Proxy-less secure sockets layer (SSL) data inspection
Some embodiments of proxy-less Secure Sockets Layer (SSL) data inspection have been presented. In one embodiment, a secured connection according to a secured network protocol between a client and a responder is setup via a gateway device, which is coupled between the client and the responder. The gateway device transparently intercepts data transmitted according to the secured network protocol between the client and the responder. Furthermore, the gateway device provides flow-control and retransmission of one or more data packets of the data without self-scheduling the packet retransmissions using timeouts and based on the packet retransmission logic of either the client-side or the responder side of the connection. The gateway device is further operable to perform security screening on the data.
1. A method for inspecting data sent over a computer network, the method comprising:
establishing a secure connection between a client device and a responder device via a gateway;
intercepting a plurality of data packets sent between the responder device and the client device via the secure connection;
maintaining packet state information relating to the intercepted data packets at the gateway, wherein a first set of state information pertains to a first set of the intercepted packets from communications with the responder device, and wherein a second set of state information pertains to a second set of the intercepted packets from communications with the client device;
updating the first set of state information as each of the first set of intercepted packets are inspected and communicated to the responder device;
transmitting a current intercepted packet from the gateway via the secured connection to the client device, wherein the client device identifies the current packet as being sent directly from the responder device;
receiving a retransmission of the current packet from the responder device based on the responder device not receiving an acknowledgment from the client device;
transparently passing the acknowledgement to the responder device that was received from the client device;
updating the second set of state information as each of the second set of intercepted packets are inspected and communicated to the client device;
identifying that the packets from the responder device include data that is associated with a security function; and
executing the security function based on the identification that the data is associated with the security function.
2. The method of claim 1 , further comprising:
receiving a first certificate from the responder device;
generating a second certificate based on modifying the first certificate, wherein a public key of the second certificate is different from a public key of the first certificate and a remaining portion of the second certificate is identical to a remaining portion of the first certificate; and
establishing a new secured connection based on the second certificate.
3. The method of claim 2 , wherein establishing the new secured connection includes:
storing details of the first certificate in memory;
completing key exchange with the responder device; and
completing certificate and key exchange with the client device.
4. The method of claim 1 , wherein executing the security function comprises blocking further transmission of the data packets sent to the client device.
5. The method of claim 1 , wherein executing the security function comprises sending a warning message to the client device.
6. The method of claim 1 , wherein inspecting the intercepted data packets includes deep packet inspection.
7. The method of claim 1 , wherein executing the security function comprises filtering content of the intercepted data packets.
8. The method of claim 1 , wherein the current packet is encrypted, and further comprising determining when to attempt decryption of the encrypted packet.
9. The method of claim 8 , wherein determining when to attempt decryption of the encrypted packet is based on detection of a connection to a known port.
10. The method of claim 8 , wherein when to attempt decryption of the encrypted packet is based on detection of a valid secure socket layer (SSL) Hello packet.
11. The method of claim 8 , further comprising determining when to attempt re-encryption of the decrypted packet.
12. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for inspecting data sent over a computer network, the method comprising:
establishing a secure connection between a client device and a responder device via a gateway;
intercepting a plurality of data packets sent between the responder device and the client device via the secure connection;
maintaining packet state information relating to the intercepted data packets at the gateway, wherein a first set of state information pertains to a first set of the intercepted packets from communications with the responder device and a second set of state information pertains to a second set of the intercepted packets from communications with the client device;
updating the first set of state information as each of the first set of intercepted packets are inspected and communicated to the responder device;
transmitting a current intercepted packet from the gateway via the secured connection to the client device, wherein the client device identifies the current packet as being sent directly from the responder device;
receiving a retransmission of the current packet from the responder device based on the responder device not receiving an acknowledgment from the client device;
transparently passing the acknowledgement to the responder device that was received from the client device;
updating the second set of state information is as each of the second set of intercepted packets are inspected and communicated to the client device;
identifying that the packets from the responder device include data that is associated with a security function; and
executing the security function based on the identification that the data is associated with the security function.
13. The non-transitory computer-readable storage medium of claim 12 , further comprising instructions executable to:
receive a first certificate from the responder device;
generate a second certificate based on modifying the first certificate, wherein a public key of the second certificate is different from a public key of the first certificate and a remaining portion of the second certificate is identical to a remaining portion of the first certificate; and
establish a new secured connection based on the second certificate.
14. The non-transitory computer-readable storage medium of claim 13 , wherein establishing the secured connection includes:
storing details of the first certificate in memory;
completing key exchange with the responder device; and
completing certificate and key exchange with the client device.
15. The non-transitory computer-readable storage medium of claim 12 , wherein executing the security function comprising blocking further transmission of the data packets sent to the client device.
16. The non-transitory computer-readable storage medium of claim 12 , wherein executing the security function comprises sending a warning message to the client device.
17. The non-transitory computer-readable storage medium of claim 12 , wherein inspecting the intercepted data packets includes deep packet inspection.
18. The non-transitory computer-readable storage medium of claim 12 , wherein executing the security function comprises filtering content of the intercepted data packets.
19. A gateway apparatus for inspecting data sent over a computer network, the apparatus comprising:
a communication interface that:
establishes a secure connection between a client device and a responder device via a gateway, and
receives a plurality of data packets sent between the responder device and the client device via the secure connection, wherein the plurality of data packets sent between the responder device and the client device via the secure connection are intercepted;
a memory; and
a processor that executes instructions out of the memory to:
maintain packet state information relating to the intercepted data packets at the gateway that includes a first set of state information that pertains to a first set of the intercepted packets from communications with the responder device and a second set of state information that pertains to a second set of the intercepted packets from communications with the client device,
update the first set of state information as each of the first set of intercepted packets are inspected and communicated in relation to the responder device, wherein the communication interface further:
transmits a current intercepted packet from the gateway via the secured connection to the client device, wherein the client device identifies the current packet as being sent directly from the responder device, and
receives a retransmission from the responder device based on the responder device not receiving an acknowledgment from the client device;
allow the acknowledgement received from the client device to be passed to the responder device transparently;
update the second set of state information as each of the second set of intercepted packets are inspected and communicated to the client device,
identify that the packets from the responder device include data that is associated with a security function, and
execute the security function based on the identification that the data is associated with the security function.
20. The apparatus of claim 19 , wherein:
the processor executes further instructions to generate a second certificate by modifying a first certificate, the generation of the second certificate causing:
the second certificate to include a public key of the second certificate that is different from a public key of the first certificate, and
a remaining portion of the second certificate to be identical to a remaining portion of the first certificate, and
the communication interface establishes a new secured connection based on the second certificate.