Qing Ying Li

US Patent:

20190253398, Aug 15, 2019

Filed:

Jun 28, 2018

Appl. No.:

16/021950

Inventors:

- Mountain View CA, US
Daniel Marino - Los Angeles CA, US
Susanta K. Nanda - San Jose CA, US
Saurabh Shintre - Sunnyvale CA, US
Brian T. Witten - Hermosa Beach CA, US
Ronald A. Frederick - Mountain View CA, US
Qing Li - Cupertino CA, US

International Classification:

H04L 29/06
G06F 21/62

Abstract:

Decrypting network traffic on a middlebox device using a trusted execution environment (TEE). In one embodiment, a method may include loading a kernel application inside the TEE, loading a logic application outside the TEE, intercepting, by the logic application, encrypted network traffic, forwarding, from the logic application to the kernel application, the encrypted network traffic, decrypting, at the kernel application, the encrypted network traffic, inspecting, at the kernel application, the decrypted network traffic according to a sensitivity policy to determine whether the decrypted network traffic includes sensitive data, forwarding, from the kernel application to the logic application, filtered decrypted network traffic that excludes the sensitive data, processing, at the logic application, the filtered decrypted network traffic, forwarding, from the logic application to the kernel application, the filtered decrypted network traffic after the processing by the logic application, and forwarding, from the kernel application, the encrypted network traffic.