Methods, systems, and computer readable media for processing QUIC communications in a network
Methods, systems, and computer readable media for processing QUIC communications in a network. An example system includes a first network interface for receiving a QUIC connection request from a first node in the network and, in response, establishing a first QUIC connection between the first node and the system. The system includes a QUIC processing module configured for receiving, via the first QUIC connection, encrypted QUIC data including a number of streams and decrypting the encrypted QUIC data, resulting in decrypted QUIC data. The QUIC processing module is configured for extracting each of the streams from the decrypted QUIC data, resulting in a plurality of extracted streams, and packaging at least one of the extracted streams into a non-QUIC protocol format, resulting in at least one packaged stream. The system includes a second network interface for transmitting the packaged stream to a second node in the network.
1. A system for processing QUIC communications in a network, the system comprising:
a QUIC gateway including at least one processor, a client stub, and a server stub for establishing proxied QUIC communications between a client and a server;
the server stub for receiving a QUIC connection request from the client;
the QUIC gateway for modifying the QUIC connection request and forwarding the modified QUIC connection request to the server via the client stub;
wherein the client stub implements a client side of a QUIC handshake with the server to establish a first QUIC connection between the client stub and the server;
wherein the server stub implements a server side of a QUIC handshake with the server to establish a second QUIC connection between the server stub and the client;
wherein the QUIC gateway is configured for:
receiving, via the first QUIC connection, encrypted QUIC data comprising a plurality of streams;
decrypting the encrypted QUIC data, resulting in decrypted QUIC data;
extracting each of the streams from the decrypted QUIC data, resulting in a plurality of extracted streams;
packaging at least one of the extracted streams into a non-QUIC protocol format, resulting in at least one packaged stream;
re-encrypting the decrypted QUIC data and transmitting the re-encrypted QUIC data to the server via the client stub; and
a second network interface implemented on the QUIC gateway for transmitting the packaged stream to a network security tool, wherein the network security tool is configured to process the packaged stream in the non-QUIC protocol format and the network security tool comprises one or more of: a firewall, a deep packet inspection tool, an intrusion detection system (IDS), an intrusion prevention system (IPS), and a data leakage protection tool.
2. The system of claim 1 , wherein packaging at least one of the extracted streams into a non-QUIC protocol format comprises encapsulating the at least one of the extracted streams for transport by hypertext transfer protocol (HTTP) or hypertext transfer protocol secure (HTTPS).
3. The system of claim 1 , wherein the QUIC gateway is configured for packaging each of the extracted streams into a respective transport control protocol (TCP) connection.
4. The system of claim 1 , wherein the QUIC gateway is configured for collectively packaging the extracted streams into a same transport control protocol (TCP) connection.
5. The system of claim 1 wherein the QUIC gateway is configured to perform certificate forging using information copied from a security certificate of the server allow the QUIC gateway to operate as a man-in-the-middle proxy between the client and the server.
6. A method for processing QUIC communications in a network, the method comprising:
providing a QUIC gateway including a client stub and a server stub for establishing proxied QUIC communications between a client and a server;
receiving, by the server stub, a QUIC connection request from the client;
modifying, by the QUIC gateway, the QUIC connection request and forwarding the modified QUIC connection request to the server via the client stub;
implementing, by the client stub, a client side of a QUIC handshake with the server to establish a first QUIC connection between the client stub and the server;
implementing, by the server stub, a server side of a QUIC handshake with the server to establish a second QUIC connection between the server stub and the client;
receiving, by the QUIC gateway and via the first QUIC connection, encrypted QUIC data comprising a plurality of streams;
decrypting, by the QUIC gateway, the encrypted QUIC data, resulting in decrypted QUIC data;
extracting, by the QUIC gateway, each of the streams from the decrypted QUIC data, resulting in a plurality of extracted streams;
packaging, by the QUIC gateway, at least one of the extracted streams into a non-QUIC protocol format, resulting in at least one packaged stream;
transmitting, by the QUIC gateway, the packaged stream to network security tool, wherein the network security tool is configured to process the packaged stream in the non-QUIC protocol format and the network security tool comprises one or more of: a firewall, a deep packet inspection tool, an intrusion detection system (IDS), an intrusion prevention system (IPS), and a data leakage protection tool; and
re-encrypting, by the QUIC gateway, the decrypted QUIC data and transmitting the re-encrypted QUIC data to the server via the client stub.
7. The method of claim 6 , wherein packaging at least one of the extracted streams into a non-QUIC protocol format comprises encapsulating the at least one of the extracted streams for transport by hypertext transfer protocol (HTTP) or hypertext transfer protocol secure (HTTPS).
8. The method of claim 6 , comprising packaging each of the extracted streams into a respective transport control protocol (TCP) connection.
9. The method of claim 6 , comprising collectively packaging the extracted streams into a same transport control protocol (TCP) connection.
10. The method of claim 6 comprising performing, by the QUIC gateway, certificate forging using information copied from a security certificate of the server allow the QUIC gateway to operate as a man-in-the-middle proxy between the client and the server.
11. A non-transitory computer readable medium comprising computer executable instructions embodied in the non-transitory computer readable medium that when executed by at least one processor of at least one computer cause the at least one computer to perform steps comprising:
providing a QUIC gateway including a client stub and a server stub for establishing proxied QUIC communications between a client and a server;
receiving, by the server stub, a QUIC connection request from the client;
modifying, by the QUIC gateway, the QUIC connection request and forwarding the modified QUIC connection request to the server via the client stub;
implementing, by the client stub, a client side of a QUIC handshake with the server to establish a first QUIC connection between the client stub and the server;
implementing, by the server stub, a server side of a QUIC handshake with the server to establish a second QUIC connection between the server stub and the client;
receiving, by the QUIC gateway and via the first QUIC connection, encrypted QUIC data comprising a plurality of streams;
decrypting, by the QUIC gateway, the encrypted QUIC data, resulting in decrypted QUIC data;
extracting, by the QUIC gateway, each of the streams from the decrypted QUIC data, resulting in a plurality of extracted streams;
packaging, by the QUIC gateway, at least one of the extracted streams into a non-QUIC protocol format, resulting in at least one packaged stream;
transmitting the packaged stream to a network security tool, wherein the network security tool is configured to process the packaged stream in the non-QUIC protocol format and the network security tool comprises one or more of: a firewall, a deep packet inspection tool, an intrusion detection system (IDS), an intrusion prevention system (IPS), and a data leakage protection tool; and
re-encrypting, by the QUIC gateway, the decrypted QUIC data and transmitting the re-encrypted QUIC data to the server via the client stub.
12. The non-transitory computer readable medium of claim 11 , wherein packaging at least one of the extracted streams into a non-QUIC protocol format comprises encapsulating the at least one of the extracted streams for transport by hypertext transfer protocol (HTTP) or hypertext transfer protocol secure (HTTPS).
13. The non-transitory computer readable medium of claim 11 comprising performing, by the QUIC gateway, certificate forging using information copied from a security certificate of the server allow the QUIC gateway to operate as a man-in-the-middle proxy between the client and the server.