Extracting data from encrypted packet flows
In one example, the present disclosure describes a device, computer-readable medium, and method for extracting data from encrypted packet flows. For instance, in one example, a method includes detecting a data packet that belongs to an encrypted data flow traversing a network, determining whether the encrypted data flow is a new encrypted data flow or an existing encrypted data flow, based on an inspection of payloads of data packets belonging to the encrypted data flow for evidence of a transport control protocol handshake, forwarding the data packet to a first server pool that will truncate the data packet, when the encrypted data flow is an existing encrypted data flow, and forwarding the data packet to a second server pool that will inspect a payload of the data packet for a secure sockets layer certificate, when the encrypted data flow is a new encrypted data flow.
1. A method comprising:
inspecting, by a processor, payloads of data packets belonging to a new encrypted data flow for a secure sockets layer certificate, wherein evidence of a transport control protocol handshake has been previously detected in the new encrypted data flow by a first device that forwards only data packets belonging to new encrypted data flows to the processor and forwards only data packets belonging to existing encrypted data flows to a different processor;
detecting, by the processor, the secure sockets layer certificate in a payload of one of the data packets that has been inspected; and
extracting, by the processor, the secure sockets layer certificate from the payload of the one of the data packets.
2. The method of claim 1 , further comprising:
ignoring future data packets of the new encrypted data flow subsequent to the detecting.
3. The method of claim 1 , further comprising:
extracting information from the secure sockets layer certificate.
4. The method of claim 3 , wherein the information includes an identity of a holder of the secure sockets layer certificate.
5. The method of claim 3 , wherein the information includes a serial number of the secure sockets layer certificate.
6. The method of claim 3 , wherein the information includes an expiration date of the secure sockets layer certificate.
7. The method of claim 3 , wherein the information includes a copy of a public key belonging to a holder of the secure sockets layer certificate.
8. The method of claim 3 , wherein the information includes a digital signature of an authority who issued the secure sockets layer certificate.
9. The method of claim 1 , further comprising:
forwarding the secure sockets layer certificate to a device for extraction of information.
10. The method of claim 1 , wherein the first device comprises a multiplexer.
11. The method of claim 1 , wherein the processor belongs to a first server pool comprising a first plurality of servers, and the different processor belongs to a second server pool comprising a second plurality of servers.
12. A non-transitory computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations, the operations comprising:
inspecting payloads of data packets belonging to a new encrypted data flow for a secure sockets layer certificate, wherein evidence of a transport control protocol handshake has been previously detected in the new encrypted data flow by a first device that forwards only data packets belonging to new encrypted data flows to the processor and forwards only data packets belonging to existing encrypted data flows to a different processor;
detecting the secure sockets layer certificate in a payload of one of the data packets that has been inspected; and
extracting the secure sockets layer certificate from the payload of the one of the data packets.
13. The non-transitory computer-readable medium of claim 12 , the operations further comprising:
ignoring future data packets of the new encrypted data flow subsequent to the detecting.
14. The non-transitory computer-readable medium of claim 12 , the operations further comprising:
extracting information from the secure sockets layer certificate.
15. The non-transitory computer-readable medium of claim 14 , wherein the information includes an identity of a holder of the secure sockets layer certificate.
16. The non-transitory computer-readable medium of claim 14 , wherein the information includes a serial number of the secure sockets layer certificate.
17. The non-transitory computer-readable medium of claim 14 , wherein the information includes an expiration date of the secure sockets layer certificate.
18. The non-transitory computer-readable medium of claim 14 , wherein the information includes a copy of a public key belonging to a holder of the secure sockets layer certificate.
19. The non-transitory computer-readable medium of claim 14 , wherein the information includes a digital signature of an authority who issued the secure sockets layer certificate.
20. A device comprising:
a processor; and
a non-transitory computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising:
inspecting payloads of data packets belonging to a new encrypted data flow for a secure sockets layer certificate, wherein evidence of a transport control protocol handshake has been previously detected in the new encrypted data flow by a first device that forwards only data packets belonging to new encrypted data flows to the processor and forwards only data packets belonging to existing encrypted data flows to a different processor;
detecting the secure sockets layer certificate in a payload of one of the data packets that has been inspected; and
extracting the secure sockets layer certificate from the payload of the one of the data packets.