Method, system, and logic for in-band exchange of meta-information

Patent metadata

Field	Value
Publication number	US-9426176-B2
Application number	US-201414520118-A
Country	US
Kind code	B2
Filing date	Oct 21, 2014
Priority date	Mar 21, 2014
Publication date	Aug 23, 2016
Grant date	Aug 23, 2016

Abstract

In an embodiment, a method is provided for enabling in-band data exchange between networks. The method can comprise receiving, by a first enveloping proxy located in the first network, at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server; receiving the data from a network element located in the first network; encoding the data into at least one custom SSL record; and transmitting the at least one regular SSL record and the at least one custom SSL record to an enveloping proxy. In another embodiment, a method can comprise receiving at least one regular secure sockets layer (SSL) record and at least one custom SSL record for a SSL session established between a client and a server; extracting the data from the at least one custom SSL; transmitting the at least one regular SSL record.

First claim

What is claimed is:

1. A method for enabling in-band data exchange between a first network and a second network, the method comprising:
receiving, by a first enveloping proxy located in the first network, at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server, wherein the first enveloping proxy does not have access to a first key needed to decrypt the at least one regular SSL record;
receiving, by the first enveloping proxy, data from a network element located in the first network;
converting, by the first enveloping proxy, the data to a format for transmission in-band by encoding the data into at least one custom SSL record; and
transmitting, by a processor in the first enveloping proxy, the data in-band from the first network to the second network over the SSL session by:
interleaving ones of the at least one custom SSL record and ones of the least one regular SSL record to generate an interleaved data, the interleaved data being generating without decrypting the at least one regular SSL record, and
transmitting the interleaved data to a second enveloping proxy located in the second network, wherein the interleaved data is transmitted via a network component that is to translate a tuple identifying the interleaved data to an alternate tuple identifying the interleaved data, and wherein the second enveloping proxy has access to a second key needed to decrypt the at least one custom SSL record and does not have access to the first key needed to decrypt the at least one regular SSL record.

2. The method of claim 1 , wherein encrypted data within the at least one regular SSL record is to be decrypted only by the server and the server has access to the first key needed to decrypt the at least one regular SSL record.

3. The method of claim 1 , wherein the transmitting the interleaved data to the second enveloping proxy located in the second network comprises transmitting the interleaved data over a data connection between the first enveloping proxy and the second enveloping proxy.

4. The method of claim 1 , wherein the receiving the data from the network element located in the first network comprises receiving the data over an out-of-band channel between the network element and the first enveloping proxy.

5. The method of claim 1 , wherein the first network is a service provider network, the first enveloping proxy is a service provider enveloping proxy, the second network is a content provider network, the second enveloping proxy is a content provider enveloping proxy, and the server is a content server.

6. The method of claim 1 , wherein the first network is a content provider network, the first enveloping proxy is a content provider enveloping proxy, the second network is a service provider network, the second enveloping proxy is a service provider enveloping proxy, and the server is a content server.

7. The method of claim 1 , wherein the interleaved data is transmitted within a single data flow, and further comprising the tuple identifying the single data flow and the alternate tuple identifying the single data flow.

8. A system for enabling in-band data exchange between a first network and a second network, the system comprising:
at least one memory element;
at least one processor coupled to the at least one memory element; and
a data encoding module, on a first enveloping proxy, to interface with the at least one processor and further to:
receive at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server, wherein the first enveloping proxy does not have access to a first key needed to decrypt the at least one regular SSL record;
receive data from a network element located in the first network;
convert the data to a format for transmission in-band by encoding the data into at least one custom SSL record; and
transmit the data in-band from the first network to the second network over the SSL session by:
interleaving ones of the at least one custom SSL record and ones of the least one regular SSL record to generate an interleaved data, the interleaved data being generating without decrypting the at least one regular SSL record, and
transmitting the interleaved data to a second enveloping proxy located in the second network, wherein the interleaved data is transmitted via a network component that is to translate a tuple identifying the interleaved data to an alternate tuple identifying the interleaved data, and wherein the second enveloping proxy has access to a second key needed to decrypt the at least one custom SSL record and does not have access to the first key needed to decrypt the at least one regular SSL record.

9. The system of claim 8 , wherein encrypted data within the at least one regular SSL record is to be decrypted only by the server and the server has access to the first key needed to decrypt the at least one regular SSL record.

10. The system of claim 8 , wherein the transmitting the interleaved data to the second enveloping proxy located in the second network comprises transmitting the interleaved data over a data connection between the first enveloping proxy and the second enveloping proxy.

11. The system of claim 8 , wherein the receiving the data from the network element located in the first network comprises receiving the data over an out-of-band channel between the network element and the first enveloping proxy.

12. The system of claim 8 , wherein the first network is a service provider network, the first enveloping proxy is a service provider enveloping proxy, the second network is a content provider network, the second enveloping proxy is a content provider enveloping proxy, and the server is a content server.

13. The system of claim 8 , wherein the first network is a content provider network, the first enveloping proxy is a content provider enveloping proxy, the second network is a service provider network, the second enveloping proxy is a service provider enveloping proxy, and the server is a content server.

14. The system of claim 8 , wherein the interleaved data is transmitted within a single data flow, and further comprising the tuple identifying the single data flow and the alternate tuple identifying the single data flow.

15. One or more non-transitory tangible media for enabling in-band data exchange between a first network and a second network, the one or more non-transitory tangible media including code for execution and when executed by a processor operable to perform operations comprising:
receiving, by a first enveloping proxy located in the first network, at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server, wherein the first enveloping proxy does not have access to a first key needed to decrypt the at least one regular SSL record;
receiving, by the first enveloping proxy, data from a network element located in the first network;
converting, by the first enveloping proxy, the data to a format for transmission in-band by encoding the data into at least one custom SSL record; and
transmitting, by a processor in the first enveloping proxy, the data in-band from the first network to the second network over the SSL session by:
interleaving ones of the at least one custom SSL record and ones of the least one regular SSL record to generate an interleaved data, the interleaved data being generating without decrypting the at least one regular SSL record, and
transmitting the interleaved data to a second enveloping proxy located in the second network, wherein the interleaved data is transmitted via a ne

Assignees

• Cisco Tech Inc

Inventors

• Duminuco Alessandro
• Bosch Hendrikus G P
• Kumar Surendra M
• La Roche Humberto J
• Napper Jeffrey
• Shatzkamer Kevin D
• Wing Daniel G

Classifications

• H04L67/42

  Electricity · mapped topic

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title