Engine (E)<n>CS executes all cryptographic operations in a Trusted Execution Environment (TEE)<n>We show that, from a TLS-client's perspective, HTTPS servers using LURK-T instead a traditional TLS-server have no noticeable overhead when serving files greater than 1MB.
  arXiv  Detail & Related papers  (2025-05-21T15:23:17Z)
• How Robust Are Router-LLMs? Analysis of the Fragility of LLM Routing Capabilities [62.474732677086855]
  Large language model (LLM) routing has emerged as a crucial strategy for balancing computational costs with performance.<n>We propose the DSC benchmark: Diverse, Simple, and Categorized, an evaluation framework that categorizes router performance across a broad spectrum of query types.
  arXiv  Detail & Related papers  (2025-03-20T19:52:30Z)
• Fundamental Limits of Hierarchical Secure Aggregation with Cyclic User Association [93.46811590752814]
  Hierarchical secure aggregation is motivated by federated learning (FL)<n>In this paper, we consider HSA with a cyclic association pattern where each user is connected to $B$ consecutive relays.<n>We propose an efficient aggregation scheme which includes a message design for the inputs inspired by gradient coding.
  arXiv  Detail & Related papers  (2025-03-06T15:53:37Z)
• An Efficient TLS 1.3 Handshake Protocol with VC Certificate Type [0.0]
  The paper presents a step forward in the design and implementation of a Transport Layer Security (TLS) handshake protocol.<n>It enables the use of Verifiable Credential (VC) while maintaining full compliance with RFC-8446 and preserving all the security features of TLS 1.3.<n>Results pave the way for the adoption of Self-Sovereign Identity in large-scale Internet of Things (IoT) systems.
  arXiv  Detail & Related papers  (2024-07-17T13:18:16Z)
• TurboTLS: TLS connection establishment with 1 less round trip [2.307447796778038]
  We show how to establish TLS connections using one less round trip. In our approach, which we call TurboTLS, the initial client-to-server and server-to-client flows of the TLS handshake are sent over UDP rather than TCP.
  arXiv  Detail & Related papers  (2023-02-10T15:16:16Z)
• Adaptive Webpage Fingerprinting from TLS Traces [13.009834690757614]
  In webpage fingerprinting, an adversary infers the specific webpage loaded by a victim user by analysing the patterns in the encrypted TLS traffic exchanged between the user's browser and the website's servers. This work studies modern webpage fingerprinting adversaries against the TLS protocol. We introduce a TLS-specific model that: 1) scales to an unprecedented number of target webpages, 2) can accurately classify thousands of classes it never encountered during training, and 3) has low operational costs even in scenarios of frequent page updates.
  arXiv  Detail & Related papers  (2020-10-19T15:13:07Z)
• Towards Bidirectional Protection in Federated Learning [70.36925233356335]
  F2ED-LEARNING offers bidirectional defense against malicious centralized server and Byzantine malicious clients. F2ED-LEARNING securely aggregates each shard's update and launches FilterL2 on updates from different shards. evaluation shows that F2ED-LEARNING consistently achieves optimal or close-to-optimal performance.
  arXiv  Detail & Related papers  (2020-10-02T19:37:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.