Dynamic whitelist management
AssigneeCisco Technology, Inc.
InventorsRobert Thomas Taylor, M. David Hanes, Nikhil Sainath Kale, Ana Perić
Life of this patent
Estimating the term…
Abstract
In one example embodiment, a proxy for a network obtains a traffic flow. The proxy determines whether a security policy in a whitelist for the traffic flow is active. If it is determined that the security policy for the traffic flow is active, the proxy selectively decrypts the traffic flow to produce one or more traffic flow attributes and, based on the one or more traffic flow attributes, determines whether the traffic flow is potentially malicious.
Claims20
A method comprising:
- at a proxy for a network:
- obtaining a traffic flow;
- determining whether a security policy in a whitelist for the traffic flow is active;
- and
- if it is determined that the security policy for the traffic flow is active:
- selectively decrypting the traffic flow to produce one or more traffic flow attributes;
- based on the one or more traffic flow attributes, determining whether the traffic flow is potentially malicious;
- in response to determining that the traffic flow is potentially malicious, deactivating the security policy for the traffic flow;
- and
- in response to deactivating the security policy for the traffic flow, decrypting one or more subsequent traffic flows.
An apparatus comprising:
- a memory that stores whitelist data for a whitelist;
- a network interface that enables network communication;
- and
- one or more processors coupled to the memory and the network interface, wherein the one or more processors are configured to:
- obtain a traffic flow;
- determine whether a security policy in the whitelist for the traffic flow is active;
- and
- if it is determined that the security policy for the traffic flow is active:
- selectively decrypt the traffic flow to produce one or more traffic flow attributes;
- based on the one or more traffic flow attributes, determine whether the traffic flow is potentially malicious;
- in response to determining that the traffic flow is potentially malicious, deactivate the security policy for the traffic flow;
- and
- in response to deactivating the security policy for the traffic flow, decrypt one or more subsequent traffic flows.
One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:
- obtain a traffic flow;
- determine whether a security policy in a whitelist for the traffic flow is active;
- and
- if it is determined that the security policy for the traffic flow is active:
- selectively decrypt the traffic flow to produce one or more traffic flow attributes;
- based on the one or more traffic flow attributes, determine whether the traffic flow is potentially malicious;
- in response to determining that the traffic flow is potentially malicious, deactivate the security policy for the traffic flow;
- and
- in response to deactivating the security policy for the traffic flow, decrypt one or more subsequent traffic flows.
Dependencies are inferred from the claim text.