Cryptographic proxy service
AssigneeVMware, Inc.
InventorErich Stuntebeck
Life of this patent
Estimating the term…
Abstract
A cryptographic proxy service may be provided. Upon determining that data associated with a network destination comprises at least some sensitive data, a cryptographic service may provide a security certificate associated with the network destination. The plurality of data may be encrypted according to the security certificate associated with the network destination and provided to the cryptographic service for re-encryption and transmission to the network destination.
Claims21
-20. (canceled)
A method for providing a cryptographic proxy service, the method comprising:
- receiving identification of a network destination where a computing device is attempting to transmit sensitive data;
- obtaining a spoofed security certificate that impersonates the network destination;
- sending a first public key of the spoofed security certificate to the computing device for encrypting the sensitive data;
- operating as a first certificate authority for the spoofed security certificate;
- receiving the encrypted sensitive data;
- decrypting the sensitive data using a private key of the spoofed security certificate;
- conditionally blocking transmission of the sensitive data based on a status of a secure channel;
- negotiating the secure channel with the network destination;
- and
- forwarding the sensitive data to the network destination based on the negotiating of the secure channel.
A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor, performs stages for providing a cryptographic proxy service, the stages comprising:
- receiving identification of a network destination where a computing device is attempting to transmit sensitive data;
- obtaining a spoofed security certificate that impersonates the network destination;
- sending a first public key of the spoofed security certificate to the computing device for encrypting the sensitive data;
- operating as a first certificate authority for the spoofed security certificate;
- receiving the encrypted sensitive data;
- decrypting the sensitive data using a private key of the spoofed security certificate;
- conditionally blocking transmission of the sensitive data based on a status of a secure channel;
- negotiating the secure channel with the network destination;
- and
- forwarding the sensitive data to the network destination based on the negotiating of the secure channel.
A cryptographic proxy system comprising:
- a memory storage including a non-transitory, computer-readable medium comprising instructions;
- and
- a computing device including a hardware-based processor that executes the instructions to carry out stages comprising:
- receiving identification of a network destination where a computing device is attempting to transmit sensitive data;
- obtaining a spoofed security certificate that impersonates the network destination;
- sending a first public key of the spoofed security certificate to the computing device for encrypting the sensitive data;
- operating as a first certificate authority for the spoofed security certificate;
- receiving the encrypted sensitive data;
- decrypting the sensitive data using a private key of the spoofed security certificate;
- conditionally blocking transmission of the sensitive data based on a status of a secure channel;
- negotiating the secure channel with the network destination;
- and
- forwarding the sensitive data to the network destination based on the negotiating of the secure channel.
Dependencies are inferred from the claim text.