Methods and systems for certificate filtering

Patent metadata

Field	Value
Publication number	US-12395481-B2
Application number	US-202117180932-A
Country	US
Kind code	B2
Filing date	Feb 22, 2021
Priority date	Mar 5, 2019
Publication date	Aug 19, 2025
Grant date	Aug 19, 2025

Abstract

SSL/TLS certificate filtering devices, systems and processes may filter packets based on risk associated with each packet. A risk score may be determined for each packet based on associated threats and risks. Risk scores may be determined based on certificates, certificate authorities, and/or end users associated with each packet. The certificates may be scored and/or categorized by threats and risk.

First claim

What is claimed is:

1. A method comprising:
receiving, by a certificate data collector and from one or more threat intelligence providers, threat intelligence data associated with a plurality of hosts, wherein the threat intelligence data indicates a first host that has been identified as a potential threat by the one or more threat intelligence providers;
in response to receiving the threat intelligence data, determining, by the certificate data collector, one or more certificate authorities that have issued one or more certificates to the first host;
receiving, by the certificate data collector and from one or more external systems that identify certificates and certificate authorities associated with hosts, certificate authority intelligence information associated with the one or more certificate authorities that were determined to have issued the one or more certificates to the first host;
determining a risk score associated with each certificate authority of the one or more certificate authorities, wherein the risk score associated with a particular certificate authority is determined based on:
the threat intelligence data indicating that the first host has been identified as a potential threat by the one or more threat intelligence providers; and
the certificate authority intelligence information associated with the one or more certificate authorities indicating that the particular certificate authority issued a certificate to the first host;

sending, to a client system, the determined risk scores associated with each certificate authority of the one or more certificate authorities;
generating, based on the determined risk scores associated with each certificate authority, one or more packet-filtering rules; and
sending, to a packet-filtering device associated with the client system, the one or more packet-filtering rules, wherein the packet-filtering device is configured to apply the one or more packet-filtering rules to network traffic.

2. The method of claim 1 , wherein the client system is further configured to generate, based on the determined risk scores associated with each certificate authority, one or more second packet-filtering rules.

3. The method of claim 1 , wherein the threat intelligence data comprises at least one of:
a domain name associated with the first host; or
an internet protocol (IP) address associated with the first host.

4. The method of claim 1 , wherein the one or more certificates form a chain of trust.

5. The method of claim 1 , further comprising:
determining a first risk score associated with a first certificate authority based on identifying the first certificate authority as being associated with a cyber threat organization.

6. The method of claim 1 , wherein determining the risk score associated with each certificate authority comprises:
assigning, based on one or more threat indicators identified in the threat intelligence data, a risk score to each certificate authority that issued a certificate to the first host.

7. The method of claim 1 , further comprising:
determining, based on the threat intelligence data, a second risk score associated with each respective certificate of one or more certificates issued to the first host; and
sending, by the certificate data collector and to a packet-filtering device associated with the client system, the second risk score associated with each respective certificate of the one or more certificates issued to the first host, along with the risk scores associated with each certificate authority.

8. The method of claim 7 , further comprising:
generating, based on the risk scores associated with each certificate authority and based on the second risk score associated with each respective certificate of the one or more certificates, a packet-filtering rule.

9. The method of claim 1 , wherein the risk score associated with the particular certificate authority is further based on at least one of:
a determination of whether the particular certificate authority issued a second certificate to known malware sites;
a determination of whether a second certificate has been revoked; or
a determination that the certificate issued to the first host is a self-signed certificate.

10. The method of claim 1 , wherein the client system comprises a packet-filtering device that resides at a boundary between, and interfaces with, a protected network and an unprotected network.

11. The method of claim 1 , wherein the one or more packet-filtering rules comprise one or more rules configured to:
protect a network associated with the client system from malicious network traffic; or
prevent malicious traffic from leaving the network associated with the client system.

12. A certificate data collector comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the certificate data collector to:
receive, from one or more threat intelligence providers, threat intelligence data associated with a plurality of hosts, wherein the threat intelligence data indicates a first host that has been identified as a potential threat by the one or more threat intelligence providers;
determine, in response to receiving the threat intelligence data, one or more certificate authorities that have issued one or more certificates to the first host;
receive, from one or more external systems that identify certificates and certificate authorities associated with hosts, certificate authority intelligence information associated with the one or more certificate authorities that were determined to have issued the one or more certificates to the first host;
determine a risk score associated with each certificate authority of the one or more certificate authorities, wherein the risk score associated with a particular certificate authority is determined based on:
the threat intelligence data indicating that the first host has been identified as a potential threat by the one or more threat intelligence providers; and
the certificate authority intelligence information associated with the one or more certificate authorities indicating that the particular certificate authority issued a certificate to the first host;

send, to a client system, the determined risk scores associated with each certificate authority of the one or more certificate authorities;
generate, based on the determined risk scores associated with each certificate authority, one or more packet-filtering rules; and
send, to a packet-filtering device associated with the client system, the one or more packet-filtering rules, wherein the packet-filtering device is configured to apply the one or more packet-filtering rules to network traffic.

13. The certificate data collector of claim 12 , wherein the client system is further configured to generate, based on the determined risk scores associated with each certificate authority, one or more second packet-filtering rules.

14. The certificate data collector of claim 12 , wherein the threat intelligence data comprises at least one of:
a domain name associated with the first host; or
an internet protocol (IP) address associated with the first host.

15. The certificate data collector of claim 12 , wherein the one or more certificates form a chain of trust.

16. The certificate data collector of claim 12 , wherein the instructions, when executed by the one or more processors, cause the certificate data collector to determine a first risk score associated with a first certificate authority by identifying the first certificate authority as being associated with a cybe

Assignees

• Centripetal Networks Llc

Inventors

• Moore Sean
• Ahn David K

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04W12/67

  Risk-dependent, e.g. selecting a security level depending on risk profiles · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title