Engagement and disengagement of transport layer security proxy services with encrypted handshaking

An apparatus comprising:

• a network interface unit configured to enable communications over a network;
• a memory;
• and
• a processor coupled to the memory and the network interface unit, and configured to:
• intercept a first initial message of a first encrypted handshaking procedure for a first secure communication session between a first device and a second device, wherein the first initial message includes at least first key exchange information for encrypting the first encrypted handshaking procedure;
• store a copy of the first initial message of the first encrypted handshaking procedure;
• send a second initial message of a second encrypted handshaking procedure to the second device for a second secure communication session between the apparatus and the second device, wherein the second initial message includes second key exchange information for encrypting the second encrypted handshaking procedure;
• and
• determine, based on the second encrypted handshaking procedure, whether to remain engaged between the first device and the second device during the first secure communication session, or to disengage such that inspection of communication traffic during the first secure communication session is not to be performed.

A non-transitory computer readable tangible storage media encoded with instructions that, when executed by a processor, cause the processor to:

• intercept a first initial message of a first encrypted handshaking procedure for a first secure communication session between a first device and a second device, wherein the first initial message includes at least first key exchange information for encrypting the first encrypted handshaking procedure;
• store a copy of the first initial message of the first encrypted handshaking procedure;
• send a second initial message of a second encrypted handshaking procedure to the second device for a second secure communication session between the apparatus and the second device, wherein the second initial message includes second key exchange information for encrypting the second encrypted handshaking procedure;
• and
• determine, based on the second encrypted handshaking procedure, whether to remain engaged between the first device and the second device during the first secure communication session, or to disengage such that inspection of communication traffic during the first secure communication session is not to be performed.