SSL/TLS Proxy Selective Decryption for Efficient Inspection

The patent segments the set of all SSL/TLS communications into two distinct groups: those requiring decryption for security inspection and those that should remain encrypted. This segmentation is achieved through analyzing application-level information (URIs, domain names) during the TLS handshake to identify which communications match security policies. By dividing the workload in this way, the proxy only performs computationally intensive decryption operations on necessary communications rather than all communications, thus resolving the contradiction between security inspection capability and computational resource consumption.

The patent applies partial action by performing decryption only on the subset of communications that require security inspection, rather than applying decryption universally to all communications. The proxy examines application-level information during the TLS handshake and selectively applies decryption logic only to matching communications. This partial approach maintains adequate security inspection capability while significantly reducing unnecessary computational resource consumption and improving overall network performance.

The patent segments communications into decrypted and encrypted streams based on policy matching. By using application-level information (URIs, domain names) available during the TLS handshake, the proxy identifies which communications require inspection and separates them from those that don't. This segmentation allows normal encrypted traffic to flow through the proxy without decryption overhead, maintaining network performance, while still providing security inspection for the segmented subset of communications that match security policies.

The patent implements partial decryption action by applying decryption only to communications that match security inspection criteria. The proxy analyzes application-level information during the TLS handshake and selectively decrypts only those communications requiring inspection. This partial approach eliminates the performance penalty of decrypting all traffic while preserving the ability to inspect communications that are relevant to security policies, thus resolving the contradiction between security inspection capability and network performance.

The patent segments the inspection process into two distinct paths: one for communications requiring decryption based on application-level information matching, and another for communications that remain encrypted. The proxy uses structured policy definitions with specific matching criteria (URIs, domain names) to segment traffic appropriately. This segmentation maintains inspection accuracy for relevant communications while simplifying the overall system by avoiding the need to decrypt and inspect all traffic, thereby reducing device complexity and configuration overhead.

The patent applies partial decryption by selectively decrypting only communications that match security inspection criteria defined through application-level information. The proxy uses policy-based matching on URIs, domain names, and other application-level data to determine which communications require inspection. This partial approach maintains adequate inspection accuracy for target communications while significantly reducing device complexity compared to universal decryption, as the proxy only needs to maintain decryption capabilities for the subset of traffic that requires inspection.

The patent segments communications into those requiring security monitoring and those requiring privacy protection. By analyzing application-level information (URIs, domain names) during the TLS handshake, the proxy identifies which communications should be decrypted for security inspection and which should remain encrypted for privacy protection. This segmentation ensures that security monitoring is applied only where necessary while preserving privacy for communications that don't match security policies, thus resolving the contradiction between security monitoring and privacy protection.

The patent implements partial decryption by decrypting only the subset of communications that match security inspection criteria. The proxy uses policy-based matching on application-level information to determine which communications require security monitoring. Communications that match policies are decrypted for inspection, while those that don't match remain encrypted, preserving privacy. This partial approach maintains adequate security monitoring capability while protecting the privacy of communications that don't require inspection, resolving the contradiction between security monitoring and privacy protection.