{"id":3060,"date":"2025-10-15T07:11:36","date_gmt":"2025-10-15T07:11:36","guid":{"rendered":"https:\/\/blog.bioaffix.com\/?p=3060"},"modified":"2025-12-16T11:21:07","modified_gmt":"2025-12-16T11:21:07","slug":"what-is-bioaffix-mul-sec","status":"publish","type":"post","link":"https:\/\/blog.bioaffix.com\/en\/software\/what-is-bioaffix-mul-sec\/","title":{"rendered":"What is BioAffix Mul-Sec?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">B<a href=\"https:\/\/bioaffix.com\/\" target=\"_blank\" rel=\"noopener\">ioAffix<\/a> Mul-Sec is an encryption protocol developed by <a href=\"https:\/\/ones.com.tr\/\" target=\"_blank\" rel=\"noopener\">Ones Technology<\/a> and is currently in active use within the BioAffix infrastructure. It establishes an application-specific <strong>second TLS tunnel (&#8220;TLS-in-TLS&#8221;)<\/strong> inside the standard TLS\/SSL tunnel within the client-server communication chain. This ensures that <strong>application data remains opaque<\/strong> in scenarios involving OS-level TLS interception\/MITM\/debugging and TLS offload\/inspection at the load balancer. A package ID feature mitigates the risks of replay attacks and fraudulent clients. The inner tunnel is sustained by a root of trust that is <strong>independent of the Operating System&#8217;s Root Certificate Store<\/strong> and is established using short-lived certificates regenerated for each <strong>session<\/strong>. As a result, critical identity and access operations are protected with <strong>end-to-end<\/strong> confidentiality and authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">BioAffix Mul-Sec was developed by Ones Technology during the implementation of the <strong>Biometric Access Control Systems for the Social Security Institution<\/strong>. It is a communication protocol designed to prevent the capture of biometric and sensitive data, addressing risks posed by <strong>malicious internal personnel<\/strong> on the server\/data center side or even by the <strong>employees who code and develop the system<\/strong> during the process of collecting the biometric data of all citizens. Following the practical observation of visibility risks created by corporate CA injection, TLS offload, and client-side debugging tools, Mul-Sec has closed this gap with an application-level, per-session TLS-in-TLS approach.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Terminology<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\"><strong>TLS\/SSL:<\/strong> Technically refers to TLS 1.2\/1.3.<\/li>\n\n\n\n<li class=\"\"><strong>Outer Tunnel (Outer TLS):<\/strong> The standard tunnel managed by the browser\/OS library, established with standard x.509 certificates. This tunnel can be terminated at the Load Balancer.<\/li>\n\n\n\n<li class=\"\"><strong>Inner Tunnel (Inner TLS \/ Mul-SEC Tunnel):<\/strong> The second tunnel operating within the application, established based solely on the Mul-SEC root of trust and the compile-time signature. It uses short-lived (ephemeral) certificates\/keys for each connection.<\/li>\n\n\n\n<li class=\"\"><strong>Client:<\/strong> BioAffix Client Applications.<\/li>\n\n\n\n<li class=\"\"><strong>Server:<\/strong> BioAffix Application Server, <a href=\"https:\/\/bioaffix.com\/software\/bioaffix-oneserver\/\" target=\"_blank\" rel=\"noopener\">BioAffix OneServer<\/a>.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Problem Definition: Scenarios Where Standard TLS Alone is Insufficient<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Client-Side TLS Debugging<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Applications that use TLS at the operating system level can be inspected via <strong>man-in-the-middle (MITM)<\/strong> attacks using tools like <strong>Fiddler \/ HTTPS Analyzer<\/strong> or by injecting a corporate root certificate. In such cases, data packets can be viewed or <strong>replayed<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>TLS Offload \/ Inspection at the Load Balancer<\/strong> In high-traffic architectures, SSL\/TLS may be terminated at the Load Balancer, its content inspected at L7, and then re-encrypted within the data center, often with a weaker or corporate CA. Malicious or over-privileged personnel can inspect incoming and outgoing data (Port mirroring \u2013 package mirroring).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These two situations compromise confidentiality. Especially if the &#8220;trusted certificate store&#8221; is managed by the device\/OS, content can be read by accessing or installing an internal CA certificate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Mul-Sec Design Principles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\"><strong>Application-level confidentiality:<\/strong> Application data remains confidential within a second tunnel even if the outer TLS is decrypted.<\/li>\n\n\n\n<li class=\"\"><strong>Compile-time root of trust:<\/strong> The inner tunnel&#8217;s trust is established through the application&#8217;s signature and the Mul-Sec embedded root key; it is independent of the operating system&#8217;s root store.<\/li>\n\n\n\n<li class=\"\"><strong>Per-session keys:<\/strong> The generation of short-lived certificates\/keys for each connection makes reuse and replay attacks more difficult.<\/li>\n\n\n\n<li class=\"\"><strong>Transparent topology compliance:<\/strong> Content remains opaque even in the presence of Load Balancer offload, reverse proxies, etc.<\/li>\n\n\n\n<li class=\"\"><strong>Root of Trust (Root CA):<\/strong> Embedded within the software.<\/li>\n\n\n\n<li class=\"\"><strong>Application Signature:<\/strong> It verifies the application signature; the inner tunnel is not established if it does not match the expected signature.<\/li>\n\n\n\n<li class=\"\"><strong>Session Certificates:<\/strong> Single-use client and\/or server certificates are created for each connection.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security Features and Threat Mitigations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\"><strong>Independence from the OS root store:<\/strong> The inner tunnel is established by trusting only the software-embedded root of trust; it remains ineffective even if a corporate CA is injected.<\/li>\n\n\n\n<li class=\"\"><strong>Dual-layer encryption:<\/strong> Even if the outer TLS is decrypted, the application data remains encrypted in the second layer.<\/li>\n\n\n\n<li class=\"\"><strong>Per-session key\/certificate:<\/strong> The impact of a replay attack or key leakage is limited to a single connection.<\/li>\n\n\n\n<li class=\"\"><strong>Compile-time signature verification:<\/strong> Only the expected application binary can open an inner tunnel; re-packaged or patched clients are blocked.<\/li>\n\n\n\n<li class=\"\"><strong>Load Balancer:<\/strong> The content of the inner tunnel is not visible even if L7 inspection is active; only an encrypted byte stream is transported.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Note: Mul-Sec does not store traffic metadata (source IP, time, byte count, etc.) at the network endpoints; confidentiality lies within the application payload.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Policy Compliance<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\"><strong>KVKK\/GDPR:<\/strong> Reduces the risk of data leakage during transmission with an additional encryption layer.<\/li>\n\n\n\n<li class=\"\"><strong>ISO\/IEC 27001 (A.8 Cryptography, A.5 Access Controls):<\/strong> Facilitates compliance with policy and technical control requirements.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Limitations<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">Dual-layer encryption introduces a measurable overhead on CPU and latency. Typical impacts vary depending on packet size, handshake frequency, and hardware acceleration.<\/li>\n\n\n\n<li class=\"\">Inner tunnel traffic cannot be inspected by L7 devices.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions (FAQ)<\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>We already use mTLS, what is the difference?<\/summary>\n<p class=\"wp-block-paragraph\">Mul-Sec includes mTLS but establishes it as an additional tunnel embedded within the outer TLS, making the trust independent of the operating system&#8217;s root store. Therefore, even if TLS\/mTLS is offloaded at the LB, the application data in Mul-Sec&#8217;s inner tunnel remains opaque.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>We terminate TLS at our Load Balancer, is that a problem?<\/summary>\n<p class=\"wp-block-paragraph\">No. The application payload is not visible at the Load Balancer because the inner tunnel remains encrypted.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What happens if a key is leaked?<\/summary>\n<p class=\"wp-block-paragraph\">Session keys are short-lived; the impact of a leak is limited to a single connection.<\/p>\n<\/details>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#eaecec\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-8b198194b28a8ce3fdc76f5b9e4096d9\" style=\"color:#ca171e\"><strong>Subscribe to the BioAffix Newsletter<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can stay informed about the latest developments by subscribing to the BioAffix e-newsletter, published quarterly.<\/p>\n\n\n<noscript class=\"ninja-forms-noscript-message\">\n\tNotice: JavaScript is required for this content.<\/noscript>\n<div id=\"nf-form-3-cont\" class=\"nf-form-cont\" aria-live=\"polite\" aria-labelledby=\"nf-form-title-3\" aria-describedby=\"nf-form-errors-3\" role=\"form\">\n\n    <div class=\"nf-loading-spinner\"><\/div>\n\n<\/div>\n        <!-- That data is being printed as a workaround to page builders reordering the order of the scripts loaded-->\n        <script>var formDisplay=1;var nfForms=nfForms||[];var form=[];form.id='3';form.settings={\"objectType\":\"Form Setting\",\"editActive\":true,\"title\":\"BioAffix Subscription\",\"default_label_pos\":\"above\",\"show_title\":\"0\",\"clear_complete\":\"1\",\"hide_complete\":\"1\",\"logged_in\":\"\",\"wrapper_class\":\"\",\"element_class\":\"\",\"form_title_heading_level\":\"3\",\"key\":\"\",\"add_submit\":\"0\",\"currency\":\"\",\"unique_field_error\":\"A form with this value has already been submitted.\",\"not_logged_in_msg\":\"\",\"sub_limit_msg\":\"The form has reached its submission limit.\",\"calculations\":[],\"formContentData\":[\"e-posta_1716481306319\",\"abone_ol_1716481278510\"],\"changeEmailErrorMsg\":\"Please enter a valid email address\",\"changeDateErrorMsg\":\"Please enter a valid date!\",\"confirmFieldErrorMsg\":\"These fields must match!\",\"fieldNumberNumMinError\":\"Number Min Error\",\"fieldNumberNumMaxError\":\"Number Max Error\",\"fieldNumberIncrementBy\":\"Please increment by \",\"formErrorsCorrectErrors\":\"Please correct the error(s) below before submitting\",\"validateRequiredField\":\"This field is required\",\"honeypotHoneypotError\":\"Honeypot Error\",\"fieldsMarkedRequired\":\"Required field(s)\",\"unique_field\":\"e-posta_1716481306319\",\"drawerDisabled\":false,\"objectDomain\":\"display\",\"allow_public_link\":0,\"embed_form\":\"\",\"ninjaForms\":\"Ninja Forms\",\"fieldTextareaRTEInsertLink\":\"Insert Link\",\"fieldTextareaRTEInsertMedia\":\"Insert Media\",\"fieldTextareaRTESelectAFile\":\"Select a file\",\"tableInsertRowAbove\":\"Insert Row Above\",\"tableInsertRowBelow\":\"Insert Row Below\",\"tableInsertColumnLeft\":\"Insert Column Left\",\"tableInsertColumnRight\":\"Insert Column Right\",\"tableDeleteRow\":\"Delete Row\",\"tableDeleteColumn\":\"Delete Column\",\"tableDeleteTable\":\"Delete Table\",\"tableLegacyNotice\":\"This content has tables in the old editor format. Custom styles are preserved until converted. Editing will update to the new format.\",\"tableLegacyConvert\":\"Convert Now\",\"tableInsertTable\":\"Insert Table\",\"dismiss\":\"Dismiss\",\"insertLink\":\"Insert Link\",\"formHoneypot\":\"If you are a human seeing this field, please leave it empty.\",\"fileUploadOldCodeFileUploadInProgress\":\"File Upload in Progress.\",\"fileUploadOldCodeFileUpload\":\"FILE UPLOAD\",\"currencySymbol\":\"&#36;\",\"thousands_sep\":\",\",\"decimal_point\":\".\",\"siteLocale\":\"en_US\",\"dateFormat\":\"m\\\/d\\\/Y\",\"startOfWeek\":\"1\",\"of\":\"of\",\"previousMonth\":\"Previous Month\",\"nextMonth\":\"Next Month\",\"months\":[\"January\",\"February\",\"March\",\"April\",\"May\",\"June\",\"July\",\"August\",\"September\",\"October\",\"November\",\"December\"],\"monthsShort\":[\"Jan\",\"Feb\",\"Mar\",\"Apr\",\"May\",\"Jun\",\"Jul\",\"Aug\",\"Sep\",\"Oct\",\"Nov\",\"Dec\"],\"weekdays\":[\"Sunday\",\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\"],\"weekdaysShort\":[\"Sun\",\"Mon\",\"Tue\",\"Wed\",\"Thu\",\"Fri\",\"Sat\"],\"weekdaysMin\":[\"Su\",\"Mo\",\"Tu\",\"We\",\"Th\",\"Fr\",\"Sa\"],\"recaptchaConsentMissing\":\"reCaptcha validation couldn&#039;t load.\",\"recaptchaMissingCookie\":\"reCaptcha v3 validation couldn&#039;t load the cookie needed to submit the form.\",\"recaptchaConsentEvent\":\"Accept reCaptcha cookies before sending the form.\",\"currency_symbol\":\"\",\"beforeForm\":\"\",\"beforeFields\":\"\",\"afterFields\":\"\",\"afterForm\":\"\"};form.fields=[{\"objectType\":\"Field\",\"objectDomain\":\"fields\",\"editActive\":false,\"order\":1,\"idAttribute\":\"id\",\"label\":\"E-Mail\",\"type\":\"email\",\"key\":\"e-posta_1716481306319\",\"label_pos\":\"above\",\"required\":1,\"default\":\"\",\"placeholder\":\"\",\"container_class\":\"\",\"element_class\":\"\",\"admin_label\":\"\",\"help_text\":\"<p><br><\\\/p>\",\"custom_name_attribute\":\"email\",\"personally_identifiable\":1,\"value\":\"\",\"drawerDisabled\":false,\"manual_key\":1,\"desc_text\":\"<p><br><\\\/p>\",\"disable_browser_autocomplete\":0,\"field_label\":\"E-Posta\",\"field_key\":\"e-posta_1716481306319\",\"id\":7,\"beforeField\":\"\",\"afterField\":\"\",\"parentType\":\"email\",\"element_templates\":[\"email\",\"input\"],\"old_classname\":\"\",\"wrap_template\":\"wrap\"},{\"objectType\":\"Field\",\"objectDomain\":\"fields\",\"editActive\":false,\"order\":2,\"idAttribute\":\"id\",\"label\":\"Subscribe\",\"type\":\"submit\",\"processing_label\":\"Completing\",\"container_class\":\"\",\"element_class\":\"\",\"key\":\"abone_ol_1716481278510\",\"drawerDisabled\":false,\"manual_key\":1,\"admin_label\":\"\",\"field_label\":\"Abone Ol\",\"field_key\":\"abone_ol_1716481278510\",\"id\":8,\"beforeField\":\"\",\"afterField\":\"\",\"value\":\"\",\"label_pos\":\"above\",\"parentType\":\"textbox\",\"element_templates\":[\"submit\",\"button\",\"input\"],\"old_classname\":\"\",\"wrap_template\":\"wrap-no-label\"}];nfForms.push(form);<\/script>\n        <\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>BioAffix Mul-Sec is an encryption protocol developed by Ones Technology and is currently in active use within the BioAffix infrastructure. It establishes an application-specific second TLS tunnel (&#8220;TLS-in-TLS&#8221;) inside the standard TLS\/SSL tunnel within the client-server communication chain. This ensures that application data remains opaque in scenarios involving OS-level TLS interception\/MITM\/debugging and TLS offload\/inspection at [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":3056,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"nf_dc_page":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[153],"tags":[157,225],"class_list":["post-3060","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software","tag-bioaffix-en","tag-mul-sec-2"],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/IMG-20251015-WA0001.webp?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts\/3060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/comments?post=3060"}],"version-history":[{"count":5,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts\/3060\/revisions"}],"predecessor-version":[{"id":3212,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts\/3060\/revisions\/3212"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/media\/3056"}],"wp:attachment":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/media?parent=3060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/categories?post=3060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/tags?post=3060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}