Method, system, and logic for in-band exchange of meta-information

A system for enabling in-band data exchange between a first network and a second network, the system comprising:

• at least one memory element;
• at least one processor coupled to the at least one memory element;
• and
• a data encoding module, on a first enveloping proxy, to interface with the at least one processor and further to:
• receive at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server, wherein the first enveloping proxy does not have access to a first key needed to decrypt the at least one regular SSL record;
• receive data from a network element located in the first network;
• convert the data to a format for transmission in-band by encoding the data into at least one custom SSL record;
• and
• transmit the data in-band from the first network to the second network over the SSL session by:
• interleaving ones of the at least one custom SSL record and ones of the least one regular SSL record to generate an interleaved data, the interleaved data being generating without decrypting the at least one regular SSL record, and
• transmitting the interleaved data to a second enveloping proxy located in the second network, wherein the interleaved data is transmitted via a network component that is to translate a tuple identifying the interleaved data to an alternate tuple identifying the interleaved data, and wherein the second enveloping proxy has access to a second key needed to decrypt the at least one custom SSL record and does not have access to the first key needed to decrypt the at least one regular SSL record.

One or more non-transitory tangible media for enabling in-band data exchange between a first network and a second network, the one or more non-transitory tangible media including code for execution and when executed by a processor operable to perform operations comprising:

• receiving, by a first enveloping proxy located in the first network, at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server, wherein the first enveloping proxy does not have access to a first key needed to decrypt the at least one regular SSL record;
• receiving, by the first enveloping proxy, data from a network element located in the first network;
• converting, by the first enveloping proxy, the data to a format for transmission in-band by encoding the data into at least one custom SSL record;
• and
• transmitting, by a processor in the first enveloping proxy, the data in-band from the first network to the second network over the SSL session by:
• interleaving ones of the at least one custom SSL record and ones of the least one regular SSL record to generate an interleaved data, the interleaved data being generating without decrypting the at least one regular SSL record, and
• transmitting the interleaved data to a second enveloping proxy located in the second network, wherein the interleaved data is transmitted via a network component that is to translate a tuple identifying the interleaved data to an alternate tuple identifying the interleaved data, and wherein the second enveloping proxy has access to a second key needed to decrypt the at least one custom SSL record and does not have access to the first key needed to decrypt the at least one regular SSL record.