Intercepting encrypted network traffic for internet usage monitoring

A tangible machine readable medium comprising machine readable instructions which, when executed, cause a machine to at least:

• intercept, using a meter comprising a kernel extension executing in an operating system kernel of a client device, a first request to be sent to a data source by a client application executing on the client device
• provide a first certificate to the client application in response to intercepting the first request sent by the client application to the data source, the first certificate being associated with the meter, the meter to monitor Internet usage associated with the client application;
• receive, at the meter from the data source, a second certificate that is associated with the data source in response to the first request being forwarded to the data source, the second certificate including second information different from first information included in the first certificate;
• obtain, at the meter, a session key to decrypt encrypted traffic exchanged between the data source and the client application, the session key being obtained from the client application after being encrypted based on the first information included in the first certificate, the session key then being sent to the data source after being encrypted based on the second information included in the second certificate;
• and
• determine Internet usage data based on using the session key to decrypt at least some of the traffic exchanged between the data source and the client application.

A metering apparatus to monitor Internet usage, the apparatus comprising:

• a request interceptor comprising a kernel extension that is to execute in an operating system kernel of a client device, the kernel extension to intercept a first request to be sent to a data source by a client application executing on the client device;
• a certificate manager implemented by a first microprocessor to:
• provide a first certificate to the client application in response to the first request being intercepted by the request interceptor, the first certificate being associated with a provider of the metering apparatus;
• and
• receive, from the data source, a second certificate that is associated with the data source in response to the request interceptor having forwarded the first request to the data source, the second certificate being including second information different from first information included in the first certificate;
• a key interceptor implemented by at least one of the first microprocessor or a second microprocessor to obtain a session key to decrypt encrypted traffic exchanged between the data source and the client application, the session key being obtained from the client application after being encrypted based on the first information included in the first certificate, the session key then being sent to the data source after being encrypted based on the second information included in the second certificate;
• and
• a usage reporter to report Internet usage data determined based on using the session key to decrypt at least some of the traffic exchanged between the data source and the client application.