Selectively performing man in the middle decryption

• US 9,781,082 B2
• Filed: 03/10/2016
• Issued: 10/03/2017
• Est. Priority Date: 05/08/2013
• Status: Active Grant

• Current Assignee: iBoss
• Original Assignee: iBoss
• Inventors: Martini, Paul Michael
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US15/066,846
• Publication Number:
  US 20160197890A1
• Time in Patent Office: 572 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

An agent on a device within a network receives a request to access a resource outside the network. A first encrypted connection is established between the device and the agent, and a second encrypted connection is established between the agent and the resource, to facilitate encrypted communication traffic between the device and the resource. The agent sends a policy request to a network appliance within the network, the request specifying the resource. The agent receives a policy response indicating that the resource is associated with one or more security policies of the network. Traffic passing between the device and the resource is selectively decrypted and inspected depending on the security policies.

Claims

1. A system comprising:

a network hosting a policy manager and a first plurality of clients each of the first plurality of client comprising an agent; and

a second plurality of clients, each of the second plurality of clients external to the network and communicably coupled with the policy manager, wherein each of the second plurality of clients comprises an agent;

the policy manager configured to;

receive, from each of the agents of the first plurality of clients and from each of the agents of the second plurality of clients, policy requests; and

return, responsive to receiving the policy, a corresponding policy response indicating a policy;

wherein the agents are configured to;

receive, from the agent'"'"'s client, a resource request;

responsive to receiving the resource request, send to the policy manager the policy requests;

receive, from the policy manager, the corresponding policy responses; and

apply, to the agent'"'"'s client, the policy indicated by the corresponding policy response to the resource request;

wherein to apply the policy indicated by the corresponding policy response to the resource request, the agent is further configured to;

receive first encrypted communication traffic from a first encrypted connection;

decrypt the first encrypted communication traffic into first decrypted communication traffic;

inspect the first decrypted communication traffic;

encrypt the first decrypted communication traffic into second encrypted communication traffic;

transmit, to the agent'"'"'s client, the second encrypted communication traffic on a second encrypted connection;

receive third encrypted communication traffic from the agent'"'"'s client on the second encrypted connection;

decrypt the third encrypted communication traffic into second decrypted communication traffic;

inspect the second decrypted communication traffic;

encrypt the second decrypted communication traffic into fourth encrypted communication traffic; and

send the fourth encrypted communication traffic on the first encrypted connection.

2. The system of claim 1 wherein some of the first plurality of clients are configured to move off of the network;

and wherein some of the second plurality of clients are configured to move onto the network.

3. The system of claim 1 wherein the agents are configured to install certificates on the agents'"'"' clients.

4. The system of claim 1 wherein the agents are drivers installed on network stacks.

5. The system of claim 1, wherein to apply the policy indicated by the corresponding policy response to the resource request, the agent is configured to perform one of the group consisting of logging, blocking the request, and modifying the resource.

6. A method performed by data processing apparatus, the method comprising:

receiving, by a policy manager, policy requests from a first plurality of clients wherein each of the clients comprises an agent, at least a first plurality of the clients being hosted on a network that hosts the policy manager, at least a second plurality of clients being external to the network and communicably coupled with the policy manager, wherein the policy manager is configured to receive, from each of the agents of the first plurality of clients and from each of the agents of the second plurality of clients, other policy requests, and each of the agents are configured to;

receive, from the agent'"'"'s client, a resource request;

responsive to receiving the resource request, send to the policy manager the policy request;

receive, from the policy manager, a corresponding policy response; and

apply, to the agent'"'"'s client, a policy indicated by the corresponding policy response to the resource request; and

returning, by the policy manager, the corresponding policy response indicating the policy;

wherein to apply the policy indicated by the corresponding policy response to the resource request, each of the agents are configured to;

receive first encrypted communication traffic from a first encrypted connection;

decrypt the first encrypted communication traffic into first decrypted communication traffic;

inspect the first decrypted communication traffic;

encrypt the first decrypted communication traffic into second encrypted communication traffic;

transmit, to the agent'"'"'s client, the second encrypted communication traffic on a second encrypted connection;

receive third encrypted communication traffic from the agent'"'"'s client on the second encrypted connection;

decrypt the third encrypted communication traffic into second decrypted communication traffic;

inspect the second decrypted communication traffic;

encrypt the second decrypted communication traffic into fourth encrypted communication traffic; and

send the fourth encrypted communication traffic on the first encrypted connection.

7. The method of claim 6 wherein some of the first plurality of clients are configured to move off of the network;

and wherein some of the second plurality of clients are configured to move onto the network.

8. The method of claim 6 wherein the agents are configured to install certificates on the agents'"'"' clients.

9. The method of claim 6 wherein the agents are drivers installed on network stacks.

10. The method of claim 6 wherein to apply the policy indicated by the corresponding policy response to the resource request, the agent is configured to perform one of the group consisting of logging, blocking the request, and modifying the resource.