Transport layer security traffic control using service name identification

Patent metadata

Field	Value
Publication number	US-9237168-B2
Application number	US-201213473835-A
Country	US
Kind code	B2
Filing date	May 17, 2012
Priority date	May 17, 2012
Publication date	Jan 12, 2016
Grant date	Jan 12, 2016

Abstract

Traffic control techniques are provided for intercepting an initial message in a handshaking procedure for a secure communication between a first device and a second device at a proxy device. Identification information associated with the second device is extracted from the initial message. A policy is applied to communications between the first device and second device based on the identification information.

First claim

What is claimed is:

1. A method of establishing a connection across a network, comprising:
intercepting at a proxy device a partially encrypted initial message of a handshaking procedure for a secure encrypted communication session between a first device and a second device, wherein the initial message is a ClientHello message of a Transport Layer Security (TLS) handshaking procedure that includes identification information associated with the second device, wherein the identification information comprises a plurality of parameters including host names, categories of hosts, reputations of hosts, and application types, and wherein each parameter has assigned a weight;
extracting from the initial message the identification information associated with the second device;
comparing the plurality of parameters with a plurality of databases to generate comparison results;
balancing the comparison results based on the assigned weights to the parameters to determine a policy; and
applying the policy to communications between the first device and the second device based on the identification information,
wherein extracting the identification information comprises extracting a server name indication extension in the initial message without decrypting the initial message, and
wherein the service name indication extension indicates a host name of the second device.

2. The method of claim 1 , wherein applying comprises comparing the identification information against stored information of devices for which communications are to be blocked, and blocking the secure communication session between the first device and second device when there is a match between the identification information and the stored information.

3. The method of claim 1 , wherein applying comprises comparing the identification information against stored information of host names for devices whose traffic is allowed to be intercepted and decrypted, and further comprising decrypting communications between the first device and second device at the proxy device when there is a match between the identification information and the stored information.

4. The method of claim 1 , wherein applying comprises comparing the identification information with stored information representing categories of hosts and applying a policy to permit access to the second device and/or to decrypt communications between the first device and second device based on a category for the identification information determined from the stored information.

5. The method of claim 1 , wherein applying comprises comparing the identification information with stored information representing reputations of hosts and applying a policy to permit access to the second device and/or to decrypt communications between the first device and second device based on a reputation determined for the identification information from the stored information.

6. The method of claim 1 , wherein applying comprises comparing the identification information with stored information representing application types associated with hosts and applying a policy to permit access to the second device and/or to decrypt communications between the first device and second device based on an application type determined for identification information from the stored information.

7. The method of claim 1 , wherein applying comprises determining whether to permit communications between the first device and second device.

8. The method of claim 1 , wherein applying comprises applying the policy prior to forwarding by the proxy device of the initial message to the second device.

9. The method of claim 1 , wherein applying comprises allowing communications between the first device and the second device without decryption of messages by the proxy device.

10. The method of claim 1 , wherein applying comprises comparing the identification information with stored information and applying a policy to permit access to the second device and/or to decrypt communications between the first device and second device based on the comparing, wherein the stored information represents host names for devices whose traffic is allowed to be intercepted and decrypted, categories of hosts, reputations of hosts and/or application types associated with hosts.

11. An apparatus comprising:
at least one network interface unit configured to transmit and receive messages over a network;
a memory;
a processor coupled to the memory and the at least one network interface, wherein the processor is configured to:
intercept a partially encrypted initial message of a handshaking procedure for a secure encrypted communication session between a first device and a second device, wherein the initial message is a ClientHello message of a Transport Layer Security (TLS) handshaking procedure that includes identification information associated with the second device, wherein the identification information comprises a plurality of parameters including host names, categories of hosts, reputations of hosts, and application types, and wherein each parameter has assigned a weight;
extract from the initial message the identification information associated with the second device;
compare the plurality of parameters with a plurality of databases to generate comparison results;
balance the comparison results based on the assigned weights to the parameters to determine a policy; and
apply the policy to communications between the first device and the second device based on the identification information,
wherein the processor is configured to extract a server name indication extension in the initial message without decrypting the initial, and wherein the server name indication extension indicates a host name of the second device.

12. The apparatus of claim 11 , wherein the memory is further configured to store information of devices for which communications are to be blocked, and wherein the processor is further configured to block the secure communication session between the first device and second device when there is a match between the identification information and the stored information.

13. The apparatus of claim 11 , wherein the processor is configured to compare the identification information with stored information representing host names for devices whose traffic is allowed to be intercepted and decrypted, categories of hosts, reputations of hosts and/or application types associated with hosts, and apply a policy to permit access to the second device and/or to decrypt communications between the first device and second device based on the comparing.

14. A non-transitory computer readable tangible storage media encoded with instructions that, when executed by a processor, cause the processor to:
intercept at a proxy device a partially encrypted initial message of a handshaking procedure for a secure encrypted communication session between a first device and a second device, wherein the initial message is a ClientHello message of a Transport Layer Security (TLS) handshaking procedure that includes identification information associated with the second device, wherein the identification information comprises a plurality of parameters including host names, categories of hosts, reputations of hosts, and application types, and wherein each parameter has assigned a weight;
extract from the initial message the identification information associated with the second device;
compare the plurality of parameters with a plurality of databases to generate comparison results;
balance the comparison results based on the assigned weights to the parameters to determine a policy; and
apply the policy to communications b

Assignees

• Wang Jianxin
• Shankar Hari
• Highland Trevor
• Koduri Niranjan
• Odnert Daryl
• Cisco Tech Inc

Inventors

• Wang Jianxin
• Shankar Hari
• Highland Trevor
• Koduri Niranjan
• Odnert Daryl

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title