Granted Patent B2

US 9,197,606 · App. 13/432,847 · Granted Nov 24, 2015

Abstract

Claims (63)

1. A method of using a first probing device, the method comprising:

monitoring one or more encrypted communications sessions between a first computing device and a second computing device, wherein each encrypted communications session includes transmitting a plurality of encrypted data objects between the first and second computing devices;

deriving, by the first probing device, timing information regarding an encrypted communications session including:

receiving an indication of a location within the encrypted communications session for which the timing information is to be derived, the location being indicated via a byte offset from a start of a portion of the encrypted communications session;

determining when the indicated location has been received including determining a byte range within the encrypted communications session associated with an encrypted data object;

comparing the byte range associated with the encrypted data object to the byte offset; and

transmitting, from the first probing device to a second probing device, the derived timing information.

2. The method of claim 1 , further including:

decrypting, by the second probing device, at least a portion of the encrypted communications session; and

creating a set of metrics related to the encrypted communications session based upon the decrypted portion of the encrypted communications session and the derived timing information.

3. The method of claim 2 , wherein a data message is included within a first encryption envelope included by the encrypted communications session; and

wherein creating a set of metrics includes:

correlating a start of the data message with the derived timing information, provided by the first probing device, indicating the timing of a start the encryption envelope, and

correlating an end of the data message with the derived timing information, provided by the first probing device, indicating the timing of an end the encryption envelope.

4. The method of claim 1 , wherein deriving the timing information includes:

determining a start of an encryption envelope included by the encrypted communications session; and

determining an end of the encryption envelope.

5. The method of claim 1 , wherein the encrypted communications session includes data objects that are both compressed and encrypted; and

further including:

receiving the indication, by the first probing device and from the second probing device, of the location within the encrypted communications session for which the timing information is to be derived.

6. The method of claim 1 , wherein the encrypted communications session includes one or more encryption envelopes; and

wherein deriving the timing information includes:

basing the timing information on a timestamp associated with the encrypted envelopes.

7. The method of claim 1 , wherein deriving the timing information includes:

ignoring, for purposes of deriving the timing information, one or more received encrypted data objects included by the encrypted communications session that are indicated, by the first computing device, as ignorable.

8. A system comprising:

a first network tap point configured to duplicate, in a non-intrusive manner, at least part of an encrypted network communication transmitted to and from an access point device that forms the boundary between a first network and a second network;

a second network tap point configured to duplicate, in a non-intrusive manner, at least part of an encrypted network communication transmitted to and from a server computing device placed within, in a network topology sense, the second network;

a client-side probing device configured to:

monitor encrypted communications sessions between the server computing device and the client computing device, wherein each encrypted communications session includes transmitting a plurality of encrypted data objects between the server and client computing devices;

derive timing information regarding an encrypted communications session based upon one or more received encrypted data objects included by the encrypted communications session, including,

receive an indication of a location within the encrypted communications session for which the timing information is to be derived, the location being indicated via a byte offset from a start of a portion of the encrypted communications session;

determine when the indicated location has been received including determine a byte range within the encrypted communications session associated with an encrypted data object;

compare the byte range associated with the encrypted data object to the byte offset; and

transmit, to a server-side probing device, the derived timing information.

9. The system of claim 8 , further including a server-side probing device configured to:

decrypt at least a portion of the encrypted communications session; and

create a set of metrics related to the encrypted communications session based upon the decrypted portion of the encrypted communications session and the derived timing information.

10. The system of claim 9 , wherein the encrypted communications session includes at least one encryption envelope, wherein the encryption envelope includes a data message; and

wherein the server-side probing device is configured to:

correlate a start of the data message with the derived timing information, provided by the first probing device, indicating the timing of a start the encryption envelope, and

correlate an end of the data message with the derived timing information, provided by the first probing device, indicating the timing of an end the encryption envelope.

11. The system of claim 8 , wherein the client-side probing device is configured to:

determine a start of an encryption envelope included by the encrypted communications session; and

determine an end of the encryption envelope.

12. The system of claim 8 , wherein the client-side probing device is configured to:

store a timestamp associated with the received indicated location within the encrypted communications session.

13. The system of claim 8 , wherein the encrypted communications session includes data objects that are both compressed and encrypted; and

wherein the client-side probing device is configured to:

receive the indication, from a server-side probing device, of the location within the encrypted communications session for which the timing information is to be derived.

14. The system of claim 8 , wherein the client-side probing device is configured to:

base the timing information on a timestamp associated with the encrypted communications session as a whole instead of a timestamp associated with one of the encrypted data objects.

15. The system of claim 8 , wherein the client-side probing device is configured to:

ignore, for purposes of deriving the timing information, one or more received encrypted data objects included by the encrypted communications session that are indicated, by the first computing device, as ignorable.

16. A computer program product for managing a network, the computer program product being tangibly embodied on a non-transitory computer-readable medium and including executable code that, when executed, is configured to cause an apparatus to:

monitor encrypted communications sessions between a first computing device and a second computing device, wherein each encrypted communications session includes transmitting a plurality of encrypted data objects between the first and second computing devices;

derive, by the apparatus, timing information regarding an encrypted communications session based upon one or more received encrypted data objects included by the encrypted communications session; and

transmit, from the apparatus to a second apparatus, the derived timing information,

wherein the executable code is configured to, when executed, cause the apparatus to:

receive an indication, from a second apparatus, of a location within the encrypted communications session for which the timing information is to be derived;

for each received encrypted data packet, determine if the received encrypted data object is included with the indicated encrypted communications session;

determine the byte range within the encrypted communications session associated with the received encrypted data object; and

compare the byte range associated with the received encrypted data object to the indicated byte offset.

Assignments (16)