Decrypting transport layer security traffic without man-in-the-middle proxy

A non-transitory computer readable medium comprising instructions stored thereon, that when executed by one or more processors cause the one or more processors to:

• detect, at a sensor device, a client initiated hello message sent from a client device to a server device;
• copy first information from the client initiated hello message to, in part, track a session initiation handshake, wherein the client initiated hello message is a first message of the handshake;
• send the client initiated hello message to the server device;
• detect, at the sensor device, a response to the client initiated hello message in a server hello message sent from the server device to the client device;
• copy second information from the server hello message to, in part, track the session initiation handshake;
• detect, at the sensor device, a negotiation of encryption key information for the session;
• store third information from the negotiation;
• detect, at the sensor device, encrypted data message information sent from the client device to the server device as part of the session;
• and
• use the first, second, and third information to analyze the encrypted data message information.

A sensor device comprising:

• one or more processing units;
• a memory communicatively coupled to the one or more processing units;
• a network interface communicatively coupled to the memory and the one or more processing units;
• and
• a secondary communication interface communicatively coupled to the memory and the one or more processing units, wherein the memory stores instructions that when executed by the one or more processing units cause the one or more processing units to:
• detect, at the sensor device, a client initiated hello message from a client device to a server device, the client initiated hello message sent over a network accessible by the network interface;
• copy first information from the client initiated hello message to, in part, track a session initiation handshake, wherein the client initiated hello message is a first message of the handshake;
• send the client initiated hello message, via the network interface, to the server device;
• detect, at the sensor device, a response to the client initiated hello message in a server hello message sent from the server device to the client device;
• copy second information from the server hello message to, in part, track the session initiation handshake;
• detect, at the sensor device, a negotiation of encryption key information for the session;
• store third information from the negotiation;
• detect, at the sensor device, encrypted data message information sent from the client device to the server device as part of the session;
• and
• use the first, second, and third information to analyze, using the one or more processing units, the encrypted data message information.