SSL Decryption Offloading to User Mode Key Agent

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software is inadequate for efficiently processing and filtering unwanted encrypted data traffic, particularly in firewalls that require deep packet inspection, as it is designed for traditional server-to-client communication and struggles with the computational expense of decrypting SSL data packets.

Innovation Solution

A method and system that decrypts SSL pre-master keys in a computing environment with user and kernel modes by sending asymmetric encrypted pre-master keys from a kernel-mode driver to a user-mode key agent for decryption, allowing for efficient decryption and inspection of encrypted packets, utilizing multiple decryption threads and error handling mechanisms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If SSL data packets are decrypted for deep packet inspection in firewall, then the ability to filter unwanted encrypted traffic is improved, but the computational expense and processing time increase significantly

Engineering Contradiction:

Improvepacket inspection capabilityVSAvoiddecryption processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The SSL decryption process is segmented into distinct phases: asymmetric decryption of the pre-master key is separated from symmetric decryption of actual data packets. This allows the computationally intensive asymmetric operations to be handled separately and efficiently, reducing overall processing time while maintaining deep packet inspection capabilities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The pre-master key is decrypted in advance during the SSL handshake phase before actual data transmission begins. By completing the expensive asymmetric decryption operation beforehand, the system avoids repeating this computation for every data packet, significantly reducing processing time during active inspection.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If traditional SSL software is used for encrypted traffic filtering, then server-to-client communication is supported, but efficiency in processing unwanted encrypted traffic is inadequate

Engineering Contradiction:

Improvecommunication mode supportVSAvoidencrypted traffic processing efficiency

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The firewall SSL inspection module is designed to handle multiple communication scenarios including server-to-client, client-to-server, and peer-to-peer encrypted traffic. The same decryption and inspection mechanisms work across different SSL/TLS versions and encryption algorithms, providing universal functionality while maintaining high processing efficiency through optimized cryptographic operations.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS8898451B2Method and system for monitoring encrypted data transmissions

Publication Date: 2014.11.25 TREND MICRO INC

AI summary

A method for efficiently decrypting asymmetric SSL pre-master keys is divided into a key agent component that runs in user mode, and an SSL driver running in kernel mode. The key agent can take advantage of multiple threads for decoding keys in a multi-processor environment, while the SSL driver handles the task of symmetric decryption of the SSL encrypted data stream. The method is of advantage in applications such as firewalls with deep packet inspection in which all encrypted data traffic passing through the firewall must be decrypted for inspection.