Back to results
US 9,176,838 B2Granted
Encrypted data inspection in a network environment
AssigneeIntel Corporation
InventorsXiaoning Li, Karanvir S. Grewal, Geoffrey H. Cooper, John R. Guzik
Life of this patent
Estimating the term…
Abstract
Technologies are provided in example embodiments for analyzing an encrypted network flow. The technologies include monitoring the encrypted network flow between a first node and a second node, the network flow initiated from the first node; duplicating the encrypted network flow to form a copy of the encrypted network flow; decrypting the copy of the encrypted network flow using a shared secret, the shared secret associated with the first node and the second node; and scanning the network flow copy for targeted data.
Claims35
A method for analyzing an encrypted network flow, comprising:
- monitoring, by a firewall, the encrypted network flow of an encryption protocol session between a first node and a second node, the encryption protocol session initiated by a process associated with an application on the first node;
- duplicating the encrypted network flow to form a copy of the encrypted network flow;
- receiving, at the firewall from an extraction module on the first node, a message containing a shared secret associated with the encrypted network flow, wherein the shared secret is determined by the first and second nodes based, at least in part, on information exchanged between the first and second nodes, and wherein, responsive to identifying at the first node an initiation of a handshake of the encrypted protocol session, the extraction module is to open a memory space of the process to extract the shared secret to send to the firewall;
- decrypting, by the firewall, the copy of the encrypted network flow using the shared secret received from the extraction module to form a network flow copy;
- and
- scanning the network flow copy for targeted data.
3 more elements
An apparatus, comprising:
- at least one processor coupled to at least one memory element;
- and
- a security module to execute on the at least one processor to:
- monitor an encrypted network flow of an encryption protocol session between a first node and a second node, the encryption protocol session initiated by a process associated with an application on the first node;
- duplicate the encrypted network flow to form a copy of the encrypted network flow;
- receive, from an extraction module on another node, a message containing a shared secret associated with the encrypted network flow, wherein the shared secret is to be determined by the first and second nodes based, at least in part, on information exchanged between the first and second nodes, wherein, responsive to identifying at the first node an initiation of a handshake of the encrypted protocol session, the extraction module is to open a memory space of the process to extract the shared secret to send to the firewall, and wherein the firewall and the other node are separate nodes;
- decrypt the copy of the encrypted network flow using the shared secret received from the extraction module to form a network flow copy;
- and
- scan the network flow copy for targeted data.
6 more elements
At least one non-transitory machine accessible storage medium having instructions stored thereon for analyzing an encrypted network flow, the instructions when executed on a machine, cause the machine to:
- monitor, by a firewall, the encrypted network flow of an encryption protocol session between a first node and a second node, the encryption protocol session initiated by a process associated with an application on the first node;
- duplicate the encrypted network flow to form a copy of the encrypted network flow;
- receive, at the firewall from an extraction module on another node, a message containing a shared secret associated with the encrypted network flow, wherein the shared secret is to be determined by the first and second nodes based, at least in part, on information exchanged between the first and second nodes, wherein, responsive to identifying at the first node an initiation of a handshake of the encrypted protocol session, the extraction module is to open a memory space of the process to extract the shared secret to send to the firewall, and wherein the firewall and the other node are separate nodes;
- decrypt, by the firewall, the copy of the encrypted network flow using the shared secret received from the extraction module to form a network flow copy;
- and
- scan the network flow copy for targeted data.
3 more elements
A method for extracting a shared secret from a first node, comprising:
- monitoring, at the first node by an extraction module, a network flow at a network layer between the first node and a second node;
- identifying an initiation of a handshake of an encryption protocol session between the first and second nodes;
- responsive to identifying the initiation, the extraction module opening a memory space of a process initiating the encryption protocol session, wherein the process is associated with an application on the first node;
- identifying, by the extraction module, the shared secret in the encryption protocol session within the memory space of the process, wherein the shared secret was computed by the first node based, at least in part, on information exchanged between the first node and the second node;
- extracting, by the extraction module, the shared secret from the memory space of the process;
- and
- sending the shared secret to a firewall between the first and second nodes.
4 more elements
At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
- monitor, at the first node by an extraction module, a network flow at a network layer between the first node and a second node;
- identify an initiation of a handshake of an encryption protocol session between the first and second nodes;
- responsive to identifying the initiation, open by the extraction module a memory space of a process initiating the encryption protocol session, wherein the process is associated with an application on the first node;
- identify, by the extraction module, the shared secret in the encryption protocol session within the memory space of the process, wherein the shared secret was computed by the first node based, at least in part, on information exchanged between the first node and the second node;
- extract, by the extraction module, the shared secret from the memory space of the process;
- and
- send the shared secret to a firewall between the first and second nodes.
4 more elements
Dependencies are inferred from the claim text.