Application-level service access to encrypted data streams

A non-transitory computer-readable storage medium storing one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

• establishing a secure connection from an intermediate node to a key server;
• receiving session identification data for an encrypted session, between a client and a content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data;
• based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server;
• in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over the secure connection, a decryption key associated with the encrypted session;
• receiving an encrypted message communicated between the client and the content server in the encrypted session;
• forwarding the encrypted message without modification to the client or the content server according to a destination address in the encrypted message;
• decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit.

A computer-implemented method, comprising:

• establishing a secure connection from an intermediate node to a key server;
• receiving session identification data for an encrypted session between a client and a content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data;
• based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server;
• in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over a secure connection, a decryption key associated with the encrypted session;
• receiving an encrypted message communicated between the client and the content server in the encrypted session;
• decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit;
• wherein the method is performed by one or more computing devices.