Granted Patent B2

US 8,813,189 · App. 13/299,773 · Granted Aug 19, 2014

Abstract

Claims (122)

1. A method comprising:

establishing, by a proxy server, a communications session between each of a plurality of client devices and the proxy server;

receiving, at the proxy server, a session key from each of the plurality of client devices;

selecting, by the proxy server, a particular traffic flow associated with a particular client device, the particular traffic flow selected from a plurality of traffic flows, each of the plurality of traffic flows being associated with one of the plurality of client devices and comprising encrypted data; and

communicating, by the proxy server, flow information to a first capture device communicatively coupled to the proxy server, the flow information comprising the session key received from the particular client device and an identification of the particular traffic flow;

wherein:

the first capture device is configured to:

receive the plurality of traffic flows from the particular client device;

store the encrypted data of the particular traffic flow selected by the proxy server;

store the session key received in the flow information from the proxy server;

discard any of the plurality of received traffic flows not identified in the flow information received from the proxy server;

utilize the session key to decrypt encrypted data of traffic flows; and

export the decrypted data to a network analyzer for analysis; and

the proxy server and the first capture device are communicatively coupled to the particular client device through separate connections.

2. The method of claim 1 , wherein the communications session between each of the plurality of client devices and the proxy server comprises a secure communications session.

3. The method of claim 1 , wherein the flow information is communicated from the proxy server to the first capture device across a secure communications channel.

4. The method of claim 1 , further comprising authenticating the proxy server to the first capture device.

5. The method of claim 1 , further comprising:

communicating, by the proxy server, flow information to a second capture device communicatively coupled to the proxy server; and

performing, by the proxy server, load balancing between the first and second capture devices;

wherein the second capture device is configured to receive the plurality of traffic flows.

6. A system comprising:

a proxy server operable to:

establish a communications session with each of a plurality of client devices;

receive a session key from each of the plurality of client devices;

select a particular traffic flow associated with a particular client device, the particular traffic flow selected from a plurality of traffic flows, each of the plurality of traffic flows being associated with one of the plurality of client devices and comprising encrypted data; and

communicate flow information to a first capture device communicatively coupled to the proxy server, the flow information comprising the session key received from the particular client device and an identification of the particular traffic flow;

wherein:

the first capture device is operable to:

receive the plurality of traffic flows from the particular client device;

store the encrypted data of the particular traffic flow selected by the proxy server;

store the session key received in the flow information from the proxy server;

discard any of the plurality of received traffic flows not identified in the flow information received from the proxy server;

utilize the session key to decrypt encrypted data of traffic flows; and

export the decrypted data to a network analyzer for analysis; and

the proxy server and the first capture device are communicatively coupled to the particular client device through separate connections.

7. The system of claim 6 , wherein the communications session between each of the plurality of client devices and the proxy server comprises a secure communications session.

8. The system of claim 6 , wherein the flow information is communicated from the proxy server to the first capture device across a secure communications channel.

9. The system of claim 6 , wherein the proxy server is further operable to authenticate the proxy server to the first capture device.

10. The system of claim 6 , wherein the proxy server is further operable to:

communicate flow information to a second capture device communicatively coupled to the proxy server; and

perform load balancing between the first and second capture devices;

wherein the second capture device is operable to receive the plurality of traffic flows.

11. One or more computer-readable non-transitory storage media embodying software operable when executed by one or more computer systems to:

establish a communications session between each of a plurality of client devices and a proxy server;

receive a session key from each of the plurality of client devices;

select a particular traffic flow associated with a particular client device, the particular traffic flow selected from a plurality of traffic flows, each of the plurality of traffic flows being associated with one of the plurality of client devices and comprising encrypted data; and

communicate flow information from the proxy server to a first capture device communicatively coupled to the proxy server, the flow information comprising the session key received from the particular client device and an identification of the particular traffic flow;

wherein:

the first capture device ism configured to:

receive the plurality of traffic flows from the particular client device;

store the encrypted data of the selected particular traffic flow;

store the session key received in the flow information from the proxy server;

discard any of the plurality of received traffic flows not identified in the flow information received from the proxy server;

utilize the session key to decrypt encrypted data of traffic flows; and

export the decrypted data to a network analyzer for analysis; and

the proxy server and the first capture device are communicatively coupled to the particular client device through separate connections.

12. The media of claim 11 , wherein the communications session between each of the plurality of client devices and the proxy server comprises a secure communications session.

13. The media of claim 11 , wherein the flow information is communicated from the proxy server to the first capture device across a secure communications channel.

14. The media of claim 11 , the software further operable when executed by one or more computer systems to authenticate the proxy server to the first capture device.

15. The media of claim 11 , the software further operable when executed by one or more computer systems to:

communicate flow information from the proxy server to a second capture device communicatively coupled to the proxy server; and

perform load balancing between the first and second capture devices;

wherein the second capture device is configured to receive the plurality of traffic flows.

16. A method comprising:

receiving, by a capture device, a plurality of traffic flows transmitted by a plurality of client devices from the plurality of client devices, each of the plurality of traffic flows being associated with one of the plurality of client devices and comprising encrypted data;

receiving, by the capture device, flow information communicated from a proxy server communicatively coupled to the capture device, the flow information comprising an identification of a particular traffic flow and a session key associated with the particular traffic flow;

storing, by the capture device, encrypted data of the particular traffic flow identified by the flow information supplied by the proxy server;

storing, by the capture device, the session key associated with the particular traffic flow;

discarding, by the capture device, any of the plurality of received traffic flows not identified in the flow information supplied by the proxy server;

utilizing, by the capture device, the session key to decrypt the encrypted data of the particular traffic flow; and

exporting, by the capture device, the decrypted data to a network analyzer for analysis;

wherein the proxy server and the first capture device are communicatively coupled to the particular client device through separate connections.

17. The method of claim 16 , wherein the proxy server is operable to:

establish a secure communications session between each of the plurality of client devices and the proxy server;

receive session keys from each of the plurality of client devices;

select the particular traffic flow from the plurality of traffic flows; and

communicate the flow information to the capture device across a secure communications channel.

18. The method of claim 16 , wherein the flow information is received at the capture device from the proxy server via a secure communications channel.

19. The method of claim 16 , further comprising authenticating, by the capture device using a certificate of the capture device stored on the proxy server, the capture device to the proxy server.

20. The method of claim 16 , wherein storing the session key associated with the particular traffic flow comprises storing the session key separate from the encrypted data of the selected traffic flow.

21. The method of claim 16 , wherein receiving the plurality of traffic flows comprises receiving the plurality of traffic flows from a span port of a network switch.

22. The method of claim 16 , wherein storing the encrypted data of the particular traffic flow comprises storing information about the encrypted data in a searchable database.

23. A system comprising:

a capture device operable to:

receive a plurality of traffic flows transmitted by a plurality of client devices from the plurality of client devices, each of the plurality of traffic flows being associated with one of the plurality of client devices and comprising encrypted data;

receive flow information communicated from a proxy server communicatively coupled to the capture device, the flow information comprising an identification of a particular traffic flow and a session key associated with the particular traffic flow;

store encrypted data of the particular traffic flow identified by the flow information supplied by the proxy server;

store the session key associated with the particular traffic flow;

discard any of the plurality of received traffic flows not identified in the flow information supplied by the proxy server;

utilize the session key to decrypt the encrypted data of the particular traffic flow; and

export the decrypted data to a network analyzer for analysis;

wherein the proxy server and the first capture device are communicatively coupled to the particular client device through separate connections.

24. The system of claim 23 , wherein the proxy server is operable to:

establish a secure communications session between each of the plurality of client devices and the proxy server;

receive session keys from each of the plurality of client devices;

select the particular traffic flow from the plurality of traffic flows; and

communicate the flow information to the capture device across a secure communications channel.

25. The system of claim 23 , wherein the flow information is received at the capture device from the proxy server via a secure communications channel.

26. The system of claim 23 , the capture device further operable to authenticate, using a certificate of the capture device stored on the proxy server, the capture device to the proxy server.

27. The system of claim 23 , wherein storing the session key associated with the particular traffic flow comprises storing the session key separate from the encrypted data of the selected traffic flow.

28. The system of claim 23 , wherein receiving the plurality of traffic flows comprises receiving the plurality of traffic flows from a span port of a network switch.

29. The method of claim 23 , wherein storing the encrypted data of the particular traffic flow comprises storing information about the encrypted data in a searchable database.

30. One or more computer-readable non-transitory storage media embodying software operable when executed by one or more computer systems to:

receive a plurality of traffic flows transmitted by a plurality of client devices from the plurality of client devices, each of the plurality of traffic flows being associated with one of the plurality of client devices and comprising encrypted data;

receive flow information from a proxy server, the flow information comprising an identification of a particular traffic flow and a session key associated with the particular traffic flow;

store encrypted data of the particular traffic flow identified by the flow information supplied by the proxy server;

store the session key associated with the particular traffic flow;

discard any of the plurality of received traffic flows not identified in the flow information supplied by the proxy server;

utilize the session key to decrypt the encrypted data of the particular traffic flow; and

export the decrypted data to a network analyzer for analysis;

wherein the proxy server and the first capture device are communicatively coupled to the particular client device through separate connections.

31. The media of claim 30 , wherein the proxy server is operable to:

establish a secure communications session between each of the plurality of client devices and the proxy server;

receive session keys from each of the plurality of client devices;

select the particular traffic flow from the plurality of traffic flows; and

communicate the flow information to the capture device across a secure communications channel.

32. The media of claim 30 , wherein the flow information is received from the proxy server via a secure communications channel.

33. The media of claim 32 , the software further operable when executed by one or more computer systems to establish the secure communications channel using a certificate stored on the proxy server.

34. The media of claim 30 , wherein storing the session key associated with the particular traffic flow comprises storing the session key separate from the encrypted data of the selected traffic flow.

35. The media of claim 30 , wherein receiving the plurality of traffic flows comprises receiving the plurality of traffic flows from a span port of a network switch.

36. The media of claim 30 , wherein storing the encrypted data of the particular traffic flow comprises storing information about the encrypted data in a searchable database.

Assignments (10)