# US 8,788,805 B2 · Application-level service access to encrypted data streams > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,805 B2 - Document ID: US8788805B2 - Status: Granted - Kind: B2 - Application number: 12/040,050 - Filed: 2008-02-29 - Published: 2009-09-03 - Granted: 2014-07-22 - Earliest claimed: 2008-02-29 - Assignees: Cisco Technology, Inc. - Applicants: Michael Herne; David McGrew - Inventors: Michael Herne; David McGrew - Web page: https://patentgrep.com/patent/US8788805B2 ## CPC - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for securely providing cryptographic keys to trusted intermediate nodes or monitoring devices are described so that SSL, TLS, or IPSec communications can be monitored, compressed over a WAN, or otherwise used. In an embodiment, a trusted intermediate node establishes a secure connection to a key server; receiving session identification data for an encrypted session between a client and a content server during negotiation of the encrypted session, and storing a copy of the session identification data; requesting from the key server, over the secure connection, a decryption key associated with the encrypted session; receiving an encrypted message communicated between the client and the content server; forwarding the encrypted message without modification to a destination address in the encrypted message; and decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit. ## Claims ### Claim 1 An apparatus, comprising: a first network interface that is configured to be coupled to a client computer through a first network; one or more second network interfaces that are configured to be coupled to a content server and to a key server through one or more second networks; wherein the first network interface and second network interface are configured to receive and forward all data communicated between the client and the content server; a processor; logic encoded in one or more non-transitory computer-readable media for operation on an intermediate node, and configured to perform: establishing a secure connection from the intermediate node to the key server; receiving session identification data for an encrypted session, between the client and the content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data; based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server; in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over the secure connection, a decryption key associated with the encrypted session; receiving an encrypted message communicated between the client and the content server in the encrypted session; decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the logic is further configured to cause the processor to perform compressing the decrypted data to result in creating compressed data; forwarding the compressed data across a wide area network to a trusted intermediate node. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the encryption protocol is Secure Sockets Layer (SSL). ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the encryption protocol is Transport Layer Security (TLS). ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the key server is co-located with the content server. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the first network and the one or more second networks each comprise different first and second local area networks respectively. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the intermediate node comprises a first trusted intermediate node configured at an edge location in a wide area network, and wherein the key server is configured in a second trusted intermediate node at a core location of the wide area network. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the second trusted intermediate node and the content server are within a single domain. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the session identification data comprises any of (a) a Secure Sockets Layer (SSL) session identifier, or (b) a source network address, a destination network address, a source port number, and a destination port number, all obtained from a transport control protocol (TCP) header of the message. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the logic configured for establishing a secure connection to the key server comprises logic configured for establishing an IPsec tunnel from the apparatus to the key server. ### Claim 11 A non-transitory computer-readable storage medium storing one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: establishing a secure connection from an intermediate node to a key server; receiving session identification data for an encrypted session, between a client and a content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data; based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server; in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over the secure connection, a decryption key associated with the encrypted session; receiving an encrypted message communicated between the client and the content server in the encrypted session; forwarding the encrypted message without modification to the client or the content server according to a destination address in the encrypted message; decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit. ### Claim 12 (depends on 11) The non-transitory computer-readable storage medium of claim 11, further comprising instructions which, when executed, cause the one or more processors to perform: compressing the decrypted data to result in creating compressed data; forwarding the compressed data across a wide area network to a trusted intermediate node. ### Claim 13 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the encryption protocol is Secure Sockets Layer (SSL). ### Claim 14 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the encryption protocol is Transport Layer Security (TSL). ### Claim 15 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the key server is co-located with the content server. ### Claim 16 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the first network and the one or more second networks each comprise different first and second local area networks. ### Claim 17 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein a first trusted intermediate node is configured at an edge location in a wide area network and wherein the key server is configured in a second trusted intermediate node at a core location of the wide area network. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the second trusted intermediate node and the content server are within a single domain. ### Claim 19 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the session identification data comprises any of (a) a Secure Sockets Layer (SSL) session identifier, or (b) a source network address, a destination address, a source port number, and a destination port number, all obtained from a transport control protocol (TCP) header of the message. ### Claim 20 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the logic configured for establishing a secure connection to the key server comprises logic configured for establishing an IPsec tunnel from the apparatus to the key server. ### Claim 21 A computer-implemented method, comprising: establishing a secure connection from an intermediate node to a key server; receiving session identification data for an encrypted session between a client and a content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data; based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server; in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over a secure connection, a decryption key associated with the encrypted session; receiving an encrypted message communicated between the client and the content server in the encrypted session; decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit; wherein the method is performed by one or more computing devices. ### Claim 22 (depends on 21) The method of claim 21, further comprising: compressing the decrypted data to result in creating compressed data; forwarding the compressed data across a wide area network to a trusted intermediate node. ### Claim 23 (depends on 21) The method of claim 21, wherein the encryption protocol is Secure Sockets Layer (SSL). ### Claim 24 (depends on 21) The method of claim 21, wherein the encryption protocol is Transport Layer Security (TLS). ### Claim 25 (depends on 21) The method of claim 21, wherein the key server is co-located with the content server. ### Claim 26 (depends on 21) The method of claim 21, wherein the first network and the one or more second networks each compromise different first and second local area networks respectively. ### Claim 27 (depends on 21) The method of claim 21, further comprising: configuring the intermediate node as a first trusted intermediate node at an edge location in a wide area network; and configuring the key server in a second trusted intermediate node at a core location of the wide area network. ### Claim 28 (depends on 27) The method of claim 27, wherein the second trusted intermediate node and the content server are within a single domain. ### Claim 29 (depends on 21) The method of claim 21, wherein the session identification data comprises any of (a) a Secure Sockets Layer (SSL) session identifier, or (b) a source network address, a destination network address, a source port number, and a destination port number, all obtained from a transport control protocol (TCP) header of the message. ### Claim 30 (depends on 21) The method of claim 21, further comprising: establishing a secure connection to the key server by establishing an IPsec tunnel from the apparatus to the key server.