US 11,310,256 B2Granted

Monitoring encrypted network traffic

AssigneeExtraHop Networks, Inc.

InventorsBenjamin Thomas Higgins, Jeff James Costlow, John Gemignani, Jr., Michael Kerber Krause Montague, Eric James Rongo, Xue Jun Wu

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers.

Claims28

Dependent claims

A method for monitoring communication over a network between one or more computers, with one or more network monitoring computers (NMCs) that perform actions, comprising:

providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server;
and
in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:
monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;
monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;
monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;
generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;
correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic;
and
generating one or more reports that include information associated with one or more of the client, the resource server, or the control server.

7 more elements

A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more networking monitoring computers perform the method comprising:

providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server;
and
in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:
monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;
monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;
monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;
generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;
correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic;
and
generating one or more reports that include information associated with one or more of the client, the resource server, or the control server.

7 more elements

A system for monitoring network traffic in a network:

one or more network monitoring computers (NMCs), comprising:
a memory that stores at least instructions;
and
one or more processors that execute instructions that perform actions, including:
providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server;
and
in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:
monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;
monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;
monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;
generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;
correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic;
and
generating one or more reports that include information associated with one or more of the client, the resource server, or the control server;
and
one or more client computers, comprising:
a memory that stores at least instructions;
and
one or more processors that execute instructions that perform actions, including:
providing at least a portion of one or more of the first communication, the second communication, or the other communication.

17 more elements

A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising:

a memory that stores at least instructions;
and
one or more processors that execute instructions that perform actions, including:
providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server;
and
in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:
monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;
monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;
monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;
generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;
correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic;
and
generating one or more reports that include information associated with one or more of the client, the resource server, or the control server.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/483,148Filed 23 Sep 2021 · us provisional application
Priority: 23 Sep 2020
Published: US 2022/0094706 A124 Mar 2022
Granted: 19 Apr 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification15 codes

H04L 43/062
Generation of reports: related to network traffic
H04L 9/0819
Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for…:…
H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
H04L 41/046
Network management architectures or arrangements: comprising network management agents or mobile agents therefor

Family

Application63/082,262Us provisional application · filed 23 Sep 2020
US 2022/0094706 A1Pre-grant publication · published 24 Mar 2022
US 11,310,256 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key