Proxy-less secure sockets layer (SSL) data inspection
View Patent ↗Some embodiments of proxy-less Secure Sockets Layer (SSL) data inspection have been presented. In one embodiment, a secured connection according to a secured network protocol between a client and a responder is setup via a gateway device, which is coupled between the client and the responder. The gateway device transparently intercepts data transmitted according to the secured network protocol between the client and the responder. Furthermore, the gateway device provides flow-control and retransmission of one or more data packets of the data without self-scheduling the packet retransmissions using timeouts and based on the packet retransmission logic of either the client-side or the responder side of the connection. The gateway device is further operable to perform security screening on the data.
1. A computer-implemented method for performing proxy-less data inspection, the method comprising:
intercepting at a gateway device a connection request for a secured connection between a client and a responder; and
executing a set of instructions stored in memory of the gateway device, wherein execution of the instructions by a processor of the gateway device:
sets up the secured connection according to a secured network protocol between the client and the responder by:
passing the connection request to an internal secured endpoint on the gateway device,
requesting a first certificate from the responder in response to intercepting the connection request,
receiving the first certificate from the responder, and
establishing the secured connection with a second certificate that is a modified copy of the first certificate received from the responder, wherein a public key of the second certificate is different from a public key of the first certificate, and wherein a remaining portion of the second certificate is identical to a remaining portion of the first certificate; and
intercepts data transmitted according to the secured network protocol between the client and the responder while remaining transparent to the client and the responder, wherein remaining transparent includes performing flow-control and retransmission of one or more data packets of the data without self-scheduling the packet transmissions using retransmission timeouts at the gateway device, and wherein performing the flow-control and retransmission includes:
maintaining a first transmission control protocol (TCP) state at the gateway device for the client and maintaining a second TCP state at the gateway device for the responder, wherein the first TCP state includes a sequence number of the last packet received by the client and the second TCP state includes a sequence number of the last packet received by the responder,
retransmitting a data packet to the client based on receiving a retransmission from the responder and based on the gateway device not using retransmission timeouts, and
retransmitting a data packet to the responder based on receiving a retransmission from the client and based on the gateway device not using retransmission timeouts; and performs security screening on the intercepted data.
2. The method of claim 1 , wherein further execution of the instructions by the processor of the gateway device:
detects an attempt by the client to negotiate for the secured connection according to the secured network protocol; and
initiates the secured connection according to the secured network protocol from the client to the responder.
3. The method of claim 2 , wherein establishing the secured connection includes:
storing details of the first certificate in memory;
completing key exchange with the responder; and
completing certificate and key exchange with the client.
4. The method of claim 3 , wherein completing certificate and key exchange with the client includes:
generating the remaining portion of the second certificate that is identical to the remaining portion of the first certificate from the responder;
inserting the second certificate public key into the second certificate to replace the first certificate public key in the first certificate, wherein the gateway device has a private key corresponding to each public key; and
signing the second certificate with a third certificate from a third party trusted by the client as a signing authority.
5. The method of claim 4 , wherein further execution of the instructions by the processor of the gateway device:
pre-generates the public key along with a corresponding private key pair; and
inserts the same public key into one or more certificates generated at the gateway device subsequent to the second certificate rather than generating a new public/private key pair for every newly generated certificate.
6. The method of claim 1 , wherein the security screening includes:
decrypting the data using a private key stored at the gateway device; and
performing deep packet inspection on the decrypted data.
7. The method of claim 1 , wherein the security screening includes:
decrypting the data using a private key stored at the gateway device;
and performing content filtering on the decrypted data.
8. The method of claim 1 , wherein the secured network protocol is a Secure Sockets Layer-based protocol.
9. A gateway device, comprising:
a first internal secured connection endpoint communicatively coupled to a client over an internal network, the first internal secured connection endpoint set up by:
intercepting a connection request for a secured connection from the client to a responder,
requesting a first certificate from the responder,
receiving the first certificate from the responder, and
establishing the secured connection with a second certificate that is a modified copy of the first certificate, wherein a public key of the second certificate is different from a public key of the first certificate, and wherein a remaining portion of the second certificate is identical to a remaining portion of the first certificate;
a second internal secured connection endpoint communicatively coupled to the responder over an external network, wherein the first and second internal secured connection endpoints transparently intercept data transmitted between the client and the responder according to a secured network protocol between the client and the responder; and
a processor that executes instructions stored in memory, wherein execution of the instructions:
performs flow-control and retransmission of one or more data packets of the data without the gateway device using retransmission timeouts wherein performing the flow-control and retransmission includes:
maintaining a first transmission control protocol (TCP) state at the gateway device for the client and maintaining a second TCP state at the gateway device for the responder, wherein the first TCP state includes a sequence number of the last packet received by the client and the second TCP state includes a sequence number of the last packet received by the responder,
retransmitting a data packet to the client based on receiving a retransmission from the responder and based on the gateway device not using retransmission timeouts, and
retransmitting a data packet to the responder based on receiving a retransmission from the responder and based on the gateway device not using retransmission timeouts, and
identifies that the client is to be blocked from receiving a file corresponding to the data.
10. The gateway device of claim 9 , wherein the first internal secured connection endpoint detects an attempt by the client to negotiate for a secured connection according to a secured network protocol, and the first internal secured connection endpoint initiates the secured connection according to the secured network protocol via the second internal secured connection endpoint responsive to the attempt.
11. The gateway device of claim 10 , wherein the secured network protocol is a Secure Sockets Layer-based protocol.
12. The gateway device of claim 10 , wherein the first internal secured connection endpoint completes certificate and key exchange with the client and the second internal secured connection endpoint receives the first certificate from the responder, stores details of the first certificate in a storage device, and completes key exchange with the responder.
13. The gateway device of claim 12 , wherein the second internal secured connection endpoint:
generates the remaining portion of the second certificate that is identical to the remaining portion of the first certificate from the responder using the details stored in the storage device;
inserts the second certificate public key into the second certificate to replace the first certificate public key in the first certificate; and
signs the second certificate with a third certificate from a third party trusted by the client as a signing authority, wherein the storage device further stores a private key corresponding to each public key.
14. The gateway device of claim 13 , wherein the public key is pre-generated on the gateway device along with its corresponding private key pair, and the same public key is inserted into one or more certificates generated subsequent to the second certificate by the gateway device rather than the gateway device generating a new public/private key pair for every certificate generated subsequent to the second certificate.
15. The gateway device of claim 9 , wherein the processor identifies that the client is to be blocked from receiving a file corresponding to the data based on deep packet inspection.
16. The gateway device of claim 9 , wherein determines that the client is to be blocked from receiving a file corresponding to the data based on content filtering.
17. A non-transitory computer-readable storage medium having instructions embodied thereon, the instructions executable by a processor of a gateway device communicatively coupled between a client and a responder to perform a method of proxy-less data inspection, the method comprising:
intercepting at a gateway device a connection request for a secured connection between the client and the responder;
setting up the secured connection between the client and the responder according to a secured network protocol by:
passing the connection request to an internal secured endpoint on the gateway device,
requesting a first certificate from the responder in response to intercepting the connection request,
receiving the first certificate from the responder, and
establishing the secured connection with a second certificate that is a modified copy of the first certificate received from the responder, wherein a public key of the second certificate is different from a public key of the first certificate, and wherein a remaining portion of the second certificate is identical to a remaining portion of the first certificate; and
intercepting data transmitted according to the secured network protocol between the client and the responder while remaining transparent to the client and the responder, wherein remaining transparent includes performing flow-control and retransmission of one or more data packets of the data self-scheduling the packet transmissions using retransmission timeouts at the gateway device, and wherein performing the flow-control and retransmission includes:
maintaining a first transmission control protocol (TCP) state at the gateway device for the client and maintaining a second TCP state at the gateway device for the responder, wherein the first TCP state includes a sequence number of the last packet received by the client and the second TCP state includes a sequence number of the last packet received by the responder,
retransmitting a data packet to the client based on receiving a retransmission from the responder and based on the gateway device not using retransmission timeouts, and
retransmitting a data packet to the responder based on receiving a retransmission from the client and based on the gateway device not using retransmission timeouts; and
performing security screening on the intercepted data.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the method further comprises:
detecting an attempt by the client to negotiate for the secured connection according to the secured network protocol; and
initiating the secured connection according to the secured network protocol from the client to the responder.
19. The non-transitory computer-readable storage medium of claim 18 , wherein establishing the secured connection includes:
storing details of the first certificate in a storage device of the gateway device;
completing key exchange with the responder; and
completing certificate and key exchange with the client.
20. The non-transitory computer-readable storage medium of claim 19 , wherein completing certificate and key exchange with the client includes:
generating the remaining portion of the second certificate identical to the remaining portion of the first certificate from the responder;
inserting the second certificate public key into the second certificate to replace the first certificate public key in the first certificate, wherein the gateway device has a private key corresponding to each public key; and
signing the second certificate with a third certificate from a third party trusted by the client as a signing authority.
21. The non-transitory computer-readable storage medium of claim 20 , wherein the method further comprises:
pre-generating the public key along with a corresponding private key pair; and
inserting the same public key into one or more certificates generated at the gateway device subsequent to the second certificate rather than generating a new public/private key pair for every newly generated certificate.
22. The non-transitory computer-readable storage medium of claim 17 , wherein performing security screening on the data includes:
decrypting the data at the gateway device using a private key stored at the gateway device; and
performing deep packet inspection on the decrypted data at the gateway device.
23. The non-transitory computer-readable storage medium of claim 17 , wherein performing security screening on the data includes:
decrypting the data at the gateway device using a private key stored at the gateway device; and
performing content filtering on the decrypted data at the gateway device.
24. The non-transitory computer-readable storage medium of claim 17 , wherein the secured network protocol is a Secure Sockets Layer-based protocol.