A Short Introduction
Okay, this is going to be sort of demanding. Secure Socket Layer (SSL) and now rather Transport Layer Security (TLS) are at the heart of our current encrypted communication via the Internet. Let’s not get too much into the history here, but consider this: SSL was developed by Netscape in the nineties and version 3.0 was used as the base for the open standard TLS 1.0 via RFC 2246 in 1999. On the wire, the protocol presents itself on top of TCP. (A variation is DTLS, which is used on top of UDP.) The unencrypted header structures are well-defined and thus perfect candidates for DPI, especially for Lightweight Inspection (LI). I’m going to refrain from putting “packet” into the term, because LI may work on top of streams as well, as it is not aware of packets. That makes things easy by unwinding the protocol stack and avoiding packet parsing/manipulation inside the engine itself. Read more...