# US 2014/0196108 A1 · Security policy enforcement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196108 A1 - Document ID: US20140196108A1 - Status: Published application - Kind: A1 - Application number: 14/235,829 - Filed: 2012-07-31 - Published: 2014-07-10 - Earliest claimed: 2011-08-04 - Assignees: International Business Machines Corporation - Inventors: Arthur J. Barr; Oliver M. Deakin; Robert B. Nicholson; Colin J. Thorne - Web page: https://patentgrep.com/patent/US20140196108A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of operating a network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the interceptor being in communication with the network and external to the first and second endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the method comprising the steps of: intercepting a handshake message transmitted over the network between the first and second endpoints; extracting from the handshake message an identification of a security standard selected for the communication between the first and second endpoints; determining a validity status of the identified security standard based on the security policy; and preventing communication between the first and second endpoints based on a negatively determined validity status of the identified security standard. ## Claims ### Claim 1 A method of operating a network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the method comprising: intercepting, by one or more processors, a handshake message transmitted over the network between the first and second network endpoints; extracting, by one or more processors, from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints; determining, by one or more processors, a validity status of the identified security standard based on the security policy; and preventing, by one or more processors, communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard. ### Claim 2 (depends on 1) The method of claim 1, further comprising: permitting, by one or more processors, communication between the first and second network endpoints based on a positively determined validity status of the identified security standard. ### Claim 3 (depends on 2) The method of claim 2, further comprising: preventing, by one or more processors, communication between the first and second network endpoints based on a determination of an authorization component using an identification of each of the first and second network endpoints. ### Claim 4 (depends on 1) The method of claim 1, wherein the security standard is a cipher suite. ### Claim 5 (depends on 1) The method of claim 1, wherein the security policy identifies at least one of: at least one key exchange method; at least one encryption algorithm; at least one message digest algorithm; and at least one minimum key length. ### Claim 6 (depends on 5) The method of claim 5, wherein the security standard identifies at least one of: a key exchange method; an encryption algorithm; and a message digest algorithm. ### Claim 7 (depends on 2) The method of claim 2, wherein the security policy indicates whether resumption of a communication session is allowable. ### Claim 8 (depends on 2) The method of claim 2, wherein the interceptor is a transparent proxy. ### Claim 9 A network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the network message interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the network message interceptor comprising: intercepting means for intercepting a handshake message transmitted over the network between the first and second network endpoints; extracting means for extracting from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints; determining means for determining a validity status of the identified security standard based on the security policy; and preventing means for preventing communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard. ### Claim 10 (depends on 9) The network message interceptor of claim 9, further comprising: permitting means for permitting communication between the first and second network endpoints based on a positively determined validity status of the identified security standard ### Claim 11 (depends on 10) The network message interceptor of claim 10, further comprising: preventing means for preventing communication between the first and second network endpoints based on a determination of an authorization component using an identification of each of the first and second network endpoints. ### Claim 12 (depends on 9) The network message interceptor of claim 9, wherein the security standard is a cipher suite. ### Claim 13 (depends on 9) The network message interceptor of claim 9, wherein the security policy identifies at least one of: at least one key exchange method; at least one encryption algorithm; at least one message digest algorithm; and at least one minimum key length. ### Claim 14 (depends on 9) The network message interceptor of claim 9, wherein the security standard identifies at least one of: a key exchange method; an encryption algorithm; and a message digest algorithm. ### Claim 15 (depends on 9) The network message interceptor of claim 9, wherein the security policy indicates whether resumption of a communication session is allowable. ### Claim 16 (depends on 9) The network message interceptor of claim 9, wherein the intercepting means is a transparent proxy. ### Claim 17 A computer program product for operating a network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code readable and executable by a processor to perform a method comprising: intercepting a handshake message transmitted over the network between the first and second network endpoints; extracting from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints; determining a validity status of the identified security standard based on the security policy; and preventing communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the method further comprises: permitting communication between the first and second network endpoints based on a positively determined validity status of the identified security standard. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the method further comprises: preventing communication between the first and second network endpoints based on a determination of an authorization component using an identification of each of the first and second network endpoints. ### Claim 20 (depends on 17) The computer program product of claim 17, wherein the security standard is a cipher suite.