Proxy-less secure sockets layer (SSL) data inspection

A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for inspecting data sent over a computer network, the method comprising:

• establishing a secure connection between a client device and a responder device via a gateway;
• intercepting a plurality of data packets sent between the responder device and the client device via the secure connection;
• maintaining packet state information relating to the intercepted data packets at the gateway, wherein a first set of state information pertains to a first set of the intercepted packets from communications with the responder device and a second set of state information pertains to a second set of the intercepted packets from communications with the client device;
• updating the first set of state information as each of the first set of intercepted packets are inspected and communicated to the responder device;
• transmitting a current intercepted packet from the gateway via the secured connection to the client device, wherein the client device identifies the current packet as being sent directly from the responder device;
• receiving a retransmission of the current packet from the responder device based on the responder device not receiving an acknowledgment from the client device;
• transparently passing the acknowledgement to the responder device that was received from the client device;
• updating the second set of state information is as each of the second set of intercepted packets are inspected and communicated to the client device;
• identifying that the packets from the responder device include data that is associated with a security function;
• and
• executing the security function based on the identification that the data is associated with the security function.

A gateway apparatus for inspecting data sent over a computer network, the apparatus comprising:

• a communication interface that:
• establishes a secure connection between a client device and a responder device via a gateway, and
• receives a plurality of data packets sent between the responder device and the client device via the secure connection, wherein the plurality of data packets sent between the responder device and the client device via the secure connection are intercepted;
• a memory;
• and
• a processor that executes instructions out of the memory to:
• maintain packet state information relating to the intercepted data packets at the gateway that includes a first set of state information that pertains to a first set of the intercepted packets from communications with the responder device and a second set of state information that pertains to a second set of the intercepted packets from communications with the client device,
• update the first set of state information as each of the first set of intercepted packets are inspected and communicated in relation to the responder device, wherein the communication interface further:
• transmits a current intercepted packet from the gateway via the secured connection to the client device, wherein the client device identifies the current packet as being sent directly from the responder device, and
• receives a retransmission from the responder device based on the responder device not receiving an acknowledgment from the client device;
• allow the acknowledgement received from the client device to be passed to the responder device transparently;
• update the second set of state information as each of the second set of intercepted packets are inspected and communicated to the client device,
• identify that the packets from the responder device include data that is associated with a security function, and
• execute the security function based on the identification that the data is associated with the security function.