Back to results
US 2019/0058714 A1Published application
Dynamic Decryption of Suspicious Network Traffic Based on Certificate Validation
AssigneeGigamon Inc.
InventorsKishor JOSHI, Manish PATHAK, Sandeep DAHIYA
Life of this patent
Estimating the term…
Abstract
A disclosed method performed by a network device can include intercepting cryptographic certificates of host servers received in response to requests for encrypted connections between host servers and user devices, and determining that each encrypted connection is a suspicious connection or a normal connection based on a certificate validation policy. The method can further include causing decryption or metadata analysis of any suspicious encrypted connection and bypassing decryption or metadata analysis of any normal encrypted connection.
Claims26
A method comprising:
- intercepting, by a network device of a computer network, a plurality of cryptographic certificates of a plurality of host servers received in response to a plurality of requests for a plurality of encrypted connections between the plurality of host servers and a plurality of user devices;
- determining, by the network device, that each encrypted connection is a suspicious connection or a normal connection based on an application of a certificate validation policy to each cryptographic certificate;
- responsive to determining that a first of the plurality of encrypted connections is a suspicious connection, causing decryption of the first encrypted connection or analysis of metadata associated with the first encrypted connection;
- and
- responsive to determining that a second of the plurality of encrypted connections is a normal connection, bypassing decryption of the second encrypted connection or analysis of metadata associated with the second encrypted connection.
2 more elements
A method comprising:
- detecting, by a network device of a first network, a plurality of encrypted sessions between a plurality of user devices of the first network and at least one host device of a second network different from the first network;
- intercepting, by the network device, a cryptographic certificate during a handshake between each user device and each host device of each encrypted session;
- determining, by the network device, that each of a subset of the plurality of encrypted sessions is associated with an untrusted cryptographic certificate such that the subset of the plurality of encrypted sessions corresponds to a plurality of suspicious sessions;
- identifying a malicious session by inspecting decrypted content of the plurality of suspicious sessions or analyzing metadata related to the plurality of suspicious sessions;
- and
- performing, by the network device, an action to mitigate a harmful effect of the malicious session.
3 more elements
A network device comprising:
- a processor;
- and
- a memory storing instructions, execution of which by the processor causes the network device to:
- intercept information transmitted by a plurality of host servers in response to a plurality of requests from a plurality of user devices seeking a plurality of encrypted connections with the plurality of host servers;
- compare an identification of each host server to a blacklist of host servers such that any encrypted connection of a blacklisted host server is decrypted and inspected to identify malicious activity and any encrypted connection of a host server that is not blacklisted undergoes a cryptographic certificate validation process;
- responsive to identifying an invalid cryptographic certificate, blacklist a host server having the invalid cryptographic certificate, decrypt an encrypted connection having the invalid cryptographic certificate, or analyze metadata of an encrypted connection having the invalid cryptographic certificate to determine a malicious connection;
- and
- responsive to identifying a valid cryptographic certificate, allow an encrypted connection associated with the valid cryptographic certificate with a user device or analyze metadata of an encrypted connection associated with the valid cryptographic certificate to determine a malicious connection.
5 more elements
Dependencies are inferred from the claim text.