Granular offloading of a proxied secure session
AssigneeJuniper Networks, Inc.
InventorsKhandi Sudhakar Reddy, Rajeev Chaubey
Life of this patent
Estimating the term…
Abstract
A device may receive encrypted traffic associated with a secure session. The device may determine, based on the encrypted traffic, information associated with an offload service to be applied to the encrypted traffic associated with the secure session. The information associated with the offload service may indicate whether the encrypted traffic is permitted to bypass inspection by one or more security services. The device may selectively permit the encrypted traffic, associated with the secure session, to bypass inspection by the one or more security services based on the information associated with the offload service.
Claims21
1-20. (canceled)
A method comprising:
- determining, by a device, that no security service, of one or more security services, is to inspect all traffic of a session;
- determining, by the device and based on determining that no security services is to inspect all traffic of the session, that a security service, of the one or more security services, is to inspect traffic in a client-to-server (C2S) direction;
- determining, by the device and based on determining that the security service is to inspect traffic in the C2S direction, that an offload service includes inspecting traffic traveling in the C2S direction;
- identifying, by the device, the offload service based on determining that the offload service includes inspecting the traffic traveling in the C2S direction;
- and
- applying, by the device, the offload service based on identifying the offload service.
A system, comprising:
- one or more memories;
- and
- one or more processors communicatively coupled to the one or more memories, configured to:
- determine that no security service, of one or more security services, is to inspect all traffic of a session;
- determine, based on determining that no security services is to inspect all traffic of the session, that a security service, of the one or more security services, is to inspect traffic in a client-to-server (C2S) direction;
- determine, based on determining that the security service is to inspect traffic in the C2S direction, that an offload service includes inspecting traffic traveling in the C2S direction;
- identify the offload service based on determining that the offload service includes inspecting the traffic traveling in the C2S direction;
- and
- apply the offload service based on identifying the offload service.
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions that, when executed by one or more processors, cause the one or more processors to:
- determine that no security service, of one or more security services, is to inspect all traffic of a session;
- determine, based on determining that no security services is to inspect all traffic of the session, that a security service, of the one or more security services, is to inspect traffic in a client-to-server (C2S) direction;
- determine, based on determining that the security service is to inspect traffic in the C2S direction, that an offload service includes inspecting traffic traveling in the C2S direction;
- identify the offload service based on determining that the offload service includes inspecting the traffic traveling in the C2S direction;
- and
- apply the offload service based on identifying the offload service.
Dependencies are inferred from the claim text.