Method and apapratus for content, endpoint, and protocol man-in-the-middle user interface

• US 9,628,420 B1
• Filed: 06/28/2012
• Issued: 04/18/2017
• Est. Priority Date: 09/28/2011
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.), Michel F. Fisher, Stephen J. Todd, Wayne A. Pauley Jr
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Pauley, Jr., Wayne A., Todd, Stephen J., Fisher, Michel F.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Kanaan, Simon
• Application Number:
  US13/536,504
• Time in Patent Office: 1,755 Days
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Example embodiments of the present invention relate to a method, an apparatus and a computer-program product for friendly man-in-the-middle data stream correlation. An example method includes receiving a data stream transmitted from a source intended for a destination. A contextual analysis of portions of the data stream then may be performed, with respective portions of the data stream being correlated according to the contextual analysis.

Claims

1. A method for friendly man-in-the-middle data stream correlation, the method comprising:

intercepting a plurality of respective data streams associated with corresponding respective different communications services at respective times that the data streams are attempting to be communicated between a first device in a network and a one or more of a plurality of second devices outside the network, the intercepting done by an intercepting device in the network, wherein the intercepting comprises intercepting the plurality of data streams before the plurality of respective data streams are permitted to be communicated between the first device and any one or more of the second devices;

performing by the intercepting device an analysis of context and content of the plurality of respective data streams, the analysis determining, based at least in part on context and content of the respective data streams, whether any one or more of the data streams are part of a conversation;

correlating a first data stream and a second data stream as being associated with a first conversation, according to the context and content of the first data stream and the second data stream; and

permitting the first and second data streams to be communicated between the first device and any one or more respective second devices associated with the first conversation, if the first and second data streams satisfy a predetermined condition.

2. The method of claim 1 wherein correlating a first respective data stream and a second respective data stream according to the context and content of the first respective data stream and the second respective data stream comprises:

correlating the first respective data stream and the second respective data stream according to a determination of whether the context and the content of the first respective data stream and the second respective data stream may be parts of the same conversation; and

presenting the correlated first respective data stream and second respective data stream to a user interface.

3. The method of claim 2 wherein correlating the first respective data stream and the second respective data stream according to a determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated comprises correlating the first respective data stream and the second respective data stream according to the determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated according to a policy.

4. The method of claim 2 wherein performing by the intercepting device an analysis of context and content of respective data stream data streams comprises:

inspecting context of respective data stream data streams according to a protocol associated with each respective data stream; and

inspecting content of respective data streams for values satisfying a policy.

5. The method of claim 4 wherein correlating the first respective data stream and the second respective data stream according to a determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated comprises correlating the first respective data stream and the second respective data stream regardless of the respective protocols associated with the first respective data stream and the second respective data stream;

and

wherein presenting the correlated first respective data stream and second respective data stream comprises presenting the correlated first respective data stream and second respective data stream to a user interface regardless of the respective protocol associated with the first respective data stream and the second respective data stream.

6. The method of claim 1, further comprising providing a user interface configured to display information related to the intercepted plurality of respective data streams based at least in part on the type of content included in a respective data stream, one or more endpoints of a respective communication associated with a respective data stream, and a correlation of the content signature to content type.

7. An apparatus for friendly man-in-the-middle data stream correlation, the apparatus comprising:

a receiver module configured to intercept a plurality of respective data streams associated with corresponding respective different communications services at respective times that the data streams are attempted to be communicated between a first device in a network with the apparatus and a one or more of a plurality of second devices outside the network, wherein the receiver module is configured to intercept the plurality of data streams before the plurality of respective data streams are permitted to be communicated between the first device and any one or more of the second devices;

an analysis engine configured to perform an analysis of context and content of the plurality of respective data streams to determine, based at least in part on context and content of the respective data streams, whether any one or more of the data streams is part of a conversation; and

a correlation engine configured to correlate a first data stream and a second data stream as being associated with a first conversation, according to the context and content of the first data stream and the second data stream, wherein the correlation engine is configured to permit the first and second data streams to be communicated between the first device and any one or more respective second devices associated with the first conversation, if the first and second data streams satisfy a predetermined condition.

8. The apparatus of claim 7 wherein the correlation engine comprises:

a correlation module configured to correlate the first respective data stream and the second respective data steam according to a determination of whether the context and the content of the first data stream and the second respective data stream may be related as being part of a first conversation; and

a presentation module configured to present the first respective data stream and second respective data stream to a user interface.

9. The apparatus of claim 8 wherein the correlation module is further configured to correlate the first respective data stream and the second respective data stream according to the determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated according to a policy.

10. The apparatus of claim 8 wherein the inspection module is configured to inspect context of respective data streams according to a protocol associated with each respective data stream, and inspect content of respective data streams for values satisfying a policy.

11. The apparatus of claim 10

wherein the correlation module is further configured to correlate the first respective data stream and the second respective data stream regardless of the respective protocols associated with the first respective data stream and the second respective data stream;

and

wherein the presentation module is further configured to present the correlated first respective data stream and second respective data stream to a user interface regardless of the respective protocol associated with the first respective data stream and the second respective data stream.

12. A computer program product including a non-transitory computer-readable storage medium encoded with computer-program code that, when executed on a processor of a computer, cause the computer to perform friendly man-in-the-middle data stream correlation, the computer-program product comprising:

computer program code for intercepting a plurality of respective data streams associated with corresponding respective different communications services at respective times that the data streams are attempted to be communicated between a first device in a network intended and one or more of a plurality of second devices outside the network, the intercepting done by an intercepting device in the network;

computer program code for intercepting the plurality of data streams before the plurality of respective data streams are permitted to be communicated between the first device and any one or more of the second devices;

computer program code for performing by the intercepting device an analysis of context and content of respective data streams, the analysis determining, based at least in part on context and content of the respective data streams, whether any one or more of the data streams is part of a conversation;

computer program code for correlating a first data stream and a second data stream as being associated with a first conversation, according to the context and content of the first data stream and the second data stream; and

computer program code permitting the first and second data streams to be communicated between the first device and any one or more respective second devices associated with the first conversation, if the first and second data streams satisfy a predetermined condition.

13. The computer program product of claim 12, wherein computer program code for correlating the first respective data stream and a second respective data stream according to the context and content of the first respective data stream and the second respective data stream comprises:

computer program code for correlating the first respective data stream and the second respective data stream according to a determination of whether the context and the content of the first respective data stream and the second respective data stream may be parts of the same conversation; and

computer program code for presenting the correlated first respective data stream and second respective data stream to a user interface.

14. The computer program product of claim 13 wherein computer program code for correlating the first respective data stream and the second respective data stream according to a determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated comprises computer program code for correlating the first respective data stream and the second respective data stream according to the determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated according to a policy.

15. The computer program product of claim 14 wherein computer program code for performing by the intercepting device an analysis of context and content of respective data streams comprises:

computer program code fix inspecting context of respective data streams according to a protocol associated with each respective data stream; and

computer program code for inspecting content of respective data streams for values satisfying a policy.

16. The computer program product of claim 15

wherein computer program code for correlating the first respective data stream and the second respective data stream according to a determination of whether the context and the content of the first respective data stream and the second respective data stream may be correlated comprises computer program code for correlating the first respective data stream and the second respective data stream regardless of the respective protocols associated with the first respective data stream and the second respective data stream;

and

wherein computer program code for presenting the correlated first respective data stream and second respective data stream comprises computer program code for presenting the correlated first respective data stream and second respective data stream to a user interface regardless of the respective protocols associated with the first respective data stream and the second respective data stream.