Back to results
US 2020/0053124 A1Published application
Packet inspection and forensics in an encrypted network
Assigneesalesforce.com, inc.
InventorsMark Manasse, Amit Limaye
Life of this patent
Estimating the term…
Abstract
According to an implementation of the disclosure, a computing device may record substantially all the network traffic being transported over a first node of a network over a period of time. The computing device may receive an authenticated request from a forensics system that includes access criteria. The first computing device may determine a relevant encrypted and unencrypted portion of the network traffic based on the access criteria. Based on unencrypted portion, the computing device may recalculate an encryption key applicable to the encrypted portion. The computing device may then replicate the relevant portion and the encryption key to the forensics system for forensic analysis.
Claims24
A method comprising:
- providing, by a first computing device to a first node of a network, a request to access network traffic of the network;
- in response to receiving access to the network traffic from the first node, writing, by the first computing device, first data from the network traffic to at least a first data store of a plurality of data stores in communication with the first computing device, the first data comprising first encrypted data and a first plurality of key exchange events;
- receiving, by the first computing device, a request from a second computing device that is distinct from the first computing device to access encrypted data transmitted over the network;
- in response to the receipt of the request from the second computing device, authenticating, by the first computing device, the second computing device;
- identifying, by the first computing device based on a time range included in the request from the second computing device, a first portion of the first encrypted data and a first key exchange event of the first plurality of key exchange events;
- calculating, by the first computing device, a first encryption key based on data included in the first key exchange event;
- and
- providing, by the first computing device to the second computing device, the first encryption key and access to the first portion of the first encrypted data written on at least the first data store.
5 more elements
(canceled)
(canceled)
(canceled)
(canceled)
A non-transitory, computer readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
- providing, by a first computing device to a first node of a network, a request to access network traffic of the network;
- in response to receiving access to the network traffic from the first node, writing, by the first computing device, first data from the network traffic to at least a first data store of a plurality of data stores in communication with the first computing device, the first data comprising first encrypted data and a first plurality of key exchange events;
- receiving, by the first computing device, a request from a second computing device that is distinct from the first computing device, to access encrypted data transmitted over the network;
- in response to the receipt of the request from the second computing device, authenticating, by the first computing device, the second computing device;
- identifying, by the first computing device based on a time range included in the request from the second computing device, a first portion of the first encrypted data and a first key exchange event of the first plurality of key exchange events;
- calculating, by the first computing device, a first encryption key based on data included in the first key exchange event;
- and
- providing, by the first computing device to the second computing device, the first encryption key and access to the first portion of the first encrypted data written on at least the first data store.
5 more elements
A system comprising:
- a first computing device comprising a processor in communication with:
- (i) a first node of a network over a first communications channel and (ii) a second computing device over a second communications channel that is secure and distinct from the first communications channel;
- and
- a non-transitory, computer readable medium, storing instructions that, when executed by the processor, cause the processor to perform operations comprising:
- providing, by the first computing device to the first node, a request to access network traffic of a network;
- in response to receiving access to the network traffic from the first node, writing, by the first computing device, first data from the network traffic to at least a first data store of a plurality of data stores in communication with the first computing device, the first data comprising first encrypted data and a first plurality of key exchange events;
- receiving, by the first computing device, a request from the second computing device to access encrypted data transmitted over the network;
- in response to the receipt of the request from the second computing device, authenticating, by the first computing device, the second computing device;
- identifying, by the first computing device based on a time range included in the request from the second computing device, a first portion of the first encrypted data and a first key exchange event of the first plurality of key exchange events;
- decrypting, by the first computing device based on data exchanged in the first key exchange event, the first portion of the first encrypted data;
- and
- providing, by the first computing device to the second computing device, the decrypted first portion of the first encrypted data.
9 more elements
Dependencies are inferred from the claim text.