# US 12,225,048 B2 · Packet capture using fixed encryption key > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,048 B2 - Document ID: US12225048B2 - Status: Granted - Kind: B2 - Application number: 17/713,520 - Filed: 2022-04-05 - Published: 2023-10-05 - Granted: 2025-02-11 - Earliest claimed: 2022-04-05 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Tomas Weinfurt - Web page: https://patentgrep.com/patent/US12225048B2 ## CPC - H04L 63/166: {at the transport layer} - H04L 69/164: Adaptation or special uses of UDP protocol - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/168: {above the transport layer} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer implemented method includes receiving data from an application layer resulting in received data. The received data is diverted to an input/output layer outside a communication stack and data packets are generated from the received data. Mock packet headers are fabricated with packet formatting and address corresponding to an underlying transport layer. Corresponding mock packet headers are concatenated with the data packets to form transport packets which are encrypted using a fixed key. The transport packets are provided to a network debug tool for decryption using a public key for execution of the network debug tool to inspect the transport packets. ## Claims ### Claim 1 A computer implemented method comprising: receiving data from an application layer resulting in received data; diverting the received data via a diagnostic filter that follows a transport protocol layer of a communication stack to an input/output layer outside the communication stack; generating data packets from the received data; fabricating mock packet headers with packet formatting and address corresponding to an underlying transport layer; concatenating corresponding mock packet headers with the data packets to form transport packets; encrypting the transport packets using a fixed key; and providing the transport packets to a network debug tool for decryption using a public key for execution of the network debug tool to inspect the transport packets. ### Claim 2 (depends on 1) The method of claim 1, wherein the transport packets correspond to multiple network sessions. ### Claim 3 (depends on 1) The method of claim 1, further comprising: filtering the received data prior to diverting the received data such that less than all the received data is diverted. ### Claim 4 (depends on 3) The method of claim 3, wherein filtering is performed to divert only received data addressed to a selected uniform resource locator (URL) or transaction. ### Claim 5 (depends on 1) The method of claim 1, wherein a mock packet header of the mock packet headers comprises a QUIC header. ### Claim 6 (depends on 1) The method of claim 1, wherein the fixed key comprises a 1-RTT (round trip time) key. ### Claim 7 (depends on 1) The method of claim 1, wherein the fixed key comprises a public key. ### Claim 8 (depends on 1) The method of claim 1, wherein the mock header is a network transport layer header. ### Claim 9 (depends on 8) The method of claim 8, wherein the encryption using a fixed key comprises a transport layer security (TLS) encryption. ### Claim 10 A machine-readable storage device having instructions for execution by a processor of a machine to cause the processor to perform operations to perform a method, the operations comprising: receiving data from an application layer resulting in received data; diverting the received data via a diagnostic filter that follows a transport protocol layer of a communication stack to an input/output layer outside the communication stack; generating data packets from the received data; fabricating mock packet headers with packet formatting and address corresponding to an underlying transport layer; concatenating corresponding mock packet headers with the data packets to form transport packets; encrypting the transport packets using a fixed key; and providing the transport packets to a network debug tool for decryption using a public key for execution of the network debug tool to inspect the transport packets. ### Claim 11 (depends on 10) The device of claim 10, wherein the transport packets correspond to multiple network sessions. ### Claim 12 (depends on 10) The device of claim 10, and further comprising filtering the received data prior to diverting the received data such that less than all the received data is diverted, wherein filtering is performed to divert only received data addressed to a selected uniform resource locator (URL) or transaction. ### Claim 13 (depends on 10) The device of claim 10, wherein a mock packet header of the mock packet headers comprises a QUIC header. ### Claim 14 (depends on 10) The device of claim 10, wherein the fixed key comprises a 1-RTT (round trip time) key. ### Claim 15 (depends on 10) The device of claim 10, wherein the fixed key comprises a public key. ### Claim 16 (depends on 10) The device of claim 10, wherein the mock header is a network transport layer header. ### Claim 17 (depends on 16) The device of claim 16, wherein the encryption using a fixed key comprises a transport layer security (TLS) encryption. ### Claim 18 A device comprising: a processor; and a memory device coupled to the processor and having a program stored thereon for execution by the processor to perform operations comprising: receiving data from an application layer resulting in received data; diverting the received data via a diagnostic filter that follows a transport protocol layer of a communication stack to an input/output layer outside the communication stack; generating data packets from the received data; fabricating mock packet headers with packet formatting and address corresponding to an underlying transport layer; concatenating corresponding mock packet headers with the data packets to form transport packets; encrypting the transport packets using a fixed key; and providing the transport packets to a network debug tool for decryption using a public key for execution of the network debug tool to inspect the transport packets. ### Claim 19 (depends on 18) The device of claim 18, wherein the transport packets correspond to multiple network sessions. ### Claim 20 (depends on 19) The device of claim 19, further comprising: filtering the received data prior to diverting the received data such that less than all the received data is diverted, wherein filtering is performed to divert only received data addressed to a selected uniform resource locator (URL) or transaction.