Back to results
US 10,375,112 B2Granted
Method and apparatus for decryption of encrypted SSL data from packet traces
AssigneeAT&T Intellectual Property I, L.P.
InventorsFeng Qian, Oliver Spatscheck, Subhabrata Sen
Life of this patent
Estimating the term…
Abstract
A system for decrypts encrypted Secure Sockets Layer (SSL) data from packet traces without using private keys or a proxy. Decryption of encrypted SSL data is accomplished by intercepting a session key associated with a communication session transmitted from a user device to a server during handshaking between the user device and the server. The session key is then used to decrypt packet level traces of the communication session. The decrypted packet level traces are then used to measure traffic.
Claims20
A method comprising:
- obtaining, by executing an instruction with a processor of a client during handshaking, session keys associated with respective ones of a plurality of communication sessions between the client and a server, the session keys obtained from information logged by a library, the library instrumented to output pairs of pre-master secret and master secret values corresponding to respective ones of the session keys for the respective ones of the communication sessions between the client and the server, a first session key to be generated based on a first master secret value included in a first one of the pairs of pre-master secret and master secret values corresponding to a first one of the communication sessions, the first session key being different from a second session key corresponding to a second one of the pairs of pre-master secret and master secret values corresponding to a second one of the plurality of communication sessions;
- identifying, by executing an instruction with the processor of the client, packet level traces of the first one of the communication sessions, the packet level traces including encrypted data associated with the first one of the communication sessions and generated data strings that were exchanged previously during the handshaking between the client and the server to compute the first master secret value associated with the first session key;
- evaluating, by executing an instruction with the processor of the client, a function with the generated data strings included in the packet level traces to identify the first master secret value and to determine the first session key corresponding to the first one of the communication sessions, the obtaining of the session keys, the identifying of the packet level traces and the evaluating of the function being performed by the client without use of a proxy server;
- decrypting, by executing an instruction with the processor of the client, the packet level traces using the first session key to generate decrypted packet level traces;
- and
- measuring traffic using the decrypted packet level traces.
3 more elements
A client device comprising:
- a processor;
- and
- memory including computer program instructions, the computer program instructions, when executed on the processor, to cause the processor to perform operations including:
- obtaining, during handshaking, session keys associated with respective ones of a plurality of communication sessions between the client device and a server, the session keys obtained from information logged by a library, the library instrumented to output pairs of pre-master secret and master secret values corresponding to respective ones of the session keys for the respective ones of the communication sessions between the client device and the server, a first session key to be generated based on a first master secret value included in a first one of the pairs of pre-master secret and master secret values corresponding to a first one of the communication sessions, the first session key being different from a second session key corresponding to a second one of the pairs of pre-master secret and master secret values corresponding to a second one of the plurality of communication sessions;
- identifying packet level traces of the first one of the communication sessions, the packet level traces including encrypted data associated with the first one of the communication sessions and generated data strings that were exchanged previously during the handshaking between the client device and the server to compute the first master secret value associated with the first session key;
- evaluating a function with the generated data strings included in the packet level traces to identify the first master secret value and to determine the first session key corresponding to the first one of the communication sessions, the obtaining of the session keys, the identifying of the packet level traces and the evaluating of the function being performed by the client device without use of a proxy server;
- decrypting the packet level traces using the first session key to generate decrypted packet level traces;
- and
- measuring traffic using the decrypted packet level traces.
6 more elements
A computer readable storage device comprising computer program instructions, which, when executed by a processor of a client, cause the processor to perform operations including:
- obtaining, during handshaking, session keys associated with respective ones of a plurality of communication sessions between the client and a server, the session keys obtained from information logged by a library, the library instrumented to output pairs of pre-master secret and master secret values corresponding to respective ones of the session keys for the respective ones of the communication sessions between the client and the server, a first session key to be generated based on a first master secret value included in a first one of the pairs of pre-master secret and master secret values corresponding to a first one of the communication sessions, the first session key being different from a second session key corresponding to a second one of the pairs of pre-master secret and master secret values corresponding to a second one of the plurality of communication sessions;
- identifying packet level traces of the first one of the communication sessions, the packet level traces including encrypted data associated with the first one of the communication sessions and generated data strings that were exchanged previously during the handshaking between the client and the server to compute the first master secret value associated with the first session key;
- evaluating a function with the generated data strings included in the packet level traces to identify the first master secret value and to determine the first session key corresponding to the first one of the communication sessions, the obtaining of the session keys, the identifying of the packet level traces and the evaluating of the function being performed by the client without use of a proxy server;
- decrypting the packet level traces using the first session key to generate decrypted packet level traces;
- and
- measuring traffic using the decrypted packet level traces.
3 more elements
Dependencies are inferred from the claim text.