A 10 Networks, Incorporated

Xuyang Jiang

Ali Golshan

Yang Yang

Takaaki Ishii

Masataka Noro

Stephen Bafico

Provided are methods and systems for intercepting encrypted data packets. A system for intercepting encrypted data packets includes a first device and a second device. The first device serves a client-side data traffic associated with a client device and the second device serves a server-side data traffic associated with a server. The first device is configured to intercept at least one encrypted data packet. The first device is further configured to decrypt the encrypted packet to produce at least one decrypted data packet. The first device provides the decrypted data packet to one or more monitoring devices for inspection of the decrypted data packet. The second device is configured to receive, from the one or more monitoring devices, the at least one decrypted data packet. The second device is further operable to re-encrypt the decrypted data packet to produce the at least one encrypted data packet.

Implementing and optimizing secure socket layer intercept

Provided are methods and systems for caching network generated security certificates. An example system may include a security gateway node and a storage module. The security gateway node may be operable to receive, from a client, a session request to establish a secure connection with a server. Based on the session request, the security gateway node may establish a first secure session between the client and the security gateway node and a second secure session between the security gateway node and the server. The security gateway node may receive a server certificate from the server. The security gateway node may match the server certificate against a gateway certificate table. Based on the matching, the security gateway node may receive a gateway certificate associated with the gateway certificate entry that matches the server certificate. The gateway certificate may be used for performing the first secure session.

Caching network generated security certificates

Provided are a method and a system for intercepting secure shell (SSH) sessions. The method may commence with intercepting, by a client-facing SSH gateway, a session request to establish an SSH session between a client and a server. The method may continue with establishing a first SSH session between the client and the client-facing SSH gateway and receiving encrypted data packets of the SSH session from the client via the first SSH session. The client-facing SSH gateway may decrypt the encrypted data packets, establish a communication session with a server-facing SSH gateway, and forward decrypted data packets to the server-facing SSH gateway via the communication session. The server-facing SSH gateway may receive the decrypted data packets, establish a second SSH session between the server-facing SSH gateway and the server, encrypt the decrypted data packets, and forward the encrypted data packets to the server via the second SSH session.

Interception of secure shell communication sessions

Provided are a method and a system for exchanging control information between secure socket layer (SSL) gateways. The method may commence with intercepting, by a client facing node, a client request including session-specific information and a session request to establish an SSL communication session between a client and a server. The method may continue with generating an SSL extension based on the session-specific information and adding the SSL extension to the session request to obtain an extended session request. The extended session request may be sent to a server facing node in communication with the client facing node. The method may further include identifying the session-specific information contained in the SSL extension of the extended session request and generating a further session request for establishing the SSL communication session between the server facing node and the server. The method may further include sending the further session request to the server.

Exchange of control information between secure socket layer gateways

Provided are methods and systems for inspecting secure data. A system for inspecting secure data comprises a server facing module, and a client facing module in communication with the server facing module. The client facing module is operable to intercept a client request associated with the secure data to establish a secure connection with a server, establish a data traffic channel via the server facing module, and provide a control message to the server facing module via the data traffic channel. The control message includes an instruction to the server facing module to obtain a security certificate from the server. The security certificate is received from the server facing module via the data traffic channel. The security certificate is forged to establish the secure connection between the client and the client facing module. The client facing module sends unencrypted data to the server facing module via the data traffic channel.

Implementation of secure socket layer intercept

Disclosed herein are systems and methods for a security gateway to process secure network sessions where there is a server certificate validation error. In various embodiments, varying security policies can be applied to the secure network sessions, including intercepting of network data, bypass of the security gateway, or termination of the secure sessions.

Processing a security policy for certificate validation error

Described are systems and methods for verifying server security certificates using hash codes. The system may include a client secure socket layer (SSL) node, a service gateway node, and a storage node. The client SSL node may receive a session request from a client. The service gateway node may forward the session request to a server to receive a server security certificate. The service gateway node may query a server domain name system module to receive a hash code. The hash code may include a first hash value and a hash function to obtain the server security certificate based on the first hash value. The service gateway node may calculate a second hash value by applying the hash function to the server security certificate and match the second hash value and the first hash value to determine whether the server security certificate is valid.

Verification of server certificates using hash codes

A security network system may include a security gateway operable to establish a client session between the security gateway and a client device. The security gateway is operable to receive client session information from the client session. The client session information includes an identification of a server with which the client device needs to exchange data. The security network system may also include a Hardware Security Module (HSM) in communication with the security gateway. The HSM is operable to establish, in concert with the security gateway, a secure session between the security gateway and the server based on the client session data, a public key, a secret key, and context attributed to the secure session.

SSL gateway with integrated hardware security module

A method for intercepting, by a security gateway, a secure data session comprises the steps of establishing a first secure data session between a client device and a server device, intercepting the first secure data session by the security gateway, establishing a second secure data session between the server device and the security gateway, receiving a first secure session request from the client device, generating a second secure session request based on the first secure session request, receiving a server certificate from the server device, sending the second secure session request to the server device, receiving first secure content from the client device over the first secure data session, creating first encrypted secure content using the first secure content and the server certificate, and sending the first encrypted secure content to the server device over the second secure data session.

Intercepting secure session upon receipt of untrusted certificate

Provided are methods and systems for intercepting encrypted data packets. A system for intercepting encrypted data packets may comprise a first device, a second device, and a monitoring device. The first device may be operable to intercept at least one encrypted data packet. The first device may be further operable to decrypt the at least one encrypted packet to produce at least one decrypted data packet. The first device may provide the at least one decrypted data packet to the monitoring device. The monitoring device may be operable to inspect the at least one decrypted data packet based on predetermined criteria. The second device may be operable to receive, from the monitoring device, the at least one decrypted data packet. The second device may be further operable to re-encrypt the at least one decrypted data packet to produce the at least one encrypted data packet.

A method for handling hyper-text transfer protocol ('HTTP') requests from client devices is disclosed. The method comprises receiving an HTTP request from a client device to connect to a destination server. It further comprises extracting a plurality of HTTP headers from the HTTP request using a gateway device in accordance with a user defined configuration to create a subset of the request. Next, it comprises forwarding the subset to an external security device from the gateway device to perform URL policy processing using the request. Finally, it comprises based on a received result of the URL policy processing, transmitting the client request to the destination server.

Growing community of inventors

Saratoga, CA, United States of America

Xuyang Jiang