Method and Apparatus for Decryption of Encrypted SSL Data from Packet Traces

摘要

A system for decrypts encrypted Secure Sockets Layer (SSL) data from packet traces without using private keys or a proxy. Decryption of encrypted SSL data is accomplished by intercepting a session key associated with a communication session transmitted from a user device to a server during handshaking between the user device and the server. The session key is then used to decrypt packet level traces of the communication session. The decrypted packet level traces are then used to measure traffic.

主权项

1. A method comprising:
identifying, during handshaking, a session key associated with a communication session between a client and a server; identifying packet level traces of the communication session; decrypting packet level traces using the session key to generate decrypted packet level traces; and measuring traffic using the decrypted packet level traces.