Back to results
US 8,898,451 B2Granted
Method and system for monitoring encrypted data transmissions
AssigneeTrend Micro Incorporated
InventorsDale Sabo, Gerrard Eric Rosenquist
Life of this patent
Estimating the term…
Abstract
A method for efficiently decrypting asymmetric SSL pre-master keys is divided into a key agent component that runs in user mode, and an SSL driver running in kernel mode. The key agent can take advantage of multiple threads for decoding keys in a multi-processor environment, while the SSL driver handles the task of symmetric decryption of the SSL encrypted data stream. The method is of advantage in applications such as firewalls with deep packet inspection in which all encrypted data traffic passing through the firewall must be decrypted for inspection.
Claims23
A method for concurrently decrypting Secure Socket Layer (SSL) pre-master keys of one or more SSL sessions, comprising:
- in a computer having a processor, and a user mode and a kernel mode comprising computer readable instructions stored in a computer readable storage medium for execution by the processor, for performing the following:
- establishing said one or more SSL sessions;
- sending asymmetric encrypted pre-master keys of each respective SSL session from a driver running in the kernel mode to a key agent running in the user mode, comprising reading a decryption request record from a decryption request queue in the driver and placing the decryption request record in an agent request queue in the key agent;
- decrypting the asymmetric encrypted pre-master keys in multiple key decryption threads in the key agent into corresponding decrypted pre-master keys;
- and
- returning the decrypted pre-master keys from the key agent to the driver.
3 more elements
A method of inspecting an encrypted packet, comprising:
- in a computer having a processor, and a user mode and a kernel mode comprising computer readable instructions stored in a computer readable storage medium for execution by the processor, for performing the following:
- (1) establishing a Secure Socket Layer (SSL) session;
- (2) decrypting a pre-master key for the SSL session, comprising:
- (a) sending an asymmetric encrypted pre-master key from a driver running in the kernel mode to a key agent running in the user mode, comprising reading a decryption request record from a decryption request queue in the driver and placing the decryption request record in an agent request queue in the key agent;
- (b) decrypting the pre-master key in one of a plurality of key decryption threads of the key agent;
- and
- (c) returning the decrypted pre-master key to the driver;
- in the driver running in the kernel mode:
- (3) generating a master key from the decrypted pre-master key;
- (4) decrypting the packet using the master key to obtain a decrypted packet;
- and
- (5) inspecting content of the decrypted packet.
9 more elements
A method of simultaneously initiating first and second Secure Socket Layer (SSL) sessions using a handshake protocol, comprising:
- in a computer having a processor, and a user mode and a kernel mode comprising computer readable instructions stored in a computer readable storage medium for execution by the processor, for performing the following:
- in a driver running in the kernel mode, receiving first and second SSL ClientKeyExchange messages of the handshake protocol including first and second encrypted pre-master keys;
- in the driver, enqueuing said encrypted pre-master keys in a decryption request queue;
- in a key agent running in the user mode, acquiring said encrypted pre-master keys through a virtual SSL device interface from the driver;
- in the key agent running in the user mode, enqueing the first and second encrypted pre-master keys in an agent request queue;
- in the key agent, selecting first and second key decryption threads;
- in respective key decryption threads, decrypting said encrypted pre-master keys into first and second decrypted pre-master keys;
- and
- sending the decrypted pre-master keys to the driver for completing the initiating of the corresponding SSL sessions.
6 more elements
A system for concurrently decrypting Secure Socket Layer (SSL) pre-master keys of one or more SSL sessions, the system comprising:
- a computer having a processor, and a memory storing computer readable instructions for execution by the processor, forming a user mode and a kernel mode;
- the kernel mode comprising a driver for sending an asymmetric encrypted pre-master keys of each respective SSL session;
- and
- the user mode comprising:
- a key agent for receiving and decrypting the asymmetric encrypted pre-master keys in multiple key decryption threads into corresponding decrypted pre-master keys;
- the key agent being configured to return the decrypted pre-master keys to the driver;
- the key agent comprising an agent request queue, and a decryption request reader thread for reading for reading a decryption request record and placing the decryption request record in the agent request queue.
4 more elements
A system for inspecting an encrypted packet, comprising:
- a computer device having a processor, and a memory having computer readable instructions stored thereon for execution by the processor, forming a user mode and a kernel mode, and causing the processor to:
- initiate an encrypted session comprising decrypting a Secure Socket Layer (SSL) pre-master key in a threaded computing environment, comprising:
- a driver running in the kernel mode;
- a key agent running in the user mode;
- and
- the driver being configured to send an asymmetric encrypted pre-master key to the key agent;
- one or more key decryption threads in the key agent for decrypting the pre-master key in one of a plurality of key decryption threads of the key agent into a decrypted pre-master key;
- and
- a passive SSL engine in the driver for receiving the decrypted pre-master key from the key agent;
- the passive SSL engine further being configured to:
- generate a master key from the decrypted pre-master key;
- decrypt the packet using the master key to obtain a decrypted packet;
- and
- inspect content of the decrypted packet.
11 more elements
A system for simultaneously initiating first and second Secure Socket Layer (SSL) sessions using a handshake protocol, the system comprising:
- a computer device having a processor, and a memory having computer readable instructions stored thereon for execution by the processor, causing the processor to form a user mode and a kernel mode;
- the kernel mode comprising a driver for receiving first and second SSL ClientKeyExchange messages of the handshake protocol, respectively comprising a first and second encrypted pre-master keys, the driver including a decryption request queue for enqueuing said encrypted pre-master keys;
- and
- the user mode comprising a key agent, the key agent comprising:
- a decryption request reader thread for acquiring said encrypted pre-master keys through a virtual SSL device interface from the driver;
- an agent request queue for enqueing said first and second encrypted pre-master keys in an agent request queue;
- and
- a plurality of key decryption threads, including selected first and second key decryption threads, for decrypting the first and second encrypted pre-master keys into respective first and second decrypted pre-master keys, and sending the decrypted pre-master keys to the driver for completing the initiating of the corresponding SSL sessions.
5 more elements
Dependencies are inferred from the claim text.