US 9,961,103 B2 · Intercepting, decrypting and inspecting traffic over an encrypted channel

Abstract

A network-based appliance includes a mechanism to intercept, decrypt and inspect secure network traffic flowing over SSL/TLS between a client and a server. The mechanism responds to detection of a session initiation request message from the client, the message being received following establishment of a TCP connection between the client and server. The mechanism responds by holding the session initiation request message, preferably by creating a fake socket to a local process, and then diverting the request message over that socket. The TCP connection is then terminated, and the mechanism initiates a new session in initiation request message, all while the original session initiation request message continues to be held. The server responds with its server certificate, which is then used by the mechanism to generate a new server certificate. The new server certificate is then returned to the requesting client as the response to the session initiation request message.

Claims25

Dependent claims

A method, comprising:

responsive to detection of a session initiation request message from a client and intended for a server, holding the session initiation request message locally, the session initiation request message being received following establishment of a Transmission Control Protocol (TCP) connection between the client and the server;
while continuing to hold the session initiation request message locally, resetting the TCP connection between the client and the server, initiating a new TCP connection to the server, and sending a new session initiation request message to the server over the new TCP connection, the new session initiation request message not including the session initiation request message received from the client;
receiving, from the server, a response to the new session initiation request message, the received response including a server certificate;
using information in at least the server certificate to generate a new server certificate;
and
forwarding, to the client, a response to the session initiation request message that was being held locally, the forwarded response including the new server certificate;
wherein each operation is carried out in software executing in a hardware element.

4 more elements

Apparatus, comprising:

a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions comprising:
program code, responsive to detection of a session initiation request message from a client and intended for a server, to hold the session initiation request message locally, the session initiation request message being received following establishment of a Transmission Control Protocol (TCP) connection between the client and the server;
program code, operative while holding the session initiation request message locally, to reset the TCP connection between the client and the server, to initiate a new TCP connection to the server, and to send a new session initiation request message to the server over the new TCP connection, the new session initiation request message not including the session initiation request message received from the client;
program code operative to receive, from the server, a response to the new session initiation request message, the received response including a server certificate;
program code operative to use information in at least the server certificate to generate a new server certificate;
and
program code operative to forward, to the client, a response to the session initiation request message that was being held locally, the forwarded response including the new server certificate.

5 more elements

A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a set of operations, the computer program instructions comprising:

program code, responsive to detection of a session initiation request message from a client and intended for a server, to hold the session initiation request message locally, the session initiation request message being received following establishment of a Transmission Control Protocol (TCP) connection between the client and the server;
program code, operative while holding the session initiation request message locally, to reset the TCP connection between the client and the server, to initiate a new TCP connection to the server, and to send a new session initiation request message to the server over the new TCP connection, the new session initiation request message not including the session initiation request message received from the client;
program code operative to receive, from the server, a response to the new session initiation request message, the received response including a server certificate;
program code operative to use information in at least the server certificate to generate a new server certificate;
and
program code operative to forward, to the client, a response to the session initiation request message that was being held locally, the forwarded response including the new server certificate.

3 more elements

Apparatus, comprising:

a hardware processor;
computer memory storing an operating system kernel, the operating system kernel including software to provide outbound Secure Sockets Layer (SSL)/Transport Layer Security (TLS) processing by (i) detecting an SSL/TLS session initiation request message from a client and intended for a server, the session initiation request message being received following establishment of a Transmission Control Protocol (TCP) connection between the client and the server, (ii) creating a fake socket to a local process;
(iii) diverting the session initiation request message to the local process over the fake socket;
(iv) resetting the TCP connection, initiating a new TCP connection to the server, and sending a new session initiation request message to the server over the new TCP connection, the new session initiation request message not including the session initiation request message received from the client;
(v) receiving, from the server, a response to the new session initiation request message, the received response including a server certificate;
(vi) using information in at least the server certificate to generate a new server certificate;
and (vii) forwarding, to the client, a response to the session initiation request message that was diverted to the local process, the forwarded response including the new server certificate.

4 more elements

Dependencies are inferred from the claim text.

Intercepting, decrypting and inspecting traffic over an encrypted channel

Life of this patent

Intercepting, decrypting and inspecting traffic over an encrypted channel

Life of this patent

Abstract

Claims25