Method and apparatus for displaying HTTPS block page without SSL inspection

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes a network controller to perform operations comprising:

snooping a first unencrypted message transmitted between a client device and a network resource, the first unencrypted message being transmitted as part of a Secure Sockets Layer (SSL) Handshake between the client device and the network resource to establish a SSL session;

determining whether the client device is authorized to access the network resource;

responsive to determining that the client device is not authorized to access the network resource:

blocking the establishment of the SSL session between the client device and the network resource, wherein blocking the establishment of the SSL session a network device coupled by the network controller includes intercepting the first message and transmitting a transmission control protocol reset message to the network resource;

spoofing, by the network controller, the network resource for establishing the SSL session between the client device and the network controller instead of establishment of the SSL session between the client device and the network resource, wherein the network controller spoofs the network resource by transmitting a self-generated certificate corresponding to the network controller in response to a request from the client device for a certificate corresponding to the network resource;

receiving, from the spoofing network controller, all subsequent messages sent by the client device directed to the network resource; and

responsive to determining that the client device is authorized to access the network resource, refraining from blocking the establishment of the SSL session between the client device and the network resource.

2. The medium of claim 1 , wherein the operations further comprise, subsequent to establishing the SSL session between the client device and the spoofing network controller, transmitting a second message from the spoofing network controller to the client device that (a) spoofs the network resource and (b) redirects the client device to a different second network resource.

3. The medium of claim 1 , wherein the operations further comprise, subsequent to establishing the SSL session between the client device and the spoofing network controller, transmitting a second message from the spoofing network controller to the client device that (a) spoofs the network resource and (b) indicates an error message comprising information why the client device cannot access the network resource.

4. The medium of claim 1 , wherein responsive to determining that the client device is not authorized to access the network resource, the operations further comprise:

spoofing, by the spoofing network controller, the client device in a second message transmitted by the spoofing network controller to the network resource, the second message indicating a termination of communication between the network resource and the client device.

5. The medium of claim 1 , wherein determining whether the client device is authorized to access the network resource is based on a set of rules indicating access permissions associated with the network resource.

6. The medium of claim 1 , wherein the first unencrypted message is an initial message in the

SSL Handshake that is transmitted from the client device and that is addressed to the network resource.

7. The medium of claim 1 , wherein the first unencrypted message is a certificate from the network resource to the client device.

8. The medium of claim 1 , wherein the determination of whether the client device is authorized to access the network resource is based on a category and/or reputation associated with the network resource.

9. The medium of claim 1 , wherein determining whether the client device is authorized to access the network resources comprises determining whether the client device is authorized to access an application corresponding to the network resource, the application being determined using a Deep Packet Inspection classification method.

10. A system comprising: a network controller including a hardware processor, the network controller being configured to:

detect performance of a 3-way Transmission Control Protocol (TCP) Handshake by a client device with a network resource to establish a first TCP connection;

snoop a first unencrypted message transmitted between the client device and the network resource, the first unencrypted message being transmitted as part of a Secure Socket Layer (SSL) Handshake between the client device and the network resource to establish a SSL session;

determine whether the client device is authorized to access the network resource;

responsive to the determination that the client device is not authorized to access the network resource:

block the establishment of the SSL session between the client device and the network resource, wherein the SSL session is blocked by the network controller intercepting the first message and transmitting a TCP reset message to the network resource;

spoof the network resource for establishing the SSL session between the client device and the network controller instead of establishment of the SSL session between the client device and the network resource, wherein the network controller spoofs the network resource by:

transmitting a self-generated certificate corresponding to the network controller in response to a request from the client device for a certificate corresponding to the network resource; and

self-generating a second TCP connection and merging it with the first TCP connection by using network address translation;

receive subsequent messages the client device directs to the network resource; and

responsive to the determination that the client device is authorized to access the network resource, refrain from blocking the establishment of the SSL session between the client device and the network resource.

11. The system of claim 10 , wherein subsequent to establishing the SSL session between the client device and the network controller, transmitting a second message from the network controller to the client device that (a) spoofs the network resource and (b) redirects the client device to a different second network resource.

12. The system of claim 10 , wherein subsequent to establishing the SSL session between the client device and the network controller, transmitting a second message from the network controller to the client device that (a) spoofs the network resource and (b) indicates an error message comprising information why the client device cannot access the network resource.

13. The system of claim 10 , wherein responsive to determining that the client device is not authorized to access the network resource, the operations further comprise:

spoofing, by the network controller, the client device in a second message transmitted by the network controller to the network resource, the second message indicating a termination of communication between the network resource and the client device.

14. The system of claim 10 , wherein determining whether the client device is authorized to access the network resource is based on a set of rules indicating access permissions associated with the network resource.

15. The system of claim 10 , wherein spoofing, by the network controller, the network resource comprises transmitting a certificate corresponding to the network controller in response to a request from the client device for a certificate corresponding to the network resource.

16. The system of claim 10 , wherein the first unencrypted message is an initial message in the SSL Handshake that is transmitted from the client device and that is addressed to the network resource.

17. The system of claim 10 , wherein the first unencrypted message is a certificate from the network resource to the client device.

18. The system of claim 10 , wherein the determination of whether the client device is authorized to access the network resource is based on a category and/or reputation associated with the network resource.

19. The system of claim 10 , wherein determining whether the client device is authorized to access the network resources comprises determining whether the client device is authorized to access an application corresponding to the network resource, the application being determined using a Deep Packet Inspection classification method.