Endpoint-assisted inspection of encrypted network traffic

Patent metadata

Field	Value
Publication number	US-12088607-B2
Application number	US-202418592137-A
Country	US
Kind code	B2
Filing date	Feb 29, 2024
Priority date	Aug 10, 2018
Publication date	Sep 10, 2024
Grant date	Sep 10, 2024

Abstract

In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session.

First claim

What is claimed is:

1. A method, comprising:
monitoring, by a monitoring agent executing on an endpoint device, a memory space of the endpoint device associated with an application or a dedicated process hosted by the endpoint device;
detecting from the memory space, by the monitoring agent, a handshake initiated between an application hosted on the endpoint device and a remote entity, the handshake initiated to establish an encrypted traffic session between the application and the remote entity;
capturing from the memory space of the endpoint device, by the monitoring agent, session key information for the encrypted traffic session between the endpoint device and the remote entity, wherein session keys are established during the handshake and are obtained after the encrypted traffic session is formed;
transmitting the session key information to a traffic inspection service hosted on an intermediary device located between the endpoint device and the remote entity over a secure connection;
using, by the traffic inspection service, the session key information to decrypt encrypted traffic from the encrypted traffic session, resulting in decrypted traffic;
applying, by the traffic inspection service and based on the decrypted traffic comprising cleartext from the encrypted traffic session, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine whether the decrypted traffic is malicious or against the policy; and
performing, by the traffic inspection service, a mitigation action in response to a determination that the decrypted traffic is malicious or against the policy.

2. The method of claim 1 wherein the session key information is received by the traffic inspection service before first data packets of the encrypted traffic session are received at the traffic inspection service.

3. The method of claim 1 wherein the monitoring agent conditionally transmits the session key information to the traffic inspection service based on one or more conditions.

4. The method of claim 3 wherein the one or more conditions include a process involved in the encrypted traffic session being malicious.

5. The method of claim 3 wherein the one or more conditions include the encrypted traffic session potentially including personally identifiable information.

6. The method of claim 1 wherein the encrypted traffic session comprises a Transport Layer Security (TLS) session and the handshake comprises a TLS handshake.

7. The method of claim 1 wherein the traffic inspection service comprises a firewall.

8. The method of claim 1 wherein the traffic inspection service comprises an intrusion detection system.

9. The method of claim 1 further comprising receiving, by the monitoring agent from the traffic inspection service, a notification that acknowledges receipt of the session key information.

10. The method of claim 1 wherein the policy comprises a security policy or a data privacy policy.

11. A system, comprising:
a monitoring agent installed on an endpoint device, the monitoring agent operative to:
monitor a memory space of the endpoint device associated with an application or a dedicated process hosted by the endpoint device;
detect from the memory space, by the monitoring agent, a handshake initiated between an application hosted on the endpoint device and a remote entity, the handshake initiated to establish an encrypted traffic session between the application and the remote entity;
capture from the memory space of the endpoint device, by the monitoring agent, session key information for the encrypted traffic session between the endpoint device and the remote entity, wherein session keys are established during the handshake and are obtained after the encrypted traffic session is formed; and
transmit the session key information to a traffic inspection service hosted on an intermediary device located between the endpoint device and the remote entity over a secure connection;
the traffic inspection service operative to:
use the session key information to decrypt encrypted traffic from the encrypted traffic session, resulting in decrypted traffic;
apply, based on the decrypted traffic comprising cleartext from the encrypted traffic session, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine whether the decrypted traffic is malicious or against the policy; and
perform a mitigation action in response to a determination that the decrypted traffic is malicious or against the policy.

12. The system of claim 11 wherein the session key information is received by the traffic inspection service before first data packets of the encrypted traffic session are received at the traffic inspection service.

13. The system of claim 11 wherein the monitoring agent conditionally transmits the session key information to the traffic inspection service based on one or more conditions.

14. The system of claim 13 wherein the one or more conditions include a process involved in the encrypted traffic session being malicious.

15. The system of claim 13 wherein the one or more conditions include the encrypted traffic session potentially including personally identifiable information.

16. The system of claim 11 wherein the encrypted traffic session comprises a Transport Layer Security (TLS) session and the handshake comprises a TLS handshake.

17. The system of claim 11 wherein the traffic inspection service comprises a firewall.

18. The system of claim 11 wherein the traffic inspection service comprises an intrusion detection system.

19. The system of claim 11 wherein the monitoring agent is operative to receive from the traffic inspection service, a notification that acknowledges receipt of the session key information.

20. The system of claim 11 wherein the policy comprises a security policy or a data privacy policy.

Assignees

• Cisco Tech Inc

Inventors

• Rehak Martin
• Mcgrew David
• Anderson Blake Harrell
• Dunlop Scott William

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title