Apparatus and method for decryption of secure communication sessions
AssigneeSymantec Corporation
InventorsJoseph H. Levy, David Wells, Paul Kraus
Life of this patent
Estimating the term…
Abstract
An apparatus includes a processor and a memory storing instructions executed by the processor to receive a first communication session using a first key, where the first communication session is between a client and a server. A second communication session is initiated using a second key, where the second communication session is between the apparatus and the server. An active communication session is negotiated between the client and the server using the first key and the second key. The active communication session is decrypted using the first key and the second key. The active communication session is re-encrypted using a third key to form re-encrypted data.
Claims15
An apparatus, comprising:
- a processor;
- and
- a memory storing instructions that, when executed by the processor, are configured to:
- receive, over a network, a first communication session using a first key, wherein the first communication session is between a client and a server,
- initiate a second communication session using a second key, wherein the second communication session is between the apparatus and the server,
- negotiate an active communication session between the client and the server using the first key and the second key,
- decrypt the active communication session using the first key and the second key,
- re-encrypt the active communication session using a third key to form re-encrypted data,
- route the re-encrypted data to a security appliance external to the network, wherein the security appliance is configured to store the re-encrypted data, and
- route the third key to the security appliance along with multiple-party authorization authentication credentials.
A method, comprising:
- receiving, at a machine, a first communication session using a first key, wherein the first communication session is between a client and a server over a network,
- initiating, at the machine, a second communication session using a second key, wherein the second communication session is between the machine and the server,
- negotiating, via the machine, an active communication session between the client and the server using the first key and the second key,
- decrypting, at the machine, the active communication session using the first key and the second key,
- re-encrypting, at the machine, the active communication session using a third key to form re-encrypted data,
- routing, via the machine, the re-encrypted data to a security appliance external to the network, wherein the security appliance is configured to store the re-encrypted data, and
- routing, via the machine, the third key to the security appliance along with multiple-factor authentication credentials.
One or more computer-readable non-transitory storage media storing instructions thereon that, when executed by one or more processors, are configured to:
- receive, at an apparatus over a network, a first communication session using a first key, wherein the first communication session is between a client and a server;
- initiate a second communication session using a second key, wherein the second communication session is between the apparatus and the server;
- negotiate an active communication session between the client and the server using the first key and the second key;
- decrypt the active communication session using the first key and the second key;
- re-encrypt the active communication session using a third key to form re-encrypted data;
- route the re-encrypted data to a security appliance external to the network, wherein the security appliance is configured to store the re-encrypted data;
- and
- route the third key to the security appliance along with role-based access control authentication credentials.
Dependencies are inferred from the claim text.