Encrypted network traffic interception and inspection

• US 9,118,700 B2
• Filed: 10/01/2013
• Issued: 08/25/2015
• Est. Priority Date: 06/18/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Lifliand, Vladimir, Ben-Menahem, Avraham Michael
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sanders, Stephen
• Application Number:
  US14/043,273
• Publication Number:
  US 20140215610A1
• Time in Patent Office: 693 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A method of operating a computing device that allows inspecting data that the device attempts to transmit over a network in an encrypted form for presence of malware, viruses or confidential information. The method includes intercepting a request from an application to an encryption component of an operating system to encrypt the data and acquiring encrypted data generated by the encryption component in response to the request. SSL or TLS protocol may be used for encryption. The request may be intercepted using API hooking. The data in an unencrypted form and an identifier of the encrypted data may be provided to a data inspection facility for establishing a correspondence between the unencrypted and encrypted data, using the identifier. The data inspection facility performs inspection of the unencrypted data to determine whether to allow transmission of the encrypted data over the network.

Claims

1. A method of operating a computer comprising at least one processor, the method comprising:

with the at least one processor;

receiving at least one request from an application at a first component, wherein the application directed the request to a second component configured to encrypt unencrypted data, and wherein the application is unaware of the receipt by the first component;

receiving encrypted data generated by the second component upon the second component encrypting the unencrypted data in response to the request of the application;

sending the encrypted data to a data inspection facility; and

sending the unencrypted data to the data inspection facility,

wherein the data inspection facility determines whether portions of the encrypted data correspond with portions of the unencrypted data, and wherein the data inspection facility determines whether to allow through-pass of the received encrypted data over a network based on, at least in part, a result of the determination of correspondence.

2. The method of claim 1, wherein the data inspection facility determines whether to allow through-pass of the received encrypted data over the network based, at least in part, upon an inspection of the unencrypted data.

3. The method of claim 2, wherein inspection of the unencrypted data is based on a policy.

4. The method of claim 1, wherein the data inspection facility determines whether portions of the encrypted data correspond with portions of the unencrypted data based upon an identifier of the encrypted data received from the first component.

5. The method of claim 1 further comprising sending an identifier of the encrypted data with the unencrypted data to the data inspection facility, wherein the identifier is used by the data inspection facility to determine whether portions of the encrypted data correspond with portions of the unencrypted data.

6. The method of claim 5, wherein the identifier is a subset of the encrypted data.

7. The method of claim 1, wherein the second component is configured to encrypt unencrypted data in accordance with a Secure Socket Layer (SSL) protocol.

8. A computer readable storage memory comprising computer-executable instructions, that when executed by a processor, perform a method comprising:

receiving at least one request from an application at a first component, wherein the application directed the request to a second component configured to encrypt unencrypted data, and wherein the application is unaware of the receipt by the first component;

receiving encrypted data generated by the second component upon the second component encrypting the unencrypted data in response to the request of the application;

sending the encrypted data to a third component; and

sending the unencrypted data to the third component,

wherein the third component determines whether portions of the encrypted data correspond with portions of the unencrypted data, and wherein the third component determines whether to allow through-pass of the received encrypted data over a network based on, at least in part, a result of the determination of correspondence.

9. The computer readable storage memory of claim 8, wherein the third component determines whether to allow through-pass of the received encrypted data over the network based, at least in part, upon an inspection of the unencrypted data.

10. The computer readable storage memory of claim 9, wherein inspection of the unencrypted data is based on a policy that defines a type of information that is not permitted to be transmitted.

11. The computer readable storage memory of claim 8, wherein the third component determines whether portions of the encrypted data correspond with portions of the unencrypted data based upon an identifier of the encrypted data received from the first component.

12. The computer readable storage memory of claim 8 further comprising sending an identifier of the encrypted data with the unencrypted data to the third component, wherein the identifier is used by the third component to determine whether portions of the encrypted data correspond with portions of the unencrypted data.

13. The computer readable storage memory of claim 12, wherein the identifier is a subset of the encrypted data.

14. The computer readable storage memory of claim 8, wherein the second component is configured to encrypt unencrypted data in accordance with a Secure Socket Layer (SSL) protocol.

15. A computer system for controlling transmission of data over a network, comprising:

a processor coupled to a memory, the memory comprising;

a first component that;

receives at least one request from an application, wherein the application directed the request to a second component configured to encrypt unencrypted data, and wherein the application is unaware of the receipt by the first component;

receives encrypted data generated by the second component upon the second component encrypting the unencrypted data in response to the request of the application;

sending the encrypted data to a data inspection facility; and

sending the unencrypted data to the data inspection facility,

wherein the data inspection facility determines whether portions of the encrypted data correspond with portions of the unencrypted data, and wherein the data inspection facility determines whether to allow through-pass of the received encrypted data over a network based on, at least in part, a result of the determination of correspondence.

16. The system of claim 15, wherein the data inspection facility determines whether to allow through-pass of the received encrypted data over the network based, at least in part, upon an inspection of the unencrypted data.

17. The system of claim 16, wherein inspection of the unencrypted data is based on a policy.

18. The system of claim 17, wherein based the policy defines a type of information that is not permitted to be transmitted.

19. The system of claim 15, wherein the data inspection facility determines whether portions of the encrypted data correspond with portions of the unencrypted data based upon an identifier of the encrypted data received from the first component.

20. The system of claim 15, wherein the first component further sends an identifier of the encrypted data with the unencrypted data to the data inspection facility, wherein the identifier is used by the data inspection facility to determine whether portions of the encrypted data correspond with portions of the unencrypted data.