# US 2024/0205244 A1 · Endpoint-assisted inspection of encrypted network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205244 A1 - Document ID: US20240205244A1 - Status: Published application - Kind: A1 - Application number: 18/592,137 - Filed: 2024-02-29 - Published: 2024-06-20 - Earliest claimed: 2018-08-10 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Martin Rehak; David McGrew; Blake Harrell Anderson; Scott William Dunlop - Web page: https://patentgrep.com/patent/US20240205244A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session. ## Claims ### Claim 1 A method, comprising: monitoring, by a monitoring agent executing on an endpoint device, a memory space of the endpoint device associated with an application or a dedicated process hosted by the endpoint device; detecting from the memory space, by the monitoring agent, a handshake initiated between an application hosted on the endpoint device and a remote entity, the handshake initiated to establish an encrypted traffic session between the application and the remote entity; capturing from the memory space of the endpoint device, by the monitoring agent, session key information for the encrypted traffic session between the endpoint device and the remote entity, wherein session keys are established during the handshake and are obtained after the encrypted traffic session is formed; transmitting the session key information to a traffic inspection service hosted on an intermediary device over a secure connection; using, by the traffic inspection service, the session key information to decrypt encrypted traffic from the encrypted traffic session, resulting in decrypted traffic; applying, by the traffic inspection service and based on the decrypted traffic comprising cleartext from the encrypted traffic session, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine whether the decrypted traffic is malicious or against the policy; and performing, by the traffic inspection service, a mitigation action in response to a determination that the decrypted traffic is malicious or against the policy. ### Claim 2 (depends on 1) The method of claim 1 wherein the session key information is received by the traffic inspection service before first data packets of the encrypted traffic session are received at the traffic inspection service. ### Claim 3 (depends on 1) The method of claim 1 wherein the monitoring agent conditionally transmits the session key information to the traffic inspection service based on one or more conditions. ### Claim 4 (depends on 3) The method of claim 3 wherein the one or more conditions include a process involved in the encrypted traffic session being malicious. ### Claim 5 (depends on 3) The method of claim 3 wherein the one or more conditions include the encrypted traffic session potentially including personally identifiable information. ### Claim 6 (depends on 1) The method of claim 1 wherein the encrypted traffic session comprises a Transport Layer Security (TLS) session and the handshake comprises a TLS handshake. ### Claim 7 (depends on 1) The method of claim 1 wherein the traffic inspection service comprises a firewall. ### Claim 8 (depends on 1) The method of claim 1 wherein the traffic inspection service comprises an intrusion detection system. ### Claim 9 (depends on 1) The method of claim 1 further comprising receiving, by the monitoring agent from the traffic inspection service, a notification that acknowledges receipt of the session key information. ### Claim 10 (depends on 1) The method of claim 1 wherein the policy comprises a security policy or a data privacy policy. ### Claim 11 A system, comprising: a monitoring agent installed on an endpoint device, the monitoring agent operative to: monitor a memory space of the endpoint device associated with an application or a dedicated process hosted by the endpoint device; detect from the memory space, by the monitoring agent, a handshake initiated between an application hosted on the endpoint device and a remote entity, the handshake initiated to establish an encrypted traffic session between the application and the remote entity; capture from the memory space of the endpoint device, by the monitoring agent, session key information for the encrypted traffic session between the endpoint device and the remote entity, wherein session keys are established during the handshake and are obtained after the encrypted traffic session is formed; and transmit the session key information to a traffic inspection service hosted on an intermediary device over a secure connection; the traffic inspection service operative to: use the session key information to decrypt encrypted traffic from the encrypted traffic session, resulting in decrypted traffic; apply, based on the decrypted traffic comprising cleartext from the encrypted traffic session, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine whether the decrypted traffic is malicious or against the policy; and perform a mitigation action in response to a determination that the decrypted traffic is malicious or against the policy. ### Claim 12 (depends on 11) The system of claim 11 wherein the session key information is received by the traffic inspection service before first data packets of the encrypted traffic session are received at the traffic inspection service. ### Claim 13 (depends on 11) The system of claim 11 wherein the monitoring agent conditionally transmits the session key information to the traffic inspection service based on one or more conditions. ### Claim 14 (depends on 13) The system of claim 13 wherein the one or more conditions include a process involved in the encrypted traffic session being malicious. ### Claim 15 (depends on 13) The system of claim 13 wherein the one or more conditions include the encrypted traffic session potentially including personally identifiable information. ### Claim 16 (depends on 11) The system of claim 11 wherein the encrypted traffic session comprises a Transport Layer Security (TLS) session and the handshake comprises a TLS handshake. ### Claim 17 (depends on 11) The system of claim 11 wherein the traffic inspection service comprises a firewall. ### Claim 18 (depends on 11) The system of claim 11 wherein the traffic inspection service comprises an intrusion detection system. ### Claim 19 (depends on 11) The system of claim 11 wherein the monitoring agent is operative to receive from the traffic inspection service, a notification that acknowledges receipt of the session key information. ### Claim 20 (depends on 11) The system of claim 11 wherein the policy comprises a security policy or a data privacy policy.