Patent ID: 9553892
Date: 2017-01-24
CPC Classifications: H04L

Claim:
1. A method in a security gateway coupled between a client end station and a web application server (WAS), wherein a protocol stack used between the client end station and the WAS includes an application layer that carries application layer data, an encryption layer under the application layer to carry and encrypt the application layer data, and a transport layer to carry the encryption layer, wherein the encryption layer and the transport layer respectively allow for an encryption layer connection carried over a transport layer connection to be established between the client end station and the WAS to encrypt and transmit application layer data between them, wherein the security gateway includes a transport protocol layer manipulation module capable of making necessary changes at the transport layer to accommodate modifications made to the traffic transmitted between the client end station and the WAS at higher layers of the protocol stack, wherein the changes comprise modifying transport layer headers of packets and generating additional packets to acknowledge or retransmit modified data, the method to improve security through modification in the security gateway of application layer data even though that application layer data was encrypted and transmitted using the encryption layer connection that is between the client end station and WAS and is not terminated by the security gateway, the method comprising: monitoring, in the security gateway implemented in an electronic device, a handshake between the client end station and the WAS that follows a handshake protocol to establish the encryption layer connection over the transport layer connection, wherein the security gateway is transparent and thus does not terminate the encryption layer connection or the underlying transport layer connection, wherein the handshake is to generate a symmetric key to be utilized by the client end station and the WAS when encrypting and decrypting application layer data to be sent using the encryption layer connection, wherein the monitoring includes the security gateway learning the symmetric key using a private key of the WAS, wherein the monitoring comprises, receiving, at the security gateway, an encrypted connection record sent from the WAS and destined to the client end station using the encryption layer connection, the encrypted connection record being the result of the WAS having encrypted a plaintext connection record comprising one or more application layer payloads; generating, by the security gateway, a set of one or more encrypted modified connection records, wherein the generating comprises: transmitting, from the security gateway to the client end station using the encryption layer connection carried on the transport layer connection, the set of encrypted modified connection records generated by the security gateway instead of the encrypted connection record sent by the WAS.