Methods and systems for filtering encrypted traffic
View Patent ↗Application programming interface (API) hooks are injected into an application program executing at a client during run-time. Responsive to these hooks, data intended for encryption prior to transmission from the client is diverted, for example for content filtering, compression, etc., prior to being encrypted. In the case of encrypted data received at the client, the data is decrypted but before being passed to the application it is diverted, under control of the API hooks, for content filtering, decompression, etc.
1. A method, comprising:
injecting, by a first device executing a software process, one or more programmatic hooks for application programming interface (API) calls into a web browser of a client device, comprising one of:
overwriting one or more portions of code of a web browser application to point to a content filtering API, and
overwriting a routine of the web browser application with the content filtering API;
intercepting, by the one or more programmatic hooks, unencrypted data to be transmitted by the web browser to a remote device, prior to encryption by the web browser;
forming a subset of the intercepted data by removing content from the intercepted data using the content filtering API configured to remove content from unencrypted data according to content filtering rules;
providing, by the content filtering API, the subset of the unencrypted data to an encryption process of the web browser for encryption and transmittal to the remote device; and
intercepting, by the one or more programmatic hooks, display data for display by the web browser application, wherein the display data was received and unencrypted by the first device prior to the one or more programmatic hooks intercepting the data for display, and wherein the one or more programmatic hooks intercept the display data prior to the web browser application displaying the data.
2. The method as in claim 1 , wherein the content filtering API is configured to call the overwritten routine.
3. The method as in claim 1 , wherein the one or more programmatic hooks reside in a wininet.dll dynamic link library.
4. The method as in claim 1 , further comprising:
forming a subset of the display data using the content filtering API; and
providing the subset of the display data for display by the web browser application.
5. The method as in claim 1 , wherein the one or more programmatic hooks reside in a nspr4.dll dynamic link library or a nspr4.so library.
6. A method, comprising:
injecting, by a first device executing a software process, one or more programmatic hooks for application programming interface (API) calls into a web browser of a client device, comprising one of:
overwriting one or more portions of code of a web browser application to point to a content filtering API, and
overwriting a routine of the web browser application with the content filtering API;
intercepting, by the one or more programmatic hooks, display data for display by the web browser application, wherein the display data was received and unencrypted by the first device prior to the one or more programmatic hooks intercepting the data for display, and wherein the one or more programmatic hooks intercept the display data prior to the web browser application displaying the data;
forming a subset of the display data using the content filtering API configured to remove content from the display data according to content filtering rules; and
providing the subset of the display data for display by the web browser application.
7. The method as in claim 6 , wherein the content filtering API is configured to call the overwritten routine.
8. The method as in claim 6 , wherein the one or more programmatic hooks reside in a wininet.dll dynamic link library.
9. The method as in claim 6 , wherein the one or more programmatic hooks reside in a nspr4.dll dynamic link library or nspr4.so library.
10. The method as in claim 6 , further comprising:
intercepting, by the one or more programmatic hooks, unencrypted data to be transmitted by the web browser to a remote device, prior to encryption by the web browser;
forming a subset of the intercepted data by removing content from the intercepted data using the content filtering API; and
providing, by the content filtering API, the subset of the unencrypted data to an encryption process of the web browser for encryption and transmittal to the remote device.
11. A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to:
inject one or more programmatic hooks for application programming interface (API) calls into a web browser of a client device, comprising one of:
overwriting one or more portions of code of a web browser application to point to a content filtering API, and
overwriting a routine of the web browser application with the content filtering API;
intercept, by the one or more programmatic hooks, unencrypted data to be transmitted by the web browser to a remote device, prior to encryption by the web browser;
form a subset of the intercepted data by removing content from the intercepted data using the content filtering API configured to remove content from unencrypted data according to content filtering rules;
provide, by the content filtering API, the subset of the unencrypted data to an encryption process of the web browser for encryption and transmittal to the remote device; and
intercept, by the one or more programmatic hooks, display data for display by the web browser application, wherein the display data was received and unencrypted by the first device prior to the one or more programmatic hooks intercepting the data for display, and wherein the one or more programmatic hooks intercept the display data prior to the web browser application displaying the data.
12. The computer-readable medium as in claim 11 , wherein the content filtering API is configured to call the overwritten routine.
13. The computer-readable medium as in claim 11 , wherein the instructions, when executed by the processor, cause the processor to:
form a subset of the display data using the content filtering API; and
provide the subset of the display data for display by the web browser application.