Proxy-less secure sockets layer (SSL) data inspection
Some embodiments of proxy-less Secure Sockets Layer (SSL) data inspection have been presented. In one embodiment, a secured connection according to a secured network protocol between a client and a responder is setup via a gateway device, which is coupled between the client and the responder. The gateway device transparently intercepts data transmitted according to the secured network protocol between the client and the responder. Furthermore, the gateway device provides flow-control and retransmission of one or more data packets of the data without self-scheduling the packet retransmissions using timeouts and based on the packet retransmission logic of either the client-side or the responder side of the connection. The gateway device is further operable to perform security screening on the data.
1. A method for establishing a proxy-less communication session, the method comprising:
performing a first key exchange of a first public key between a gateway device and a server;
performing a second key exchange of a second public key between the gateway device and a client device after the first key exchange;
receiving a data packet at the gateway device, wherein the data packet includes information encrypted at the server using the first public key;
decrypting the encrypted information included in the data packet received from the server, wherein the decrypted information is inspected in accordance with deep packet inspection by the gateway device;
generating a first certificate that includes the first public key and a set of attributes associated with the client device;
storing certificate details of the first certificate in gateway memory of the gateway device;
generating encrypted data in response to an indication the decrypted information passes inspection;
detecting when to transmit the encrypted data based on transmission information communicated from the server and the client device and verification of the set of attributes associated with the client device;
sending the first certificate and the encrypted data transparently from the gateway device to the client device, wherein sending the first certificate is transparent to the server, and wherein the encrypted data are decrypted at the client device using the second public key;
receiving a first acknowledgement from the client device acknowledging receipt of the encrypted data included in the data packet have been received by the gateway device;
sending a second acknowledgement from the gateway device to the server based on the receipt of the first acknowledgement from the client device, wherein sending the second acknowledgement is transparent to the client device, and wherein the second acknowledgement indicates that the data packet has been received, and the second acknowledgement is not sent to the server until after the first acknowledgement is received from the client device indicating that the encrypted data included in the data packet have been received at the client device;
generating a second certificate that is a modified copy of the first certificate, wherein a public key of the second certificate is different from a public key of the first certificate, and wherein a remaining portion of the second certificate is identical to a remaining portion of the first certificate; and
establishing the communication session between the client device and the server using the gateway device without a proxy based on an identification that the second certificate matches a previously trusted certificate, wherein the gateway device provides flow control of data transmitted between the client device and the server in the established communication session.
2. The method of claim 1 , further comprising receiving the first certificate from the server, and passing the second certificate to the client device.
3. The method of claim 1 , wherein the encrypted information corresponds to the data packet, and further comprising:
identifying that the data packet includes data associated with a security screening based on the inspection; and
executing the security screening using the gateway device based on the identification.
4. The method of claim 3 , wherein executing the security screening includes blocking a further data packet from being transmitted to the client device.
5. The method of claim 3 , wherein executing the security screening includes sending a warning message from the gateway device to the client device.
6. The method of claim 3 , wherein inspecting the decrypted information includes the deep packet inspection by the gateway device.
7. The method of claim 3 , wherein executing the security screening includes using the gateway device to filer content of data received from the server.
8. The method of claim 1 , further comprising:
intercepting one or more data packets transmitted according to a secured network protocol between the client device and the server while remaining transparent to the client device and the server;
maintaining a first set of state information for the client device, the first set of state information including a sequence number of a last packet received by the client device; and
retransmitting the last data packet corresponding to the sequence number to the client device based on the first set of state information.
9. The method of claim 8 , wherein retransmitting the last data packet is further based on a retransmission received from the server.
10. The method of claim 1 , further comprising attempting decryption of the information that is encrypted in the data packet based on detection of a connection to a known SSL TCP port.
11. The method of claim 1 , further comprising attempting decryption of the information that is encrypted in the data packet based on detection of a valid secure socket layer (SSL) Hello packet to a known port.
12. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for establishing a proxy-less communication session, the method comprising:
performing a first key exchange of a first public key between a gateway device and a server;
performing a second key exchange of a second public key between the gateway device and a client device after the first key exchange;
receiving a data packet at the gateway device, wherein the data packet includes information encrypted at the server using the first public key;
decrypting the encrypted information included in the data packet received from the server, wherein the decrypted information is inspected in accordance with deep packet inspection by the gateway device;
generating a first certificate that includes the first public key and a set of attributes associated with the client device;
storing certificate details of the first certificate in gateway memory of the gateway device;
generating encrypted data in response to an indication the decrypted information passes inspection;
detecting when to transmit the encrypted data based on transmission information communicated from the server and the client device and verification of the set of attributes associated with the client device;
sending the first certificate and the encrypted data transparently from the gateway device to the client device, wherein sending the first certificate is transparent to the server, and wherein the encrypted data are decrypted at the client device using the second public key;
receiving a first acknowledgement from the client device acknowledging receipt of the encrypted data included in the data packet have been received by the gateway device;
sending a second acknowledgement from the gateway device to the server based on the receipt of the first acknowledgement from the client device, wherein sending the second acknowledgement is transparent to the client device, and wherein the second acknowledgement indicates that the data packet has been received, and the second acknowledgement is not sent to the server until after the first acknowledgement is received from the client device indicating that the encrypted data included in the data packet have been received at the client device;
generating a second certificate that is a modified copy of the first certificate, wherein a public key of the second certificate is different from a public key of the first certificate, and wherein a remaining portion of the second certificate is identical to a remaining portion of the first certificate; and
establishing the communication session between the client device and the server using the gateway device without a proxy based on an identification that the second certificate matches a previously trusted certificate, wherein the gateway device provides flow control of data transmitted between the client device and the server in the established communication session.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the encrypted information corresponds to the data packet, and further comprising instructions executable to:
identify that the data packet includes data associated with a security screening based on the inspection; and
execute the security screening using the gateway device based on the identification.
14. The non-transitory computer-readable storage medium of claim 13 , wherein executing the security screening includes blocking a further data packet from being transmitted to the client device.
15. The non-transitory computer-readable storage medium of claim 13 , wherein executing the security screening includes sending a warning message from the gateway device to the client device.
16. The non-transitory computer-readable storage medium of claim 13 , wherein executing the security screening includes using the gateway device to filter content of data received from the server.
17. The non-transitory computer-readable storage medium of claim 13 , wherein inspecting the decrypted information includes the deep packet inspection by the gateway device.
18. The non-transitory computer-readable storage medium of claim 12 , further comprising instructions executable to:
intercept one or more data packets transmitted according to a secured network protocol between the client device and the server while remaining transparent to the client device and the server;
maintain a first set of state information for the client device, the first set of state information including a sequence number of a last packet received by the client device; and
retransmit the last data packet corresponding to the sequence number to the client device based on the first set of state information.
19. The non-transitory computer-readable storage medium of claim 18 , wherein retransmitting the last data packet is also based on receiving a retransmission from the server.
20. A gateway apparatus for establishing a proxy-less communication session, the gateway apparatus comprising:
a memory;
a communication interface that communicates over a communication network to:
perform a first key exchange of a first public key with a server, and
perform a second key exchange of a second public key with a client device; and
a processor that executes instructions out of the memory to:
access a received data packet that includes information encrypted at the server using the first public key,
decrypt the encrypted information included in the data packet received from the server, wherein the decrypted information is inspected in accordance with deep packet inspection,
generate a first certificate that includes the first public key and a set of attributes associated with the client device,
store certificate details of the first certificate in the memory,
generate the encrypted data in response to an indication the decrypted information passes inspection, wherein the encrypted data are decrypted at the client device using the second public key, wherein the communication interface sends the first certificate including the encrypted data transparently to the client device, wherein sending the first certificate is also transparent to the server,
detect when to transmit the encrypted data based on transmission information communicated from the server and the client device and verification of the set of attributes associated with the client device, wherein the communication interface further:
sends the first certificate and the encrypted data transparently to the client device, wherein sending the first certificate is transparent to the server, and wherein the encrypted data is decrypted at the client device using the second public key,
receives a first acknowledgement from the client device acknowledging receipt of the encrypted data included in the data packet has been received, and
sends a second acknowledgement to the server based on the receipt of the first acknowledgement from the client device, wherein sending the second acknowledgement is transparent to the client device, and wherein the second acknowledgement indicating that the data packet has been received, and the second acknowledgement is not sent to the server until after the first acknowledgement is received from the client device indicating that the encrypted data included in the data packet has been received at the client device,
generate a second certificate for transmission to the client device that is a modified copy of the first certificate, wherein a public key of the second certificate is different from a public key of the first certificate, and wherein a remaining portion of the second certificate is identical to a remaining portion of the first certificate, and
establish the communication session between the client device and the server without a proxy based on an identification that the second certificate matches a previously trusted certificate, wherein flow control is provided for data transmitted between the client device and the server in the established communication session.