Application-level service access to encrypted data streams
Techniques for securely providing cryptographic keys to trusted intermediate nodes or monitoring devices are described so that SSL, TLS, or IPSec communications can be monitored, compressed over a WAN, or otherwise used. In an embodiment, a trusted intermediate node establishes a secure connection to a key server; receiving session identification data for an encrypted session between a client and a content server during negotiation of the encrypted session, and storing a copy of the session identification data; requesting from the key server, over the secure connection, a decryption key associated with the encrypted session; receiving an encrypted message communicated between the client and the content server; forwarding the encrypted message without modification to a destination address in the encrypted message; and decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit.
1. An apparatus, comprising:
a first network interface that is configured to be coupled to a client computer through a first network;
one or more second network interfaces that are configured to be coupled to a content server and to a key server through one or more second networks;
wherein the first network interface and second network interface are configured to receive and forward all data communicated between the client and the content server;
a processor;
logic encoded in one or more non-transitory computer-readable media for operation on an intermediate node, and configured to perform:
establishing a secure connection from the intermediate node to the key server;
receiving session identification data for an encrypted session, between the client and the content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data;
based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server;
in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over the secure connection, a decryption key associated with the encrypted session;
receiving an encrypted message communicated between the client and the content server in the encrypted session;
decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit.
2. The apparatus of claim 1 , wherein the logic is further configured to cause the processor to perform compressing the decrypted data to result in creating compressed data; forwarding the compressed data across a wide area network to a trusted intermediate node.
3. The apparatus of claim 1 , wherein the encryption protocol is Secure Sockets Layer (SSL).
4. The apparatus of claim 1 , wherein the encryption protocol is Transport Layer Security (TLS).
5. The apparatus of claim 1 , wherein the key server is co-located with the content server.
6. The apparatus of claim 1 , wherein the first network and the one or more second networks each comprise different first and second local area networks respectively.
7. The apparatus of claim 1 , wherein the intermediate node comprises a first trusted intermediate node configured at an edge location in a wide area network, and wherein the key server is configured in a second trusted intermediate node at a core location of the wide area network.
8. The apparatus of claim 7 , wherein the second trusted intermediate node and the content server are within a single domain.
9. The apparatus of claim 1 , wherein the session identification data comprises any of (a) a Secure Sockets Layer (SSL) session identifier, or (b) a source network address, a destination network address, a source port number, and a destination port number, all obtained from a transport control protocol (TCP) header of the message.
10. The apparatus of claim 1 , wherein the logic configured for establishing a secure connection to the key server comprises logic configured for establishing an IPsec tunnel from the apparatus to the key server.
11. A non-transitory computer-readable storage medium storing one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:
establishing a secure connection from an intermediate node to a key server;
receiving session identification data for an encrypted session, between a client and a content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data;
based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server;
in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over the secure connection, a decryption key associated with the encrypted session;
receiving an encrypted message communicated between the client and the content server in the encrypted session;
forwarding the encrypted message without modification to the client or the content server according to a destination address in the encrypted message;
decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit.
12. The non-transitory computer-readable storage medium of claim 11 , further comprising instructions which, when executed, cause the one or more processors to perform:
compressing the decrypted data to result in creating compressed data;
forwarding the compressed data across a wide area network to a trusted intermediate node.
13. The non-transitory computer readable storage medium of claim 11 , wherein the encryption protocol is Secure Sockets Layer (SSL).
14. The non-transitory computer readable storage medium of claim 11 , wherein the encryption protocol is Transport Layer Security (TSL).
15. The non-transitory computer readable storage medium of claim 11 , wherein the key server is co-located with the content server.
16. The non-transitory computer readable storage medium of claim 11 , wherein the first network and the one or more second networks each comprise different first and second local area networks.
17. The non-transitory computer readable storage medium of claim 11 , wherein a first trusted intermediate node is configured at an edge location in a wide area network and wherein the key server is configured in a second trusted intermediate node at a core location of the wide area network.
18. The non-transitory computer readable storage medium of claim 17 , wherein the second trusted intermediate node and the content server are within a single domain.
19. The non-transitory computer readable storage medium of claim 11 , wherein the session identification data comprises any of (a) a Secure Sockets Layer (SSL) session identifier, or (b) a source network address, a destination address, a source port number, and a destination port number, all obtained from a transport control protocol (TCP) header of the message.
20. The non-transitory computer readable storage medium of claim 11 , wherein the logic configured for establishing a secure connection to the key server comprises logic configured for establishing an IPsec tunnel from the apparatus to the key server.
21. A computer-implemented method, comprising:
establishing a secure connection from an intermediate node to a key server;
receiving session identification data for an encrypted session between a client and a content server, during negotiation of the encrypted session between the client and the content server using an encryption protocol, and storing a copy of the session identification data;
based on intercepting an end-of-the-handshake message exchanged between the client and the content server, determining that the handshake communications resulted in successful establishing of the secure session between the client and the content server;
in response to intercepting the end-of-the-handshake message, requesting from the key server, and receiving from the key server over a secure connection, a decryption key associated with the encrypted session;
receiving an encrypted message communicated between the client and the content server in the encrypted session;
decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit;
wherein the method is performed by one or more computing devices.
22. The method of claim 21 , further comprising:
compressing the decrypted data to result in creating compressed data;
forwarding the compressed data across a wide area network to a trusted intermediate node.
23. The method of claim 21 , wherein the encryption protocol is Secure Sockets Layer (SSL).
24. The method of claim 21 , wherein the encryption protocol is Transport Layer Security (TLS).
25. The method of claim 21 , wherein the key server is co-located with the content server.
26. The method of claim 21 , wherein the first network and the one or more second networks each compromise different first and second local area networks respectively.
27. The method of claim 21 , further comprising:
configuring the intermediate node as a first trusted intermediate node at an edge location in a wide area network; and
configuring the key server in a second trusted intermediate node at a core location of the wide area network.
28. The method of claim 27 , wherein the second trusted intermediate node and the content server are within a single domain.
29. The method of claim 21 , wherein the session identification data comprises any of (a) a Secure Sockets Layer (SSL) session identifier, or (b) a source network address, a destination network address, a source port number, and a destination port number, all obtained from a transport control protocol (TCP) header of the message.
30. The method of claim 21 , further comprising:
establishing a secure connection to the key server by establishing an IPsec tunnel from the apparatus to the key server.