Security policy enforcement

A network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the network message interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, wherein the network message interceptor comprises one or more processors, and a non-transitory computer readable storage device storing instructions, the one or more processors executing the instructions to:

• intercept a handshake message transmitted over the network between the first and second network endpoints;
• extract from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints;
• determine a validity status of the identified security standard based on the security policy, wherein the security policy defines characteristics of predetermined acceptable security standards for communication over the network;
• prevent communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard;
• extract an identification of a security standard selected for communication between the first and second network endpoints from the handshake message, wherein the identification of the security standard is determined by extracting a cipher suite from an initial “Server Hello” message from the first network endpoint to the second network endpoint, and wherein the cipher suite is used by the security standard to encrypt communications between the first and second network endpoints;
• reference a predefined security policy to determine a validity status of the identified security standard from the handshake message, wherein the predefined security policy includes a definition of supported cipher suites used in the communication between the first and second network endpoints, and wherein the predefined security policy further prevents a resumption of previous communication sessions between the first and second network endpoints;
• verify that the first network endpoint is in possession of a private key associated with a public key in the certificate by intercepting a “Certificate Verify” message from the first network endpoint to the second network endpoint, wherein the “Certificate Verify” message consists of a concatenation of all messages in a handshake between the first and second network endpoints, wherein said all messages in the handshake between the first network endpoint and the second network endpoint include a “Client Hello” message from the first network endpoint to the second network endpoint, a “Server Hello” message from the second network endpoint to the first network endpoint, a “Server Certificate” message from the second network endpoint to the first network endpoint, a “Client Certificate Request” message from the second network endpoint to the first network endpoint, and a “Client Certificate” message from the first network endpoint to the second network endpoint;
• and
• further prevent communication between the first and second network endpoints based on the first and second endpoints complying with the security standard selected for communication between the first and second network endpoints, the first and second endpoints complying with the predefined security policy, and verification that the first network endpoint is in possession of the private key associated with the public key in the certificate based on the “Certificate Verify” message from the first network endpoint to the second network endpoint.

A computer program product for operating a network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code readable and executable by a processor to perform a method comprising:

• intercepting a handshake message transmitted over the network between the first and second network endpoints;
• extracting from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints;
• determining a validity status of the identified security standard based on the security policy;
• preventing communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard;
• extracting an identification of a security standard selected for communication between the first and second network endpoints from the handshake message, wherein the identification of the security standard is determined by extracting a cipher suite from an initial “Server Hello” message from the first network endpoint to the second network endpoint, and wherein the cipher suite is used by the security standard to encrypt communications between the first and second network endpoints;
• referencing a predefined security policy to determine a validity status of the identified security standard from the handshake message, wherein the predefined security policy includes a definition of supported cipher suites used in the communication between the first and second network endpoints, and wherein the predefined security policy further prevents a resumption of previous communication sessions between the first and second network endpoints;
• verifying that the first network endpoint is in possession of a private key associated with a public key in the certificate by intercepting a “Certificate Verify” message from the first network endpoint to the second network endpoint, wherein the “Certificate Verify” message consists of a concatenation of all messages in a handshake between the first and second network endpoints, wherein said all messages in the handshake between the first network endpoint and the second network endpoint include a “Client Hello” message from the first network endpoint to the second network endpoint, a “Server Hello” message from the second network endpoint to the first network endpoint, a “Server Certificate” message from the second network endpoint to the first network endpoint, a “Client Certificate Request” message from the second network endpoint to the first network endpoint, and a “Client Certificate” message from the first network endpoint to the second network endpoint;
• and
• further preventing communication between the first and second network endpoints based on the first and second endpoints complying with the security standard selected for communication between the first and second network endpoints, the first and second endpoints complying with the predefined security policy, and verification that the first network endpoint is in possession of the private key associated with the public key in the certificate based on the “Certificate Verify” message from the first network endpoint to the second network endpoint.