Proxylity has introduced DTLS Listeners to provide encrypted and authenticated transport for UDP applications while preserving the datagram nature of UDP. These Listeners support DTLS versions 1.2 and 1.3, enabling clients to establish secure sessions with assigned domains and ports. Once authenticated, Proxylity decrypts incoming data and forwards the plaintext to configured backend destinations. Responses from these applications are encrypted and sent back through the same DTLS session.

This approach is particularly useful for applications that already support DTLS or require encrypted UDP transport without switching to stream-oriented TLS. Common use cases include RADIUS authentication, Internet of Things (IoT) protocols, real-time telemetry, and custom request-response protocols that cannot leverage TCP-based TLS connections.

DTLS Listeners are also positioned as the initial transport layer for Proxylity’s upcoming WebRTC Data Channels support, although signaling and SCTP layers remain separate.

Each DTLS Listener is provisioned with a server certificate and private key managed by Proxylity, which clients use to verify the Listener’s identity. Certificate rotation is supported through CloudFormation updates, allowing secure management of trust anchors.

For clients using pre-shared keys (PSK), Proxylity allows configuration of identity-key mappings, with sensitive keys recommended to be stored securely in AWS Secrets Manager. Additionally, enabling DTLS cookie exchange helps verify client source addresses and mitigates amplification attacks, though it adds a handshake round trip.

DTLS 1.3 clients benefit from encrypted session tickets that facilitate faster session resumption with fewer handshake messages. Early data transmission (0-RTT) is supported but should be limited to idempotent operations due to replay risks. The ticket lifetime and replay protection window are configurable.

DTLS 1.2 clients supporting Connection IDs (CID) can maintain sessions despite network changes such as NAT rebinding or port changes, which is advantageous for low-power IoT devices by reducing handshake overhead.

Proxylity’s DTLS Listeners are created via CloudFormation with the Custom::ProxylityUdpGatewayListener resource, specifying DTLS as the protocol. They cannot be combined with UDP or WireGuard protocols on the same Listener.

The solution includes practical examples, such as an encrypted RADIUS authentication endpoint, demonstrating how existing backend applications can securely receive DTLS-encrypted UDP traffic without running dedicated server hosts.

OpenSSL can be used to verify DTLS 1.2 connectivity by performing a handshake and inspecting the server certificate and negotiated cipher suite, although application-level payload validation requires additional testing.

Overall, Proxylity’s DTLS Listeners offer a streamlined way to secure UDP-based applications with TLS-grade encryption and authentication, addressing a common gap in securing datagram protocols.