IPC분류정보
| 국가/구분 |
United States(US) Patent
등록
|
| 국제특허분류(IPC7판) |
|
| 출원번호 |
US-0320331
(2014-06-30)
|
| 등록번호 |
US-9742806
(2017-08-22)
|
|
발명자
/ 주소 |
- Rothstein, Jesse Abraham
- Mukerji, Arindum
- Schmitt, David D.
- Hughes, John R.
|
| 출원인 / 주소 |
|
| 대리인 / 주소 |
|
| 인용정보 |
피인용 횟수 :
0 인용 특허 :
106 |
초록
▼
A method, system, and apparatus are directed towards enabling access to payload by a third -party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the
A method, system, and apparatus are directed towards enabling access to payload by a third -party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the SSL handshake messages are routed through the proxy, the proxy may extract data. In addition, one of the client or the server may send another message within, or out-of-band to, the series of SSL handshake message directly to the proxy. The other SSL message may include secret data that the proxy may use to generate a session key the SSL connection. With the session key, the proxy may receive SSL messages over the SSL connection, modify and/or transpose the payload within the received SSL messages, and/or terminate the SSL connection at the proxy.
대표청구항
▼
1. A proxy device for managing an SSL session that is interposed between a first network device and a second network device, the proxy device, comprising: a transceiver to send and receive data over a network; anda processor that is operative to perform actions comprising: forwarding, at the proxy d
1. A proxy device for managing an SSL session that is interposed between a first network device and a second network device, the proxy device, comprising: a transceiver to send and receive data over a network; anda processor that is operative to perform actions comprising: forwarding, at the proxy device, SSL handshake messages between the first network device and the second network device, wherein the SSL handshake messages enable an SSL session to be established between the first network device and the second network device, and wherein the SSL session established between the first network device and the second network device includes a single SSL session;extracting data, at the proxy device, from at least one of the SSL handshake messages between the first network device and the second network device, wherein the at least one of the SSL handshake messages is separate from an acknowledgement (ACK) message or a synchronize (SYN) message;receiving, at the proxy device, a message that includes secret data associated with the SSL session;employing, in part, at the proxy device, the secret data to generate a session key associated with the SSL session;receiving an SSL message over the SSL session;decrypting a payload within the SSL message using the session key;transposing one or more portions of the decrypted payload within the SSL message; andproviding the transposed payload in another SSL message over the SSL session. 2. The proxy device of claim 1, wherein the actions further comprising: extracting other data from one or more of the SSL handshake messages between the first network device and the second network device; andemploying the other data with the secret data to generate the session key. 3. The proxy device of claim 1, wherein the other data further comprises randomly generated data. 4. The proxy device of claim 1, wherein the secret data further comprises one or more of a master secret or a pre-master secret associated with the SSL session. 5. The proxy device of claim 1, wherein the received message further comprises one or more of an SSL handshake record, an SSL alert message or a message sent out-of-band. 6. The proxy device of claim 1, the actions further comprising: modifying the decrypted payload;encrypting the modified payload using the session key; andproviding the modified payload over the SSL session. 7. The proxy device of claim 1, the actions further comprising: terminating the SSL session at the proxy device, wherein the terminated SSL session is between the first network device and the proxy device. 8. The proxy device of claim 1, wherein the first network device is a client device and the second network device is a traffic management device (TMD). 9. A system for managing an SSL communication over a network, comprising: a traffic management device (TMD) operative to perform actions comprising: receiving an SSL handshake message from a client device, wherein the received message further comprises one or more of an SSL handshake record, an SSL alert message or a message sent out-of-band;sending another SSL handshake message to the client device; andestablishing an SSL session with the client device based, in part, on the SSL handshake message and other SSL handshake message, wherein the SSL session includes a single SSL session between the TMD and the client device; anda proxy device interposed between the client device and the TMD, the proxy operative to perform actions comprising: forwarding SSL handshake messages between the client device and the TMD, wherein the SSL handshake messages enable an SSL session to be established between the client device and the TMD, and wherein the SSL session established between the client device and the TMD includes a single SSL session;extracting data from at least one of the SSL handshake messages between the client device and the TMD, wherein the at least one of the SSL handshake messages is separate from an acknowledgement (ACK) message or a synchronize (SYN) message;receiving a message that includes secret data associated with the SSL session;employing the secret data to generate a session key associated with the SSL session;receiving an SSL message over the SSL session; anddecrypting a payload within the SSL message using the session key. 10. The system of claim 9, wherein the actions further comprising: extracting other data from one or more of the SSL handshake messages between the client device and the TMD; andemploying the other data with the secret data to generate the session key. 11. The system of claim 9, wherein the other data further comprises randomly generated data. 12. The system of claim 9, wherein the secret data further comprises one or more of a master secret or a pre-master secret associated with the SSL session. 13. The system of claim 9, the actions further comprising: modifying the decrypted payload;encrypting the modified payload using the session key; andproviding the modified payload over the SSL session. 14. The system of claim 9, the actions further comprising: transposing one or more portions of the decrypted payload within the SSL message; andproviding the transposed payload in another SSL message over the SSL session. 15. The system of claim 9, the actions further comprising: terminating the SSL session at the proxy device, wherein the terminated SSL session is between the client device and the proxy device. 16. A method for managing an SSL connection, the method comprising: forwarding, at a proxy device, SSL handshake messages between a first network device and a second network device, wherein the SSL handshake messages enable an SSL session to be established between the first network device and the second network device, and wherein the SSL session established between the first network device and the second network device includes a single SSL session;extracting data, at the proxy device, from at least one of the SSL handshake messages between the first network device and the second network device, wherein the at least one of the SSL handshake messages is separate from an acknowledgement (ACK) message or a synchronize (SYN) message;receiving, at the proxy device, a message that includes secret data associated with the SSL session;employing, in part, at the proxy device, the secret data to generate a session key associated with the SSL session;receiving an SSL message over the SSL session;decrypting a payload within the SSL message using the session key;modifying, at the proxy device, the decrypted payload;encrypting, at the proxy device, the modified payload using the session key; andproviding, at the proxy device, the modified payload over the SSL session. 17. The method of claim 16, the actions further comprising: extracting, at the proxy device, other data from one or more of the SSL handshake messages between the first network device and the second network device; andemploying, at the proxy device, the other data with the secret data to generate the session key.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.