Security policy enforcement

1. A method of operating a network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the method comprising:

intercepting, by one or more processors, a handshake message transmitted over the network between the first and second network endpoints;

extracting, by one or more processors, from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints;

determining, by one or more processors, a validity status of the identified security standard based on the security policy, wherein the security policy defines characteristics of predetermined acceptable security standards for communication over the network;

preventing, by one or more processors, communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard;

extracting, by one or more processors, an identification of a security standard selected for communication between the first and second network endpoints from the handshake message, wherein the identification of the security standard is determined by extracting a cipher suite from an initial “Server Hello” message from the first network endpoint to the second network endpoint, and wherein the cipher suite is used by the security standard to encrypt communications between the first and second network endpoints;

referencing, by one or more processors, a predefined security policy to determine a validity status of the identified security standard from the handshake message, wherein the predefined security policy includes a definition of supported cipher suites used in the communication between the first and second network endpoints, and wherein the predefined security policy further prevents a resumption of previous communication sessions between the first and second network endpoints;

verifying, by one or more processors, that the first network endpoint is in possession of a private key associated with a public key in the certificate by intercepting a “Certificate Verify” message from the first network endpoint to the second network endpoint, wherein the “Certificate Verify” message consists of a concatenation of all messages in a handshake between the first and second network endpoints, wherein said all messages in the handshake between the first network endpoint and the second network endpoint include a “Client Hello” message from the first network endpoint to the second network endpoint, a “Server Hello” message from the second network endpoint to the first network endpoint, a “Server Certificate” message from the second network endpoint to the first network endpoint, a “Client Certificate Request” message from the second network endpoint to the first network endpoint, and a “Client Certificate” message from the first network endpoint to the second network endpoint; and

further preventing, by one or more processors, communication between the first and second network endpoints based on the first and second endpoints complying with the security standard selected for communication between the first and second network endpoints, the first and second endpoints complying with the predefined security policy, and verification that the first network endpoint is in possession of the private key associated with the public key in the certificate based on the “Certificate Verify” message from the first network endpoint to the second network endpoint.

2. The method of claim 1 , further comprising:

permitting, by one or more processors, communication between the first and second network endpoints based on a positively determined validity status of the identified security standard.

3. The method of claim 1 , further comprising:

preventing, by one or more processors, communication between the first and second network endpoints based on a determination by an authorization component using an identification of each of the first and second network endpoints.

4. The method of claim 1 , wherein the security standard is a cipher suite.

5. The method of claim 1 , wherein the security policy identifies at least one of:

at least one key exchange method;

at least one encryption algorithm;

at least one message digest algorithm; and

at least one minimum key length.

6. The method of claim 5 , wherein the security standard identifies at least one of:

a key exchange method;

an encryption algorithm;

and a message digest algorithm.

7. The method of claim 2 , wherein the security policy indicates whether resumption of a communication session is allowable.

8. The method of claim 2 , wherein the interceptor is a transparent proxy.

9. A network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the network message interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, wherein the network message interceptor comprises one or more processors, and a non-transitory computer readable storage device storing instructions, the one or more processors executing the instructions to:

intercept a handshake message transmitted over the network between the first and second network endpoints;

extract from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints;

determine a validity status of the identified security standard based on the security policy, wherein the security policy defines characteristics of predetermined acceptable security standards for communication over the network;

prevent communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard;

extract an identification of a security standard selected for communication between the first and second network endpoints from the handshake message, wherein the identification of the security standard is determined by extracting a cipher suite from an initial “Server Hello” message from the first network endpoint to the second network endpoint, and wherein the cipher suite is used by the security standard to encrypt communications between the first and second network endpoints;

reference a predefined security policy to determine a validity status of the identified security standard from the handshake message, wherein the predefined security policy includes a definition of supported cipher suites used in the communication between the first and second network endpoints, and wherein the predefined security policy further prevents a resumption of previous communication sessions between the first and second network endpoints;

verify that the first network endpoint is in possession of a private key associated with a public key in the certificate by intercepting a “Certificate Verify” message from the first network endpoint to the second network endpoint, wherein the “Certificate Verify” message consists of a concatenation of all messages in a handshake between the first and second network endpoints, wherein said all messages in the handshake between the first network endpoint and the second network endpoint include a “Client Hello” message from the first network endpoint to the second network endpoint, a “Server Hello” message from the second network endpoint to the first network endpoint, a “Server Certificate” message from the second network endpoint to the first network endpoint, a “Client Certificate Request” message from the second network endpoint to the first network endpoint, and a “Client Certificate” message from the first network endpoint to the second network endpoint; and

further prevent communication between the first and second network endpoints based on the first and second endpoints complying with the security standard selected for communication between the first and second network endpoints, the first and second endpoints complying with the predefined security policy, and verification that the first network endpoint is in possession of the private key associated with the public key in the certificate based on the “Certificate Verify” message from the first network endpoint to the second network endpoint.

10. The network message interceptor of claim 9 , wherein the one or more processors further execute instructions to:

permit communication between the first and second network endpoints based on a positively determined validity status of the identified security standard.

11. The network message interceptor of claim 10 , wherein the one or more processors further execute instructions to:

prevent communication between the first and second network endpoints based on a determination of an authorization component using an identification of each of the first and second network endpoints.

12. The network message interceptor of claim 9 , wherein the security standard is a cipher suite.

13. The network message interceptor of claim 9 , wherein the security policy identifies at least one of: at least one key exchange method;

at least one encryption algorithm;

at least one message digest algorithm; and

at least one minimum key length.

14. The network message interceptor of claim 9 , wherein the security standard identifies at least one of:

a key exchange method;

an encryption algorithm; and

a message digest algorithm.

15. The network message interceptor of claim 9 , wherein the security policy indicates whether resumption of a communication session is allowable.

16. A computer program product for operating a network message interceptor for enforcing a security policy for communication over a network between first and second network endpoints, the interceptor being in communication with the network and external to the first and second network endpoints, the network including transport layer security, and the security policy identifying at least one valid security standards for communication over the network, the computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code readable and executable by a processor to perform a method comprising:

intercepting a handshake message transmitted over the network between the first and second network endpoints;

extracting from the handshake message an identification of a security standard selected for the communication between the first and second network endpoints;

determining a validity status of the identified security standard based on the security policy;

preventing communication between the first and second network endpoints based on a negatively determined validity status of the identified security standard;

extracting an identification of a security standard selected for communication between the first and second network endpoints from the handshake message, wherein the identification of the security standard is determined by extracting a cipher suite from an initial “Server Hello” message from the first network endpoint to the second network endpoint, and wherein the cipher suite is used by the security standard to encrypt communications between the first and second network endpoints;

referencing a predefined security policy to determine a validity status of the identified security standard from the handshake message, wherein the predefined security policy includes a definition of supported cipher suites used in the communication between the first and second network endpoints, and wherein the predefined security policy further prevents a resumption of previous communication sessions between the first and second network endpoints;

verifying that the first network endpoint is in possession of a private key associated with a public key in the certificate by intercepting a “Certificate Verify” message from the first network endpoint to the second network endpoint, wherein the “Certificate Verify” message consists of a concatenation of all messages in a handshake between the first and second network endpoints, wherein said all messages in the handshake between the first network endpoint and the second network endpoint include a “Client Hello” message from the first network endpoint to the second network endpoint, a “Server Hello” message from the second network endpoint to the first network endpoint, a “Server Certificate” message from the second network endpoint to the first network endpoint, a “Client Certificate Request” message from the second network endpoint to the first network endpoint, and a “Client Certificate” message from the first network endpoint to the second network endpoint; and

further preventing communication between the first and second network endpoints based on the first and second endpoints complying with the security standard selected for communication between the first and second network endpoints, the first and second endpoints complying with the predefined security policy, and verification that the first network endpoint is in possession of the private key associated with the public key in the certificate based on the “Certificate Verify” message from the first network endpoint to the second network endpoint.

17. The computer program product of claim 16 , wherein the method further comprises:

permitting communication between the first and second network endpoints based on a positively determined validity status of the identified security standard.

18. The method of claim 1 , wherein the security policy identifies a list of acceptable key exchange mechanisms, a list of acceptable encryption functions a list of acceptable hashing algorithms, and a minimum key length for encryption used for communication over the network.