Access to content of encrypted data session
Methods, terminal and a data center gateway are provided for allowing efficient debugging and troubleshooting of data session encrypted with Perfect Forward Secrecy (PFS) encryption techniques such as for example the Transport Layer Security (TLS) protocol version 1.3. Embodiments of the invention allow the user terminal to authorize a data center gateway to persistently store one or more encryption keys associated with the data session for use to access the recorded data session and troubleshooting it after the session ended, when faults are detected. When a fault is detected, the user terminal provides authorization to the gateway to persistently store the data session along with one or more encryption key(s). With this, the gateway allows for the data session to be later decrypted and faults to be investigated despite the data session being encrypted with PFS techniques.
1. A method in a terminal for authorizing storage of security keys, the method comprising:
detecting by the terminal a fault with a data session encrypted with a Perfect Forward Secrecy (PFS) encryption technique, the data session extending at least between the terminal and a data center gateway;
obtaining an authorization for storing the security keys, the obtaining triggered by the detected fault with the data session encrypted with the PFS encryption technique; and
responsive to detecting the fault, sending from the terminal to the gateway a message with the authorization to authorize the data center gateway to persistently store one or more security keys associated with the data session, in view of troubleshooting the fault.
2. The method of claim 1 , wherein the message further comprises an indication of the fault.
3. The method of claim 1 , wherein the step of detecting the fault comprises receiving from the data center gateway information about the fault.
4. The method of claim 1 , wherein the data session is a Hyper Text Transfer Protocol (HTTP) data session encrypted with a Transport Layer Security (TLS) protocol.
5. A method in a gateway for authorizing storage of security keys, the method comprising:
responsive to detecting a fault with a data session encrypted with a Perfect Forward Secrecy (PFS) encryption technique, the data session extending at least between the terminal and the data center gateway, receiving a message with an authorization to authorize the data center gateway to persistently store one or more security keys associated with the data session, in view of troubleshooting the fault with the data session encrypted with the PFS encryption technique;
instructing the storing of the security key associated with the data session; and
storing the security keys based on the received authorization.
6. The method of claim 5 , wherein the message further comprises an indication of the fault.
7. The method of claim 5 , wherein detecting the fault is performed by the terminal.
8. The method of claim 5 , wherein detecting the fault is performed by the data center gateway.
9. The method of claim 5 , wherein the data session is a Hyper Text Transfer Protocol (HTTP) data session encrypted with a Transport Layer Security (TLS) protocol.
10. A terminal comprising circuitry configured to:
authorize storage of security keys;
detect a fault with a data session encrypted with a Perfect Forward Secrecy (PFS) encryption technique, the data session extending at least between the terminal and a data center gateway;
obtain an authorization for storing the security keys, the obtaining triggered by the detected fault with the data session encrypted with the PFS encryption technique; and
responsive to detecting the fault, send to the gateway a message with the authorization to authorize the data center gateway to persistently store one or more security keys associated with the data session, in view of troubleshooting the fault.
11. The terminal of claim 10 , wherein the message further comprises an indication of the fault.
12. The terminal of claim 10 , wherein the detecting the fault comprises receiving from the data center gateway information about the fault.
13. The terminal of claim 10 , wherein the data session is a Hyper Text Transfer Protocol (HTTP) data session encrypted with a Transport Layer Security protocol.
14. A data center gateway comprising circuitry configured to:
authorize storage of security keys responsive to detecting a fault with a data session encrypted with a Perfect Forward Secrecy (PFS) encryption technique, the data session extending at least between the terminal and the data center gateway, receive a message with an authorization to authorize the data center gateway to persistently store one or more security keys associated with the data session, in view of troubleshooting the fault with the data session encrypted with the PFS encryption technique; and
store the security keys based on the received user authorization.
15. The data center gateway of claim 14 , wherein the message further comprises an indication of the fault.
16. The data center gateway of claim 14 , wherein detecting the fault is performed by the data center gateway.
17. The data center gateway of claim 14 , wherein the data session is a Hyper Text Transfer Protocol (HTTP) data session encrypted with a Transport Layer Security (TLS) protocol.