Methods for inspecting security certificates by network security devices to detect and prevent the use of invalid certificates

• US 8,850,576 B2
• Filed: 03/04/2012
• Issued: 09/30/2014
• Est. Priority Date: 01/20/2009
• Status: Active Grant

• Current Assignee: Check Point Software Technologies Limited
• Original Assignee: Check Point Software Technologies Limited
• Inventors: Guzner, Guy, Haviv, Ami, Lieblich, Danny, Gal, Yahav
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/411,567
• Publication Number:
  US 20120167212A1
• Time in Patent Office: 940 Days
• Field of Search: 726/22, 726/10, 713/156
• US Class Current: 726/22
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Disclosed are methods and media for inspecting security certificates. Methods include the steps of: scanning, by a network security device, messages of a security protocol between a server and a client system; detecting the messages having a security certificate; detecting suspicious security certificates from the messages; and aborting particular sessions of the security protocol associated with the suspicious certificates. Preferably, the step of scanning is performed only on messages of server certificate records. Preferably, the method further includes the step of sending an invalid-certificate notice to the server and the client system. Preferably, the step of detecting the suspicious certificates includes detecting a use of an incorrectly-generated private key for the certificates. Preferably, the step of detecting the suspicious certificates includes detecting an unavailability of revocation information for the certificates. Preferably, the step of detecting the suspicious certificates includes detecting a use of an invalid cryptographic algorithm for the certificates.

Claims

1. A method for inspecting security certificates, the method comprising the steps of by a network security device:

(a) detecting messages, of a security protocol between a server and a client system, that have a security certificate;

(b) detecting suspicious security certificates from said messages, by steps including;

(i) scanning said messages for an object ID (OID) of a compromised cryptographic hash function, and

(ii) scanning said messages for an OID of a certificate extension;

(iii) upon detecting said OID of said certificate extension in said messages, checking a comment length of said OID of said certificate extension for invalid-certificate criteria, said invalid-certificate criteria including an excessive comment length and at least one non-ASCII character contained in said OID of said certificate extension; and

(c) aborting sessions of said security protocol associated with said suspicious security certificates that are determined, by said detecting of said suspicious security certificates, to be invalid.

2. The method of claim 1, wherein said step of detecting suspicious security certificates is performed only on messages of server certificate records.

3. The method of claim 1, the method further comprising the step of:

(d) sending an invalid-certificate notice to said server and said client system.

4. The method of claim 1, wherein said step of detecting said suspicious security certificates further includes:

(iv) prior to said step of checking, determining that said OID of said compromised cryptographic hash function and said OID of said certificate extension are in the same trust chain member by searching for a second appearance of said OID of said compromised cryptographic hash function.

5. The method of claim 1, wherein said step of detecting said suspicious security certificates includes detecting a use of an incorrectly-generated private key for said security certificates.

6. The method of claim 1, wherein said step of detecting said suspicious security certificates includes detecting an unavailability of revocation information for said security certificates.

7. The method of claim 1, wherein said step of detecting said suspicious security certificates includes detecting a use of an invalid cryptographic algorithm for said security certificates.

8. A non-transitory computer-readable storage medium having computer-readable code embodied on the computer-readable storage medium, the computer-readable code being for inspection of security certificates by a network security device, the computer-readable code comprising:

(a) program code for detecting messages, of a security protocol between a server and a client system, that have a security certificate;

(b) program code, for detecting suspicious security certificates from said messages, including;

(i) program code for scanning said messages for an object ID (OID) of a compromised cryptographic hash function, and

(ii) program code for scanning said messages for an OID of a certificate extension;

(iii) program code for, upon detecting said OID of said certificate extension in said messages, checking a comment length of said OID of said certificate extension for invalid-certificate criteria, said invalid-certificate criteria including an excessive comment length of more than 200 bytes and at least one non-ASCII character contained in said OID of said certificate extension; and

,

(c) program code for aborting sessions of said security protocol associated with said suspicious security certificates that are determined, by said detecting of said suspicious security certificates, to be invalid.

9. The storage medium of claim 8, wherein said program code for detecting suspicious security certificates is performed only on messages of server certificate records.

10. The storage medium of claim 8, the computer-readable code further comprising:

(d) program code for sending an invalid-certificate notice to said server and said client system.

11. The storage medium of claim 8, wherein said program code for detecting said suspicious security certificates further includes:

(iv) program code for, prior to said checking, determining that said OID of said compromised cryptographic hash function and said OID of said certificate extension are in the same trust chain member by searching for a second appearance of said OID of said compromised cryptographic hash function.

12. The storage medium of claim 8, wherein said program code for detecting said suspicious security certificates includes program code for detecting a use of an incorrectly-generated private key for said security certificates.

13. The storage medium of claim 8, wherein said program code for detecting said suspicious security certificates includes program code for detecting an unavailability of revocation information for said security certificates.

14. The storage medium of claim 8, wherein said program code for detecting said suspicious security certificates includes program code for detecting a use of an invalid cryptographic algorithm for said security certificates.