Transparent inspection of traffic encrypted with perfect forward secrecy (PFS)

A system for inspecting network traffic, the system comprising:

• a memory configured to store instructions;
• at least one processor in a single contained device, disposed in communication with said memory, wherein instructions upon execution by the at least one processor cause the at least one processor to:
• receive network traffic inbound from an external host that is external to a protected network, the network traffic flowing to a protected host of the protected network and being transported by a secure protocol that implements ephemeral keys that endure for a limited time;
• perform a first transmission control protocol (TCP) handshake with the external host;
• obtain source and destination data during the first TCP handshake, the source and destination data including source and destination link and internet addresses obtained;
• cache the source and destination data;
• and
• use the source and destination data that was cached to obtain a Layer-7 request from the external host to the protected host and to pass a Layer-7 response from the protected host to the external host.

A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

• receive network traffic inbound from an external host that is external to a protected network, the network traffic flowing to a protected host of the protected network and being transported by a secure protocol that implements ephemeral keys that endure for a limited time;
• perform a first transmission control protocol (TCP) handshake with the external host;
• obtain source and destination data during the first TCP handshake, the source and destination data including source and destination link and internet addresses obtained;
• cache the source and destination data;
• and
• use the source and destination data that was cached to obtain a Layer-7 request from the external host to the protected host and to pass a Layer-7 response from the protected host to the external host.