# US 11,310,256 B2 · Monitoring encrypted network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,256 B2 - Document ID: US11310256B2 - Status: Granted - Kind: B2 - Application number: 17/483,148 - Filed: 2021-09-23 - Published: 2022-03-24 - Granted: 2022-04-19 - Earliest claimed: 2020-09-23 - Assignees: ExtraHop Networks, Inc. - Applicants: ExtraHop Networks, Inc. - Inventors: Benjamin Thomas Higgins; Jeff James Costlow; John Gemignani, Jr.; Michael Kerber Krause Montague; Eric James Rongo; Xue Jun Wu - Web page: https://patentgrep.com/patent/US11310256B2 ## CPC - H04L 43/062: related to network traffic - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 41/142: using statistical or mathematical methods - H04L 43/026: using flow identification - H04L 43/12: Network monitoring probes - H04L 43/18: Protocol analysers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers. ## Claims ### Claim 1 A method for monitoring communication over a network between one or more computers, with one or more network monitoring computers (NMCs) that perform actions, comprising: providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including: monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server; monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server; monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server; generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication; correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and generating one or more reports that include information associated with one or more of the client, the resource server, or the control server. ### Claim 2 (depends on 1) The method of claim 1, further comprising: providing the one or more keys to the NMC; employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 3 (depends on 1) The method of claim 1, further comprising: providing one or more sharing agents to the one or more computers; determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents; employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 4 (depends on 1) The method of claim 1, wherein monitoring the first communication between the client and the control server further comprises: generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication. ### Claim 5 (depends on 1) The method of claim 1, wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises: determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol; determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and updating the one or more metrics based on the one or more anomalous characteristics. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols. ### Claim 7 (depends on 1) The method of claim 1, wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol. ### Claim 8 A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more networking monitoring computers perform the method comprising: providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including: monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server; monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server; monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server; generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication; correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and generating one or more reports that include information associated with one or more of the client, the resource server, or the control server. ### Claim 9 (depends on 8) The media of claim 8, further comprising: providing the one or more keys to the NMC; employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 10 (depends on 8) The media of claim 8, further comprising: providing one or more sharing agents to the one or more computers; determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents; employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 11 (depends on 8) The media of claim 8, wherein monitoring the first communication between the client and the control server further comprises: generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication. ### Claim 12 (depends on 8) The media of claim 8, wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises: determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol; determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and updating the one or more metrics based on the one or more anomalous characteristics. ### Claim 13 (depends on 8) The media of claim 8, further comprising: determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols. ### Claim 14 (depends on 8) The media of claim 8, wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol. ### Claim 15 A system for monitoring network traffic in a network: one or more network monitoring computers (NMCs), comprising: a memory that stores at least instructions; and one or more processors that execute instructions that perform actions, including: providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including: monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server; monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server; monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server; generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication; correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and generating one or more reports that include information associated with one or more of the client, the resource server, or the control server; and one or more client computers, comprising: a memory that stores at least instructions; and one or more processors that execute instructions that perform actions, including: providing at least a portion of one or more of the first communication, the second communication, or the other communication. ### Claim 16 (depends on 15) The system of claim 15, wherein the one or more NMC processors execute instructions that perform actions, further comprising: providing the one or more keys to the NMC; employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 17 (depends on 15) The system of claim 15, wherein the one or more NMC processors execute instructions that perform actions, further comprising: providing one or more sharing agents to the one or more computers; determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents; employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 18 (depends on 15) The system of claim 15, wherein monitoring the first communication between the client and the control server further comprises: generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication. ### Claim 19 (depends on 15) The system of claim 15, wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises: determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol; determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and updating the one or more metrics based on the one or more anomalous characteristics. ### Claim 20 (depends on 15) The system of claim 15, wherein the one or more NMC processors execute instructions that perform actions, further comprising: determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols. ### Claim 21 (depends on 15) The system of claim 15, wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol. ### Claim 22 A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising: a memory that stores at least instructions; and one or more processors that execute instructions that perform actions, including: providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including: monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server; monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server; monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server; generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication; correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and generating one or more reports that include information associated with one or more of the client, the resource server, or the control server. ### Claim 23 (depends on 22) The NMC of claim 22, wherein the one or more processors execute instructions that perform actions, further comprising: providing the one or more keys to the NMC; employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 24 (depends on 22) The NMC of claim 22, wherein the one or more processors execute instructions that perform actions, further comprising: providing one or more sharing agents to the one or more computers; determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents; employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication. ### Claim 25 (depends on 22) The NMC of claim 22, wherein monitoring the first communication between the client and the control server further comprises: generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication. ### Claim 26 (depends on 22) The NMC of claim 22, wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises: determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol; determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and updating the one or more metrics based on the one or more anomalous characteristics. ### Claim 27 (depends on 22) The NMC of claim 22, wherein the one or more processors execute instructions that perform actions, further comprising: determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols. ### Claim 28 (depends on 22) The NMC of claim 22, wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol.