# US 12,192,248 B2 · Decryption of perfect forward secrecy (PFS) and non-PFS sessions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,248 B2 - Document ID: US12192248B2 - Status: Granted - Kind: B2 - Application number: 17/523,851 - Filed: 2021-11-10 - Published: 2023-05-11 - Granted: 2025-01-07 - Earliest claimed: 2021-11-10 - Assignees: Arbor Networks, Inc. - Applicants: Arbor Networks, Inc. - Inventors: Sean O'Hara; Archana Adiyamankottai Rajaram - Web page: https://patentgrep.com/patent/US12192248B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/0272: {Virtual private networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method and a computer system are provided for selecting active or passive decryption mode when observing network traffic between a downstream client and an upstream server. The method includes selecting a decryption mode in an initial stage of setting up a secure session based on a determination of a most probable decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when the client initiates a transport layer connection before the transport layer connection or the secure session is established. The method further includes validating the selected decryption mode at least once during the secure session based on whether the selected decryption mode is actually and/or is probably supported based on security algorithms supported by the client and/or server, and switching the decryption mode based on a result of validating the selected decryption mode. ## Claims ### Claim 1 A computer-implemented method of selecting active or passive decryption mode when observing network traffic between a downstream client and an upstream server, the method comprising: selecting a first decryption mode in an initial stage of setting up a secure session based on a determination of a decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when the client initiates a transport layer connection; when the first decryption mode is active, before switching from the first decryption mode, determining whether an impact of changing the first decryption mode to a second decryption mode would satisfy an impact criterion by: predicting a retry time to reset the transport layer connection for both downstream and upstream channels of the secure session and for the client to reconnect to the secure session with the second decryption mode; predicting an active session time of the secure session without resetting the transport layer connection or switching from the first decryption mode, wherein the impact criterion is satisfied when a predicted passive session time, including the retry time, is less than the predicted active session time; and responsive to determining the impact criterion is satisfied, switching the first decryption mode to the second decryption mode. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein determining whether an impact of changing the first decryption mode to the second decryption mode would satisfy an impact criterion is performed after the server establishes the secure session and communicates which security algorithms it can support for the secure session. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the predicted retry time for the downstream channel is based on a measured round trip time of the client and a comparison of a statistical function of actual round trip times for the client. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the second decryption mode is not evaluated again after the switch from the first decryption mode to the second decryption mode. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the similar secure sessions can include multiple series of secure sessions, each series of secure sessions defined by different session characteristics. ### Claim 6 A network monitor for observing network traffic and selecting active or passive decryption mode between a downstream client and an upstream server, the network monitor comprising: a memory configured to store a plurality of programmable instructions; and at least one processing device in communication with the memory, wherein the at least one processing device, upon execution of the plurality of programmable instructions is configured to: select a first decryption mode in an initial stage of setting up a secure session based on a determination of a decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when the client initiates a transport layer connection; when the first decryption mode is active, before switching from the first decryption mode, determine whether an impact of changing the first decryption mode to a second decryption model would satisfy an impact criterion by: predicting a retry time to reset the transport layer connection for both downstream and upstream channels of the secure session and for the client to reconnect to the secure session with the second decryption mode; predicting an active session time of the secure session without resetting the transport layer connection or switching from the first decryption mode, wherein the impact criterion is satisfied when a predicted passive session time, including the retry time, is less than the predicted active session time; and responsive to determining the impact criterion is satisfied, switch the first decryption mode to the second decryption mode. ### Claim 7 (depends on 6) The network monitor of claim 6, wherein determining whether an impact of changing the first decryption mode to the second decryption mode would satisfy an impact criterion is performed after the server establishes the secure session and communicates which security algorithms it can support for the secure session. ### Claim 8 (depends on 6) The network monitor of claim 6, wherein the predicted retry time for the downstream channel is based on a measured round trip time of the client and a comparison of a statistical function of actual round trip times for the client. ### Claim 9 (depends on 6) The network monitor of claim 6, wherein the second decryption mode is not evaluated again after the switch from the first decryption mode to the second decryption mode. ### Claim 10 (depends on 6) The network monitor of claim 6, wherein the similar secure sessions can include multiple series of secure sessions, each series of secure sessions defined by different session characteristics. ### Claim 11 A non-transitory computer readable storage medium and one or more computer programs stored therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to: select a first decryption mode in an initial stage of setting up a secure session based on a determination of a decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when a client initiates a transport layer connection; when the first decryption mode is active, before switching from the first decryption mode, determine whether an impact of changing the first decryption mode to a second decryption mode would satisfy an impact criterion by: predicting a retry time to reset the transport layer connection for both downstream and upstream channels of the secure session and for the client to reconnect to the secure session with the second decryption mode; predicting an active session time of the secure session without resetting the transport layer connection or switching from the first decryption mode, wherein the impact criterion is satisfied when a predicted passive session time, including the retry time, is less than the predicted active session time; and responsive to determining the impact criterion is satisfied, switch the decryption mode.