Implementing and optimizing secure socket layer intercept

Patent metadata

Field	Value
Publication number	US-10063591-B1
Application number	US-201514622840-A
Country	US
Kind code	B1
Filing date	Feb 14, 2015
Priority date	Feb 14, 2015
Publication date	Aug 28, 2018
Grant date	Aug 28, 2018

Abstract

Provided are methods and systems for intercepting encrypted data packets. A system for intercepting encrypted data packets may comprise a first device, a second device, and a monitoring device. The first device may be operable to intercept at least one encrypted data packet. The first device may be further operable to decrypt the at least one encrypted packet to produce at least one decrypted data packet. The first device may provide the at least one decrypted data packet to the monitoring device. The monitoring device may be operable to inspect the at least one decrypted data packet based on predetermined criteria. The second device may be operable to receive, from the monitoring device, the at least one decrypted data packet. The second device may be further operable to re-encrypt the at least one decrypted data packet to produce the at least one encrypted data packet.

First claim

What is claimed is:

1. A system for intercepting an encrypted data packet, the system comprising:
a first device serving a client-side data traffic, the first device being hardware configured to:
intercept the encrypted data packet;
decrypt the encrypted data packet to produce a decrypted data packet, the decrypted data packet comprising an indication that the decrypted data packet requires re-encryption; and
provide the decrypted data packet to a firewall, the firewall including:
a first monitoring device being hardware and configured to inspect the decrypted data packet to determine whether the decrypted data packet includes a malware; and
a second monitoring device being hardware and configured to inspect the decrypted data packet to determine whether the decrypted data packet includes a botnet; and
wherein the firewall is configured to:

filter incoming data packets and outgoing data packets using predetermined criteria, wherein the firewall is configured to filter the decrypted data packet;
upon receiving the decrypted data packet from the first device, send the decrypted data packet to the first monitoring device and the second monitoring device; and
forward the decrypted data packet to a second device when the decrypted data packet does not match the predetermined criteria of the filtering, when the first monitoring device determines that malware is absent in the decrypted data packet, and when the second monitoring device determines that botnet communication is absent in the decrypted data packet;

wherein the second device is serving a server-side data traffic, the second device being hardware and is configured to:
receive, from the firewall, the decrypted data packet; and
based on the indication in the decrypted data packet that the decrypted data packet requires re-encryption, re-encrypt the decrypted data packet to produce the encrypted data packet.

2. The system of claim 1 , wherein the encrypted data packet is encrypted according to a Secure Socket Layer (SSL) protocol.

3. The system of claim 1 , wherein the encrypted data packet is received from at least one client device of an organization.

4. The system of claim 3 , wherein an interception proxy authority certificate is installed on the at least one client device by the organization to enable secure communications between the at least one client device and the first device.

5. The system of claim 1 , wherein the second device is further operable to replace a secure certificate associated with the server to enable secure communication between the second device and the server.

6. The system of claim 1 , wherein at least one of the first monitoring device and the second monitoring device includes at least one of an intrusion prevention system and an intrusion detection system.

7. The system of claim 1 , wherein the first device and the second device run on different partitions of a third device.

8. The system of claim 1 , wherein the encrypted data packet is intercepted using a wildcard Virtual Internet Protocol (VIP) address.

9. The system of claim 1 , wherein the decrypted data packet includes a clear text.

10. A method for intercepting an encrypted data packet, the method comprising:
intercepting, by a first device, the encrypted data packet, wherein the first device is a client-side device serving a client-side data traffic;
decrypting, by the first device, the encrypted data packet to produce a decrypted data packet, the decrypted data packet comprising an indication that the decrypted data packet requires re-encryption;
providing, by the first device, the decrypted data packet to a firewall, the firewall including a first monitoring device and a second monitoring device;
filtering, by the firewall, incoming data packets and outgoing data packets using predetermined criteria, wherein the firewall is configured to filter the decrypted data packets;
sending, by the firewall, the decrypted data packet to the first monitoring device and the second monitoring device, wherein the first monitoring device inspects the decrypted data packet for malware and the second monitoring device inspects the decrypted data packet for botnet communication;
forwarding, by the firewall, the decrypted data packet to a second device when the decrypted data packet does not match the predetermined criteria of the filtering, when the first monitoring device determines, based on the inspecting, that malware is absent in the decrypted data packet, and when the second monitoring device determines, based on the inspecting, that botnet communication is absent in the decrypted data packet, wherein the second device is a server-side device serving a server-side data traffic;
receiving, by the second device, from the firewall, the decrypted data packet; and
based on the indication in the decrypted data packet that the decrypted data packet requires re-encryption, re-encrypting, by the second device, the decrypted data packet to produce the encrypted data packet.

11. The method of claim 10 , wherein the encrypted data packet is encrypted according to an SSL protocol.

12. The method of claim 10 , wherein the encrypted data packet is received from at least one client device of an organization.

13. The method of claim 12 , wherein an interception proxy authority certificate is installed on the at least one client device by the organization to enable secure communications between the at least one client device and the first device.

14. The method of claim 10 , further comprising replacing, by the second device, a secure certificate associated with the server to enable secure communication between the second device and the server.

15. The method of claim 10 , wherein at least one of the first monitoring device and the second monitoring device includes at least one of an intrusion prevention system and an intrusion detection system.

16. The method of claim 10 , wherein the first device and the second device run on different partitions of a third device.

17. The method of claim 10 , wherein the encrypted data packet is intercepted using a wildcard VIP address.

18. A non-transitory computer-readable medium having embodied thereon a program being executable by at least one processor to perform a method for intercepting an encrypted data packet, the method comprising:
intercepting, by a first device, the encrypted data packet, wherein the first device is a client-side device serving a client-side data;
decrypting, by the first device, the encrypted data packet to produce a decrypted data packet, the decrypted data packet comprising an indication that the decrypted data packet requires re-encryption;
providing, by the first device, the decrypted data packet to a firewall;
filtering, by the firewall, incoming data packets and outgoing data packets using predetermined criteria, wherein the firewall is configured to filter the decrypted data packets;
sending, by the firewall, the decrypted data packet to a first monitoring device and a second monitoring device, wherein the first monitoring device inspects the decrypted data packet for malware and the second monitoring device inspects the decrypted data packet for botnet communication;
forwarding, by the firewall, the decrypted data packet to a second device when the decrypted data packet does not match the predetermined criteria of the filtering, when the first monitoring device determines, based on the inspecting, that malware is absent in the decrypted data packet, and when the second monitoring device determines, based on the inspecting, that botnet communicat

Assignees

• A10 Networks Inc

Inventors

• Jiang Xuyang
• Golshan Ali

Classifications

• H04L63/168 Primary

  above the transport layer · CPC title

• H04L63/0464

  using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title