Methods and systems for filtering encrypted traffic
View Patent ↗Application programming interface (API) hooks are injected into an application program executing at a client during run-time. Responsive to these hooks, data intended for encryption prior to transmission from the client is diverted, for example for content filtering, compression, etc., prior to being encrypted. In the case of encrypted data received at the client, the data is decrypted but before being passed to the application it is diverted, under control of the API hooks, for content filtering, decompression, etc.
1. A method for filtering data to be securely transmitted from a client to a remote computer system, comprising:
injecting, at run-time, one or more hooks on application programming interface (API) calls within an application executing on the client;
catching, using the hooks, calls from the application concerning encryption of the data to be transferred to the remote computer system;
diverting the data away from said encryption and towards an instruction layer for filtering just prior to said encryption, wherein the data is filtered at the instruction layer;
directing the filtered data to an encryption engine, wherein the data is encrypted at the encryption engine; and
initiating a secure transmission of the encrypted data from the client to the remote computer system, thereby causing the data to be filtered before being encrypted and securely transmitted to the remote computer system;
wherein the hooks are injected at one or more of the following hook points within the application: wininet!InternetConnectA, wininet!HttpOpenRequestA, wininet!InternetCloseHandle, wininet!InternetOpen, wininet!InternetOpenURL, wininet!HttpOpenRequest/Ex, wininet!InternetReadFile, and wininet!InternetWriteFile.
2. The method of claim 1 , wherein the filtering occurs at the client.
3. The method of claim 1 , wherein the encryption engine is remotely located from the client on which the application is executing.
4. The method of claim 1 , wherein the hooks are injected at one or more of the following hook points within the application: nspr4!PR_Close, nspr4!PR_Connect, ssl3!SSL_ImportFD, nspr4!Write, nsp4!PR_Shutdown, nspr4!PR_GetHostByName and nspr4!Read.
5. The method of claim 1 , wherein the hooks are injected at one or more of the following hook points within the application: CFNetwork!CFHTTPMessageCreateRequest, CoreFoundation!CFReadStreamRead, and CoreFoundation!CFWriteStreamWrite.
6. A computer system having stored thereon computer-readable instructions which, when executed by a processor of said computer system, cause said processor to:
inject, at run-time, one or more hooks on application programming interface (API) calls within an application executing on said computer system;
catch, using the hooks, calls from the application concerning encryption of data to be transferred to a remote computer system;
divert the data away from said encryption and towards an instruction layer for filtering just prior to said encryption, wherein the data is filtered at the instruction layer;
direct the filtered data to an encryption engine, wherein the data is encrypted at the encryption engine; and
initiate a secure transmission of the encrypted data from the client to the remote computer system, thereby causing the data to be filtered before being encrypted and securely transmitted to the remote computer system;
wherein the hooks are injected at one or more of the following hook points within the application: wininet!InternetConnectA, wininet!HttpOpenRequestA, wininet!InternetCloseHandle, wininet!InternetOpen, wininet!InternetOpenURL, wininet!HttpOpenRequest/Ex, wininet!InternetReadFile, and wininet!InternetWriteFile.
7. The computer system of claim 6 , wherein the filtering occurs at the computer system.
8. A method for filtering data to be securely transmitted from a client to a remote computer system, comprising:
directing, under a control of application programming interface (API) hooks injected into an application program executing at the client, plain text data away from an encryption engine just prior to the encryption engine and towards an instruction layer of the client for content filtering at the client;
filtering the plain text data at the instruction layer of the client; encrypting the data at the encryption engine; and initiating a secure transmission of the encrypted data from the client to the remote computer system, thereby causing the data to be filtered before being encrypted and securely transmitted to the remote computer system;
wherein the hooks are injected at one or more of the following hook points within the application: wininet!InternetConnectA, wininet!HttpOpenRequestA, wininet!InternetCloseHandle, wininet!InternetOpen, wininet!InternetOpenURL, wininet!HttpOpenRequest/Ex, wininet!InternetReadFile, and wininet!InternetWriteFile.
9. The method of claim 8 , wherein the hooks are injected at one or more of the following hook points within the application program: wininet!InternetConnectA, wininet!HttpOpenRequestA, wininet!InternetCloseHandle, wininet!InternetOpen, wininet!InternetOpenURL, wininet!HttpOpenRequest/Ex, wininet!InternetReadFile, wininet!InternetWriteFilenspr4!PR_Connect, nspr4!PR_Close, nspr4!PR_Connect, ssl3!SSL_ImportFD, nspr4!Write, nsp4!PR_Shutdown, nspr4!PR_GetHostByName, nspr4!Read, CFNetwork!CFHTTPMessageCreateRequest, CoreFoundation!CFReadStreamRead, and CoreFoundation!CFWriteStreamWrite.