SYSTEM AND METHOD FOR OBSERVING ENCRYPTED TRAFFIC IN JAVA APPLICATIONS USING EBPF AND JAVA AGENT
A method for observing encrypted traffic in Java applications using eBPF and Java Agent is disclosed. The method includes providing the eBPF program to capture to capture encrypted data from kernel-level read and write operations, and/or Transfer Layer Security (TLS) generated key. The method also includes providing a Java agent to instrument functions involved in TLS key generation and to extract session secrets. Further, the method includes facilitating the Java agent to write session secrets to a non-persistent storage medium, such that the eBPF program reads session secrets from the non-persistent storage medium. Thereafter, the method includes providing a user-space program to receive the encrypted data and session secrets from the eBPF program and decrypt the data for analyzing and tracing the Java application.
1 . A system for observing encrypted traffic in Java applications using an extended Berkeley Packet Filter (eBPF) program and Java agent, the system comprising:
an eBPF program module to provide the eBPF program to capture at least one of: encrypted data from kernel-level read and write operations, and Transfer Layer Security (TLS) generated key;
a Java agent module to provide a Java agent to instrument functions involved in TLS key generation and to extract session secrets;
a storage module to facilitate the Java agent to write session secrets to a non-persistent storage medium, such that the eBPF program reads session secrets from the non-persistent storage medium; and
a user-space program module to provide a user-space program to receive the encrypted data and session secrets from the eBPF program and decrypt the data for analyzing and tracing the Java application.
2 . The system of claim 1 , wherein the non-persistent storage medium is associated with “/dev/null”, such that the Java agent writes the session secrets while minimizing impact and security concern.
3 . The system of claim 1 , wherein the eBPF program module maintains connection state information to correlate the encrypted data with the appropriate session secrets.
4 . The system of claim 1 , wherein the Java agent correspond to a lightweight program that instruments only the TLS key generation functions to minimize performance impact.
5 . The system of claim 4 , wherein the TLS key generation functions are part of the cryptography library and security provider used by the Java application, such that the TLS key generation functions are invoked once during initial SSL handshake of connection which minimizes performance impact due to being a one-time operation.
6 . The system of claim 1 , wherein the eBPF program operates at the kernel level to provide visibility independent of the application layer.
7 . The system of claim 1 , wherein the storage module further ensures the security of session secrets during extraction and transfer.
8 . The system of claim 1 , wherein the user-space program further includes functionality to analyze the decrypted data for at least one of: performance monitoring, security auditing, and troubleshooting purposes.
9 . A method for observing encrypted traffic in Java applications using an extended Berkeley Packet Filter (eBPF) program and Java agent, the method comprising:
providing the eBPF program to capture to at least one of: capture encrypted data from kernel-level read and write operations, and Transfer Layer Security (TLS) generated key;
providing a Java agent to instrument functions involved in TLS key generation and to extract session secrets;
facilitating the Java agent to write session secrets to a non-persistent storage medium, such that the eBPF program reads session secrets from the non-persistent storage medium; and
providing a user-space program to receive the encrypted data and session secrets from the eBPF program and decrypt the data for analyzing and tracing the Java application.
10 . The method of claim 9 , wherein the non-persistent storage medium is associated with “/dev/null”, such that the Java agent writes the session secrets while minimizing impact and security concern.
11 . The method of claim 9 , further comprises maintaining connection state information to correlate the encrypted data with the appropriate session secrets.
12 . The method of claim 9 , wherein the Java agent correspond to a lightweight program that instruments only the TLS key generation functions to minimize performance impact.
13 . The method of claim 12 , wherein the TLS key generation functions are part of the cryptography library and security provider used by the Java application, such that the TLS key generation functions are invoked once during initial SSL handshake of connection which minimizes performance impact due to being a one-time operation.
14 . The method of claim 9 , wherein the eBPF program operates at the kernel level to provide visibility independent of the application layer.
15 . The method of claim 9 , further comprise ensuring the security of session secrets during extraction and transfer.
16 . The method of claim 9 , wherein the user-space program further includes functionality to analyze the decrypted data for at least one of: performance monitoring, security auditing, and troubleshooting purposes.
17 . A computer program product including at least one non-transitory computer-readable storage medium having computer-executable program code portions stored therein, the computer program product is configured to:
provide the eBPF program to capture to at least one of: capture encrypted data from kernel-level read and write operations, and Transfer Layer Security (TLS) generated key;
provide a Java agent to instrument functions involved in TLS key generation and to extract session secrets;
facilitate the Java agent to write session secrets to a non-persistent storage medium, such that the eBPF program reads session secrets from the non-persistent storage medium; and
provide a user-space program to receive the encrypted data and session secrets from the eBPF program and decrypt the data for analyzing and tracing the Java application.
18 . The computer program product of claim 17 ,
wherein the non-persistent storage medium is associated with “/dev/null”, such that the Java agent writes the session secrets while minimizing impact and security concern;
wherein the Java agent correspond to a lightweight program that instruments only the TLS key generation functions to minimize performance impact;
wherein the TLS key generation functions are part of the cryptography library and security provider used by the Java application, such that the TLS key generation functions are invoked once during initial SSL handshake of connection which minimizes performance impact due to being a one-time operation;
wherein the eBPF program operates at the kernel level to provide visibility independent of the application layer; and
wherein the user-space program further includes functionality to analyze the decrypted data for at least one of: performance monitoring, security auditing, and troubleshooting purposes.
19 . The computer program product of claim 17 , further configured to maintain connection state information to correlate the encrypted data with the appropriate session secrets.
20 . The computer program product of claim 17 , further configured to ensure the security of session secrets during extraction and transfer.