Probe Association for Tracing TLS Functions via Pointers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Tracing, tracking, and monitoring API calls in encrypted connections, such as TLS connections, are challenging due to encrypted binary data hiding application-layer information like process IDs and file descriptors, making it difficult to hook probes effectively.
Innovation Solution
A system utilizing a receiver module, pointer identification module, and probe association module to associate probes with functions based on pointers, enabling tracing, tracking, and monitoring across the lifecycle of encrypted connections, independent of operating system versions, using eBPF programs like eBPF uprobe and kprobe.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If probes are hooked to functions based on file descriptors in encrypted connections, then tracing and monitoring can be performed, but application-layer information is hidden due to encryption making file descriptor determination challenging
Solution Approach 1:
Instead of trying to extract file descriptors from encrypted data (which is hidden), the patent inverts the approach by injecting probes directly into the function's execution flow using memory address manipulation. The probe association module associates probes with functions by directly accessing function memory addresses rather than through file descriptors, thereby bypassing the encryption barrier entirely.
Solution Approach 2:
The patent introduces an intermediary mechanism (the pointer association module and probe association module) that bridges the gap between encrypted data and probe injection. By using pointers as an intermediary to access function memory addresses directly, the system can associate probes with functions without needing to decrypt or interpret encrypted application-layer information.
2Adaptability or versatility
If probes are associated with functions using memory addresses, then operating system version independence is achieved, but determining the correct file descriptor becomes more challenging
Solution Approach 1:
The patent extracts the file descriptor determination step from the probe association process. By directly accessing function memory addresses and associating probes through pointer manipulation rather than file descriptor lookup, the system removes the challenging file descriptor determination step entirely. This extraction enables operating system version independence while avoiding the complexity of file descriptor mapping.
3Reliability
If encryption is used to secure connections, then data security is improved, but application-layer information including process ID and file descriptor becomes invisible to monitoring tools
Solution Approach 1:
The patent transitions from monitoring at the network/data layer (where encryption hides information) to monitoring at the memory/executable layer. By injecting probes directly into function execution and accessing information at the memory address level, the system retrieves application-layer information from a different dimension that is not affected by cryptographic encryption.
Data Source
AI summary
A method for associating probe to function in an encrypted connection initiated by the function is disclosed. The method includes receiving data pertaining to an encrypted connection initiated by a function compliant to a secure communication protocol. Next, the method includes identifying a pointer of a structure holding details associated with the initiated encrypted connection. Thereafter, the method includes associating a probe to the function based on the pointer to trace, track, and monitor the function.