Encrypted packet inspection

• US 20030018891A1
• Filed: 06/07/2002
• Published: 01/23/2003
• Est. Priority Date: 06/26/2001
• Status: Active Grant

• Current Assignee: Ncipher Security Limited
• Original Assignee: nCipher Corporation Limited (Thales SA)
• Inventors: Mitchell, Oscar R., Hall, Rick
• Granted Patent: US 7,900,042 B2
• Time in Patent Office: Days
• US Class Current: 713/160
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A method, system, and device for encrypted packet inspection allowing an authorized third party device to monitor cryptographic handshaking information (full-duplex) between two other devices and together with the secret private key then transparently decrypt the bulk encrypted data stream.

The scope of this invention encompasses many applications, three examples of which are firewalls, load balancers, and local network caches. Additionally, this invention achieves and contributes to the efficient handling of encrypted information in other ways, three examples of which are making switching, routing, and security decisions.

Claims

1. An encrypted packet inspection (EPI) method, comprising:

noninvasively receiving, as an authorized third party, an encrypted packet, the packet being sent in a cryptographic session from a first computing device and addressed to a second computing device; and

decrypting the encrypted packet, whereby a plaintext packet results.

2. The method of claim 1, further comprising sending the plaintext packet responsively to a request from a third computing device.

3. The method of claim 1, further comprising sending the plaintext packet automatically to a third computing device.

4. The method of claim 1, further comprising monitoring the first and second computing devices'"'"' cryptographic handshaking information as an authorized third party to ascertain symmetric keys to be used for bulk encryption, whereby the cryptographic session is created.

5. The method of claim 4, wherein the receiving, the decrypting, and the monitoring are performed within the context of a firewall.

6. The method of claim 5, further comprising applying layer 5-7 intrusion detection tools to the plaintext.

7. The method of claim 5, further comprising applying URL blocking to the plaintext.

8. The method of claim 5, further comprising applying URL tracking to the plaintext.

9. The method of claim 4, wherein the receiving, the decrypting, and the monitoring are performed within the context of a load balancer.

10. The method of claim 9, further comprising making load balancing decisions based on the plaintext.

11. The method of claim 10, wherein the plaintext includes cookie information.

12. The method of claim 10, wherein the plaintext includes URL information.

13. The method of claim 4, wherein the receiving, the decrypting, and the monitoring are performed within the context of a local network caching system.

14. The method of claim 13, further comprising monitoring the cryptographic session for content cache hits without terminating the cryptographic session.

15. The method of claim 4, further comprising transmitting new content in the middle of the cryptographic session without awareness by either the first computing device or the second computing device.

16. The method of claim 4, wherein the cryptographic handshaking is SSL/TLS handshaking and wherein the cryptographic session is a SSL/TLS session.

17. The method of claim 4, wherein the cryptographic handshaking is IPSec handshaking and wherein the cryptographic session is an IPSec session.

19. The system of claim 18, wherein the EPI device operates within a firewall.

20. The system of claim 18, wherein the EPI device operates within a load balancer.

21. The system of claim 18, wherein the EPI device operates within a local network caching system.

22. The system of claim 18, wherein the cryptographic session includes an SSL/TLS session.

24. The system of claim 23, further comprising:

a table configured to hold the first computing device'"'"'s and the second computing device'"'"'s private keys;

wherein the EPI device is configured to access the table to decrypt incoming packets with the appropriate symmetric key to stay in sync; and

wherein the EPI device is further configured to encrypt outgoing packets with the appropriate symmetric key to stay in sync.

25. The system of claim 24, wherein the EPI device operates within a firewall.

26. The system of claim 24, wherein the EPI device operates within a load balancer.

27. The system of claim 24, wherein the EPI device operates within a local network caching system.

28. The system of claim 24, wherein the cryptographic session includes an SSL/TLS session.

18. An encrypted packet inspection (EPI) system comprising:

an EPI device;

a system application circuitry;

a first computing device;

a second computing device;

wherein the first and second computing devices are configured to establish a cryptographic session and to send and receive encrypted information over the cryptographic session;

wherein the cryptographic session passes through the system application circuitry;

wherein the EPI device is configured to receive communications of the cryptographic session;

wherein the EPI device is configured to decrypt encrypted communications of the cryptographic session, producing plaintext; and

wherein the EPI device sends the plaintext to the system application circuitry.

23. An encrypted packet inspection (EPI) system comprising:

a first computing device;

a second computing device;

an EPI device;

a system application circuitry including a content cache configured to provide cache inserted content;

wherein the first computing device and the second computing device are configured to establish an cryptographic session;

wherein the EPI device is configured to intermediate the cryptographic session;

wherein the EPI device is configured to decrypt encrypted packets communicated in the cryptographic session, producing plaintext;

wherein the EPI device is configured to send the plaintext to the system application circuitry; and

wherein the system application circuitry is configured to send the plaintext and cache inserted text to the EPI device.