`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 1 of 4
`
`
`
`
`
`EXHIBIT 2
`EXHIBIT 2
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 2 of 4
`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 2 of 4
`
`JUNIPET
`
`
`
`Aurnentication and intecsrated User Firewalls
`Feature Guide for becurity Devices
`
`
`
`Modified: 2017-08-02
`
`Copyright © 2017, Juniper Networks, Inc.
`
`JNPR-FNJN_29007 00009469
`
`
`
`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 3 of 4
`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 3 of 4
`
`Authentication and Integrated User Firewalls Feature Guide for Security Devices
`
`certificate with its own identity and signs this new certificate with its own public key
`(provided as a part of the proxy profile configuration). When the client accepts such
`a certificate, it sends a shared pre-master key encrypted with the public key on the
`certificate. Because SSL proxy replaced the original key with its own key,it is able to
`receive the shared pre-master key. Decryption and encryption take place in each
`direction (client and server), and the keys are different for both encryption and
`decryption.
`
`i? depicts how SSL inspection (on an existing SRX Series IDP module)
`:
`
`typically used to protect servers. SSL inspection requires access to the private keys
`isis
`used by the servers so that the SRX Series device can decrypt the encrypted traffic.
`
`Figure 1 SSL insmection onan Existing SR Series [DP Mocuie
`
`SSL inspection
`
`
`
`eT
`aa : :
`Untrust fpoohatemet
`Zone
`\
`“he
`Na - .
`
`3 oe
`
`SPO Series device
`
`i Server private keys
`:
`loaded an the
`rye oe
`SRX Series device
`
`SRE Series device BMtZ
`zone g0s4212
`
`Vebservers
`
`
`re
`= shows how SSL proxy works on an encrypted payload. When
`application firewall (AppFW), Intrusion Detection and Prevention (IDP), or application
`tracking (AppTrack) is configured, the SSL proxy acts as an SSL server by terminating
`the SSL session from the client and establishing a new SSL session to the server, the
`SRX Series device decrypts and then reencrypts all SSL proxy traffic. SSL proxy uses the
`following:
`
`« SSL-T-SSL terminator on the client side.
`
`« SSL-I-SSL initiator on the server side.
`
`« Configured AppFW,IDP, or AppTrack services use the decrypted SSL sessions.
`
`12
`
`Copyright © 2017, Juniper Networks,Inc.
`
`JNPR-FNJN_29007 00009506
`
`
`
`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 4 of 4
`Case 3:17-cv-05659-WHA Document 480-3 Filed 05/16/19 Page 4 of 4
`
`Chapter 3: Configuring Encrypted Files Using SSL Proxy
`
`
`
`
`
` =:
`If none of the services (AppFW,IDP, or AppTrack) are configured,
`then SSLproxy services are bypassed even if an SSL proxy profile is
`attached to a firewall policy.
`
` TE: The IDP module will not perform its SSL inspection on a session if
`SSL pproxy is enabled for that session. Thatis, if both SSL inspection and
`SSL proxy are enabled onasession, SSL proxy will always take precedence.
`
`Figure 2. S31 Froxyoan an Encryoted Payinac
`
`SSL forward proxy
`
`Unerust
`zone
`
`a
`a a
`i
`nternet
`\
`te%,
`
`Me
`
`Server keys are unknown, so
`the server certificate is modified
`d by the SRX Series device
`
`Trust
`zone
`
`Client
`
`+ais=3=
`
`
`
`Perfect Forward Secrecy (PFS) is a feature of specific key agreement protocols that
`provides assurancesyour session keys will not be compromised even if the private key
`of the server is compromised. By generating a unique session key for every session flow
`a user initiates, the compromise of a single session key will not affect any data other than
`that exchangedin the specific session protected by that particular key. For PFS to function,
`the key used to protect transmission of data must not be used to derive any additional
`keys, and if the key used to protect transmission of data was derived from some other
`keying material, that material must not be used to derive any further keys.
`
`The ECDHE (Elliptic Curve DHE) cipher suits are used to enable the PFS on SSL proxy.
`ECDHE cipher suits are based on elliptic curve cryptography, which provides the same
`level of security as the RSA with smaller keys. SSL proxy is targeted to support only
`ECDHE ciphers suites as they are less expensive computationally than DHE ciphers.
`
`Copyright © 2017, Juniper Networks, Inc.
`
`13
`
`JNPR-FNJIN_29007 00009507
`
`