Decryption system and method for network analyzers and security programs

• US 7,590,844 B1
• Filed: 04/26/2002
• Issued: 09/15/2009
• Est. Priority Date: 04/26/2002
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Lawler, Geoffrey T., Heyman, Michael D., Sherman, David L., Sterne, Daniel F.
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US10/133,792
• Time in Patent Office: 2,699 Days
• Field of Search: None
• US Class Current: 713/171
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system, method and computer program product are provided for decrypting network communications. Initially, encrypted network communications are identified. A key is then received. Such key is subsequently utilized to decrypt the encrypted network communications. In use, the key is conditionally received based on predetermined criteria.

Claims

1. A system, comprising:

a cryptographic interceptor module coupled between an application and a cryptographic supplier for intercepting keys, the application residing on a first computer;

a key broker module coupled to the cryptographic interceptor module for storing the keys, the key broker module residing on a second computer coupled to the first computer via at least one network for receiving the keys from the cryptographic interceptor module on the first computer via the at least one network; and

a tool coupled to the key broker module, the tool adapted for identifying encrypted network communications, requesting at least one of the keys, and utilizing the at least one key to decrypt the encrypted network communications, the tool residing on a third computer coupled to the second computer via the at least one network for receiving the at least one key from the key broker module on the second computer via the at least one network;

wherein the system is operable such that the cryptographic interceptor module conditionally intercepts the keys based on a policy;

wherein the cryptographic interceptor module includes a shim between the application and the cryptographic supplier; and

wherein the key broker module does not receive the keys from the cryptographic interceptor module if it is determined that the tool is an interactive process under control of a human user.

2. The system as recited in claim 1, wherein the at least one key is used to decrypt the encrypted network communications by utilizing a security program.

3. The system as recited in claim 1, wherein the at least one key is used to decrypt the encrypted network communications by utilizing a network analyzer.

4. The system as recited in claim 1, wherein the key broker module conditionally receives the keys based on the policy.

5. The system as recited in claim 4, wherein the policy includes information associated with a user receiving the encrypted network communications, a web site associated with the encrypted network communications, and a process type receiving the encrypted network communications.

6. The system as recited in claim 4, wherein the policy is unique to the cryptographic interceptor module.

7. The system as recited in claim 1, wherein the key broker module conditionally receives the keys from the cryptographic interceptor module.

8. The system as recited in claim 7, and further comprising receiving a request from the application for the encrypted network communications over the network utilizing the cryptographic interceptor module, identifying the policy utilizing the cryptographic interceptor module, and conditionally sharing the at least one key with the key broker module based on the policy utilizing the cryptographic interceptor module.

9. The system as recited in claim 1, wherein the keys are received in response to a request.

10. The system as recited in claim 9, wherein the request includes information.

11. The system as recited in claim 10, wherein the keys are conditionally received based on whether the information meets predetermined criteria.

12. The system as recited in claim 1, wherein the at least one key is encrypted.

13. The system as recited in claim 12, wherein the at least one key is decrypted based on user input.

14. The system as recited in claim 1, wherein the at least one key is indexed.

15. The system as recited in claim 1, wherein the key broker module conditionally receives the keys based on end points of a connection.

16. The system as recited in claim 1, wherein the key broker module conditionally receives the keys based on a type of the tool.