In-band security protocol decryptor and scanner
View Patent ↗An in-band decryptor and scanner (IBDS) for monitoring data packets or frames of an encrypted communication session. The IBDS may reroute or process the data packets or frames prior to reaching their destination. The IBDS may be used to decrease the load on a server by decrypting, preprocessing or rerouting the incoming data without altering the endpoints of the encrypted communication session from the server and a client.
1. A method comprising:
detecting, at a network device, a packet or frame from an encrypted communication session between a first endpoint and a second endpoint of the session;
decrypting the packet or frame, at the network device, transparent to the first endpoint and the second endpoint, using encryption configuration data for the intercepted encrypted communication session;
re-encrypting the packet or frame using at least in part different encryption configuration data; and
processing the packet or frame to reduce a load on the second endpoint.
2. The method of claim 1 , wherein the first endpoint is a client and the second endpoint is a server.
3. The method of claim 1 , further comprising:
forwarding the packet or frame to the second endpoint.
4. The method of claim 1 , further comprising:
scanning the packet or frame for spyware, viruses or malware.
5. The method of claim 1 , further comprising:
identifying a type of the data; and
forwarding the packet or frame to a module or server for processing based on the type of the data.
6. The method of claim 1 , further comprising:
aggregating data from the packet or frame with data from a second packet or frame of the encrypted communication session; and
forwarding aggregated data to the second endpoint.
7. The method of claim 1 , wherein the encryption configuration data is intercepted from communication between the first endpoint and the second endpoint.
8. The method of claim 1 , wherein the encryption configuration data is provided by an administrator of the encrypted communication session.
9. A device comprising:
a memory;
a communications module to transmit and receive a set of encrypted data packets from a session over a network, the session being between a first endpoint and a second endpoint;
a decryption module to decrypt the set of encrypted data packets;
an encryption module to encrypt or re-encrypt the set of decrypted data packets using encryption keys; and
a processor coupled to the communication module to analyze a content of the set of encrypted data packets and to reroute the set of re-encrypted data packets for processing by a module or a first server.
10. The device of claim 9 , further comprising:
a configuration module to maintain session data including encryption keys for each session.
11. The device of claim 9 , further comprising:
an application detection module to identify an application associated with the content.
12. The device of claim 9 , further comprising:
a scanning module to scan each of the set of encrypted data packets for one of a virus, spyware or malware.
13. The device of claim 9 , further comprising:
a compression module to compress the set of re-encrypted data packets.
14. The device of claim 9 , further comprising:
an aggregation module to aggregate data in the set of decrypted data packets.
15. A machine readable medium, having a set of instructions stored therein, which when executed cause a machine to perform a set of operations comprising:
monitoring packets of an encrypted session between a first endpoint and a second endpoint;
identifying an encrypted data packet to the second endpoint;
decrypting the encrypted data packet using a first set of configuration data;
re-encrypting the decrypted data packet using at least in part a second set of configuration data; and
rerouting the re-encrypted data packet to a module or a first server to be processed according to the type of data encrypted in the encrypted data packet.
16. The machine readable medium of claim 15 , having further instructions stored therein, which when executed, cause a machine to perform a further set of instructions comprising:
authenticating a request from the first endpoint.
17. The machine readable medium of claim 15 , having further instructions stored therein, which when executed, cause a machine to perform a further set of instructions comprising:
compressing the re-encrypted data packets; and
forwarding the compressed data packets to the second endpoint.
18. The machine readable medium of claim 15 , having further instructions stored therein, which when executed, cause a machine to perform a further set of instructions comprising:
determining an application to handle the encrypted data packet based on the type of the data encrypted in the encrypted data packet.