System and method for monitoring leakage of internal information by analyzing encrypted traffic
AssigneeThe Industry & Academic Cooperation in Chungnam National University (IAC)
InventorsYoo Jae Won, Ji Hoon Yoon
Life of this patent
Estimating the term…
Abstract
A system and method for monitoring a leakage of internal information by analyzing encrypted traffic according to the present invention is characterized in that an SSL session is not created directly between an internal computer and an external computer, but a monitoring computer creates SSL sessions with the internal computer and the external computer respectively, and when a data packet is transmitted from the internal computer to the external computer, the monitoring computer first checks whether the data packet contains internal information and then delivers the data packet.
Claims10
A system for monitoring leakage of internal information, the system comprising:
- an internal computer;
- a monitoring computer;
- and
- an external computer,
- wherein the monitoring computer is configured to:
- make a request for an SSL session to the external computer after receiving an SSL session creation request from the internal computer;
- upon receiving a response thereto, create an SSL session between the monitoring computer and the external computer using an original certificate transmitted from the external computer;
- transmit a response to the SSL session creation request to the internal computer to thus create an SSL session between the monitoring computer and the internal computer, wherein the SSL session between the monitoring computer and the internal computer is created using a monitoring-computer-modified certificate that is obtained through modification of the original certificate;
- and
- when transmitting a packet from the internal computer to the external computer, check whether or not the packet contains internal information and then transmit the same,
- wherein the original certificate includes a public key of the external computer, and
- the monitoring computer is configured to obtain the monitoring-computer-modified certificate by replacing the public key included in the original certificate with a randomly created key.
A method for monitoring leakage of internal information through analysis of encrypted traffic using a system for monitoring leakage of internal information, which comprises an internal computer, a monitoring computer, and an external computer, the method comprising:
- a first step in which the monitoring computer receives an SSL session creation request from the internal computer;
- a second step in which, in order to create a new SSL session between the external computer and the monitoring computer, the monitoring computer makes a request for an SSL session to the external computer, and receives a response thereto;
- a third step of creating an SSL session between the monitoring computer and the external computer using an original certificate transmitted from the external computer, and then transmitting a response to the SSL session creation request to the internal computer;
- a fourth step of creating an SSL session between the monitoring computer and the internal computer using a monitoring-computer-modified certificate obtained through modification of the original certificate;
- and
- a fifth step of transmitting a packet from the internal computer to the external computer after the monitoring computer checks whether or not the packet contains internal information,
- wherein the original certificate includes a public key of the external computer, and the method further comprises obtaining the monitoring-computer-modified certificate by replacing the public key included in the original certificate with a randomly created key.
A method, the method comprising:
- receiving from an external computer an original certificate, wherein the original certificate includes a public key of the external computer;
- creating a first SSL session between a monitoring computer and the external computer using the original certificate;
- replacing the public key included in the original certificate with a randomly created key, thereby creating a modified certificate;
- and
- creating a second SSL session between the monitoring computer and an internal computer using the modified certificate.
Dependencies are inferred from the claim text.