Efficient SSL/TLS proxy
Systems, devices, and methods are disclosed for selectively decrypting SSL/TLS communications. Contents of the decrypted communications that may result in some action; for example, to terminate the communications, or to log and store the plaintext packets of the communications for subsequent content inspection and analysis. A SSL/TLS proxy may examine the information contained in the TLS handshake protocol and/or examine other information associated with the connection. Based on the examination, a proxy may determine whether or not to decrypt the encrypted communications. The proxy may take additional actions based on content inspection.
1. A method comprising:
storing, by a computing device, a list of identification data and at least one corresponding action to perform on encrypted communication flows associated with corresponding identification data;
receiving, by the computing device, one or more packets initiating at least one encrypted communication flow;
identifying, by the computing device, flow identification data associated with the one or more packets initiating the at least one encrypted communication flow;
comparing, by the computing device, the identified flow identification data with the list of the identification data; and
decrypting, by the computing device and based on the comparing resulting in a match with data of the list, each packet of an encrypted communication flow associated with the match with data of the list and performing a corresponding action on each packet of the encrypted communication flow associated with the match with data of the list; and
re-encrypting, after performing the corresponding action, each packet of the encrypted communication flow associated with the match with data of the list and transmitting each packet of the encrypted communication flow to its intended destination.
2. The method of claim 1 , further comprising:
receiving, by the computing device, a list of one or more network addresses and/or domain names from a security application; and
creating the list of the identification data based on the received list of the one or more network addresses and/or domain names.
3. The method of claim 1 , further comprising:
receiving, by the computing device and via a subscription service, at least one list of network addresses and/or domain names from one or more cyber threat intelligence providers; and
creating the list of the identification data based on the received at least one list of network addresses and/or domain names.
4. The method of claim 1 , further comprising:
receiving, by the computing device, a list of one or more network addresses and/or domain names from a privacy protection application; and
creating the list of the identification data based on the received list of the one or more network addresses and/or domain names.
5. The method of claim 1 , further comprising:
receiving, by the computing device, a list of one or more network addresses and/or domain names from a law-enforcement wiretapping application; and
creating the list of the identification data based on the received list of the one or more network addresses and/or domain names.
6. The method of claim 1 , further comprising:
forwarding, by the computing device, a plurality of packets associated with a particular encrypted communication flow to their intended destinations, wherein the plurality of packets are not decrypted prior to the forwarding.
7. The method of claim 1 , further comprising:
receiving, by the computing device, a first list of one or more network addresses and/or domain names, wherein the first list of one or more network addresses and/or domain names indicates network addresses and/or domain names whose corresponding encrypted communication flows are to be decrypted;
receiving, by the computing device, a second list of one or more network addresses and/or domain names, wherein the second list of one or more network addresses and/or domain names indicates network addresses and/or domain names whose corresponding encrypted communication flows are not to be decrypted;
assigning a first priority to the first list of one or more network addresses and/or domain names and a second priority to the second list of one or more network addresses and/or domain names, wherein the first priority is different from the second priority; and
creating, based on the first priority and the second priority, an ordered list of identification data from the first list of one or more network addresses and/or domain names and the second list of one or more network addresses and/or domain names.
8. The method of claim 1 ,
wherein the list of the identification data indicates a particular action to perform on the identification data comprised by the list;
wherein the comparing the identified flow identification data with the list of the identification data determines that the list of the identification data does not comprise the identified flow identification data, the method further comprising:
performing, by the computing device and based on a comparison indicating no match with data of the list, an action other than the particular action indicated by the list of the identification data.
9. The method of claim 8 , wherein the action other than the particular action indicated by the list comprises terminating an associated encrypted communication flow.
10. The method of claim 8 , wherein the action other than the particular action indicated by the list comprises:
logging packets associated with an associated encrypted communication flow for subsequent analysis; and
forwarding the packets associated with the associated encrypted communication flow to their respective intended destinations.
11. An apparatus comprising:
at least one processor; and
memory storing instructions that when executed by the at least one processor cause the apparatus to:
store a list of identification data and at least one corresponding action to perform on encrypted communication flows associated with each corresponding identification data;
receive one or more packets initiating at least one encrypted communication flow;
identify flow identification data associated with the one or more packets initiating the at least one encrypted communication flow;
compare the identified flow identification data with the list of identification data;
decrypt, based on comparing the identified flow identification data with the list of the identification data resulting in a match with data of the list, each packet of an encrypted communication flow associated with the match with data of the list and performing a corresponding action on each packet of the encrypted communication flow associated with the match with data of the list; and
re-encrypt, after performing the corresponding action, each packet of the encrypted communication flow associated with the match with data of the list and transmit each packet of the encrypted communication flow to its intended destination.
12. The apparatus of claim 11 , wherein the instructions, when executed by the at least one processor, further cause the apparatus to:
receive a list of one or more network addresses and/or domain names from a security application; and
create the list of the identification data based on the received list of the one or more network addresses and/or domain names.
13. The apparatus of claim 11 , wherein the instructions, when executed by the at least one processor, further cause the apparatus to:
receive, via a subscription service, at least one list of network addresses and/or domain names from one or more cyber threat intelligence providers; and
create the list of the identification data based on the received at least one list of network addresses and/or domain names.
14. The apparatus of claim 11 , wherein the instructions, when executed by the at least one processor, further cause the apparatus to:
receive a list of one or more network addresses and/or domain names from a privacy protection application; and
create the list of the identification data based on the received list of the one or more network addresses and/or domain names.
15. The apparatus of claim 11 , wherein the instructions, when executed by the at least one processor, further cause the apparatus to:
receive a list of one or more network addresses and/or domain names from a law-enforcement wiretapping application; and
create the list of the identification data based on the received list of the one or more network addresses and/or domain names.
16. The apparatus of claim 11 , wherein the instructions, when executed by the at least one processor, further cause the apparatus to:
forward a plurality of packets associated with a particular encrypted communication flow to their intended destinations, wherein the plurality of packets are not decrypted prior to the forwarding.
17. The apparatus of claim 11 , wherein the instructions, when executed by the at least one processor, further cause the apparatus to:
receive a first list of one or more network addresses and/or domain names, wherein the first list of one or more network addresses and/or domain names indicates network addresses and/or domain names whose corresponding encrypted communication flows are to be decrypted;
receive a second list of one or more network addresses and/or domain names, wherein the second list of one or more network addresses and/or domain names indicates network addresses and/or domain names whose corresponding encrypted communication flows are not to be decrypted;
assign a first priority to the first list of one or more network addresses and/or domain names and a second priority to the second list of one or more network addresses and/or domain names, wherein the first priority is different from the second priority; and
create, based on the first priority and the second priority, an ordered list of identification data from the first list of one or more network addresses and/or domain names and the second list of one or more network addresses and/or domain names.
18. The apparatus of claim 11 ,
wherein the list of the identification data indicates a particular action to perform on the identification data comprised by the list;
wherein the comparing the identified flow identification data with the list of the identification data determines that the list of the identification data does not comprise the identified flow identification data; and
wherein the instructions, when executed by the at least one processor, cause the apparatus to perform, based on a comparison indicating no match with data of the list, an action other than the particular action indicated by the list of the identification data.
19. The apparatus of claim 18 , wherein the action other than the particular action indicated by the list of identification data comprises terminating an associated encrypted communication flow.
20. The apparatus of claim 18 , wherein the action other than the particular action indicated by the list further causes the apparatus to:
log packets associated with an associated encrypted communication flow for subsequent analysis; and
forward the packets associated with the associated encrypted communication flow to their respective intended destinations.