Back to results
US 11,388,146 B2Granted
Secure low-latency trapdoor proxy
AssigneeBitglass, Inc.
InventorsAnurag Kahol, Anoop Kumar Bhattacharjya, Balas Natarajan Kausik, Siva Saran Kumar Kollipara
Life of this patent
Estimating the term…
Abstract
A proxy system is installed on a computing device that is in the network path between the device and the Internet. The proxy system, residing on the computing device, decrypts and inspects all traffic going in and out of the computing device.
Claims20
A method, comprising:
- receiving, by a device proxy executing on a user device, data from an application server via a network;
- determining, by the device proxy, whether a certificate authority of the device proxy is in a certificate authority chain of trust in a certificate of the application server;
- based on a determination that the certificate authority of the device proxy is in the certificate authority chain of trust in the certificate of the application server, refusing the data from the application server;
- based on a determination that the device proxy's certificate authority is not in the certificate authority chain of trust in the application server's certificate:
- decrypting the data with a session key;
- inspecting cleartext data in the decrypted data;
- encrypting the decrypted data with the session key;
- sending the encrypted data to an application program executing on the user device.
5 more elements
One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
- receiving, by a device proxy executing on a user device, data from an application server via a network;
- determining, by the device proxy, whether a certificate authority of the device proxy is in a certificate authority chain of trust in a certificate of the application server;
- based on a determination that the certificate authority of the device proxy is in the certificate authority chain of trust in the certificate of the application server, refusing the data from the application server;
- based on a determination that the device proxy's certificate authority is not in the certificate authority chain of trust in the application server's certificate:
- decrypting the data with a session key;
- inspecting cleartext data in the decrypted data;
- encrypting the decrypted data with the session key;
- sending the encrypted data to an application program executing on the user device.
5 more elements
An apparatus, comprising:
- a device proxy executing on a user device, implemented at least partially in hardware, configured to receive data from an application server via a network;
- wherein the device proxy is further configured to determine whether a certificate authority of the device proxy is in a certificate authority chain of trust in a certificate of the application server;
- wherein the device proxy is further configured to, based on a determination that the certificate authority of the device proxy is in the certificate authority chain of trust in the certificate of the application server, refuse the data from the application server;
- wherein the device proxy is further configured to, based on a determination that the device proxy's certificate authority is not in the certificate authority chain of trust in the application server's certificate:
- decrypt the data with a session key;
- inspect cleartext data in the decrypted data;
- encrypt the decrypted data with the session key;
- send the encrypted data to an application program executing on the user device.
5 more elements
Dependencies are inferred from the claim text.