Computer implemented method of analyzing x.509 certificates in ssl/tls communications and the dataprocessing system
AssigneeThe Boeing Company
InventorPEDRO BALLESTEROS TABOSO
Life of this patent
Estimating the term…
Abstract
A computer implemented method of analyzing X.509 certificates in SSL/TLS communications, and the data processing system for implementing said method, that may include: extracting X.509 certificates from SSL/TLS Handshake protocols; monitoring each extracted X.509 certificate for evaluating, using the processor, a grade of polymorphism that the X.509 certificate exhibits; and, storing the X.509 certificate in the certificate database if the X.509 certificate is not previously stored in the certificate database or, if the X.509 certificate exhibits a grade of polymorphism with respect to a previously stored version of the X.509 certificate.
Claims20
A method comprising:
- extracting a security certificate used during a secure handshake protocol;
- storing the security certificate in a certificate database when the security certificate is not previously stored in the certificate database;
- determining whether the security certificate exhibits a grade of polymorphism with respect to a stored version of the security certificate when the security certificate is previously stored in the certificate database;
- and
- storing the security certificate in the certificate database when the security certificate exhibits a grade of polymorphism with respect to the stored version of the security certificate.
A system comprising:
- a certificate collection module configured to extract at least one security certificate from a secure handshake protocol;
- a certificate classifier module configured to determine whether the security certificate exhibits a grade of polymorphism with respect to a stored version of the security certificate;
- and
- a certificate database configured to store the security certificate when the certificate is not previously stored in the certificate database or the security certificate exhibits a grade of polymorphism with respect to the stored version of the security certificate.
A non-transitory computer readable medium storing instructions that, when executed by a processor, causes the processor to perform operations comprising:
- periodically sending security certificate requests to one or more command and control infrastructures of a network server;
- extracting a security certificate received from the network server and used during a secure handshake protocol associated with at least one of the security certificate requests;
- storing the security certificate in a certificate database when the security certificate is not previously stored in the certificate database;
- and
- storing the security certificate in the certificate database when a stored version of the security certificate in the certificate database exhibits a grade of polymorphism with respect to the stored version of the security certificate.
Dependencies are inferred from the claim text.