Inline SSL Inspection Bypassing TCP Stack
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL man-in-the-middle inspection systems are inefficient due to the need for SSL packets to bounce back and forth between the kernel, SSL proxy, and inspection module, leading to overhead from socket API usage and resource contention, as well as mismatched cipher suites and TCP sequence numbers in SSL sessions.
Innovation Solution
An inline SSL inspection system that directly receives and decrypts encrypted packets, bypassing the TCP stack and socket API, and tailors cipher suites and certificates to match those of the SSL server, allowing for direct transmission of decrypted packets without re-encryption, thereby maintaining consistent TCP sequence numbers and improving inspection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL man-in-the-middle inspection is performed using a transparent SSL proxy, then SSL packet decryption and inspection can be achieved, but the system efficiency deteriorates due to packet bouncing between kernel, SSL proxy, and inspection module
Solution Approach 1:
The patent merges the SSL decryption function and inspection function into a single integrated module. The inspection module directly decrypts SSL packets using session keys obtained during the SSL handshake, eliminating the need for separate SSL proxy components. This consolidation removes the packet bouncing between multiple components (kernel → SSL proxy → inspection module → SSL proxy → kernel) and replaces it with a direct flow (kernel → inspection module → kernel), thereby maintaining inspection capability while significantly improving processing efficiency.
2Reliability
If a full-function SSL proxy is used to establish SSL connections and encrypt/decrypt packets, then complete SSL inspection functionality is achieved, but device complexity and resource contention increase due to socket API overhead
Solution Approach 1:
The patent extracts the essential SSL decryption functionality from the complex full-function SSL proxy architecture. Instead of implementing a complete SSL proxy that handles connection establishment, encryption, and decryption separately, the inspection module directly obtains session keys during the SSL handshake and performs only the necessary decryption operations. This extraction removes unnecessary components and simplifies the system architecture while maintaining the core inspection capability.
Solution Approach 2:
The patent introduces a simplified intermediary mechanism where the inspection module acts as a direct intermediary between the kernel and the SSL traffic flow. Rather than using a full SSL proxy as an intermediary that requires socket APIs and complex state management, the inspection module directly intercepts packets from the kernel, decrypts them using obtained session keys, performs inspection, and returns results to the kernel. This streamlined intermediary approach reduces device complexity and eliminates socket API overhead.
3Loss of information
If SSL proxy decrypts packets and sends to inspection module, then encrypted traffic can be inspected, but loss of time occurs due to multiple packet redirections and re-encryptions
Solution Approach 1:
The patent applies preliminary action by obtaining the SSL session key during the SSL handshake phase before actual data transmission begins. The inspection module captures the premaster secret or session key when the SSL connection is initially established, stores it securely, and uses it for subsequent decryption operations. This preliminary acquisition of decryption credentials eliminates the need for repeated key exchange operations during data transmission, significantly reducing packet processing time while ensuring complete inspection capability.
Data Source
AI summary
Systems and methods for inline security protocol inspection are provided. According to one embodiment, a security device receives an encrypted packet from a first network appliance and buffers the encrypted packet in a buffer. An inspection module accesses the encrypted packet from the buffer, decrypts the encrypted packet to produce plain text and scans the plain text by the inspection module.