Granted Patent B1

US 10,958,666 · App. 15/468,391 · Granted Mar 23, 2021

Inventors: Brian Witten (Hermosa Beach, CA); Qing Li (Cupertino, CA); Ronald Frederick (Mountain View, CA); Roelof Du Toit (Portersville, PA); Susanta Nanda (Santa Clara, CA); Saurabh Shintre (Sunnyvale, CA); Darren Shou (La Jolla, CA)

Assignee: NortonLifeLock Inc.

H04L63/126H04L9/3265H04L9/3268H04L43/0811H04L63/0823H04L63/166H04L67/42H04L63/0428

Abstract

Claims (92)

1. A computer-implemented method for verifying connection integrity, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

configuring a middlebox that is capable of examining traffic between a client computing device and a server to execute a middlebox security application distributed by a security vendor;

receiving, by the middlebox, a request from the client computing device to initiate a connection to the server via the middlebox using a transport layer security protocol;

determining that the client computing device is configured to execute a client security application distributed by the security vendor;

by the middlebox and via a side protocol that facilitates communication between the middlebox security application and the client security application, and operates independently of the transport layer security protocol:

receiving, from the client computing device, a request for a certificate for the middlebox that attests to a trustworthiness of the middlebox;

sending the certificate for the middlebox to the client computing device, thereby enabling the client computing device to evaluate a trustworthiness of the transport layer security protocol between the middlebox and the client computing device;

receiving a request from the client computing device that requests an additional certificate from a device upstream of the middlebox that attests to the device upstream of the middlebox, wherein the device upstream of the middlebox comprises at least one of an additional middlebox and a server;

requesting the additional certificate from the device upstream from the middlebox;

receiving, from the device upstream of the middlebox, the additional certificate for the device upstream of the middlebox; and

sending the additional certificate to the client computing device, thereby enabling the client computing device to evaluate the trustworthiness of the device upstream of the middlebox;

relaying data from the client computing device to the server, using the transport layer security protocol, via the connection that was validated by the client computing device, based at least in part on the client computing device determining that the additional certificate is globally trusted, in response to the middlebox sending the additional certificate;

receiving, via the connection, using transport layer security protocol, from an upstream device, data originating from the server and bound for the client computing device;

receiving, from the upstream device via the side protocol, a manifest that describes the data;

altering the data bound for the client computing device;

creating a new manifest that describes the altered data;

signing the new manifest that describes the altered data with a key corresponding to the certificate for the middlebox;

sending the altered data to the client computing device via the via the connection, using transport layer security protocol; and

sending the new manifest that describes the altered data to the client computing device via the side protocol.

2. The computer-implemented method of claim 1 , wherein the certificate for the middlebox comprises a dynamically generated certificate that identifies the middlebox as being the server.

3. The computer-implemented method of claim 1 , wherein sending, from the middlebox to the client computing device, via the side protocol, the additional certificate for the device upstream from the middlebox comprises:

receiving, from the client computing device, via the side protocol, a request for a certificate for each successive device immediately upstream from a most recent device for which the middlebox has sent a certificate until the client computing device receives a certificate from the middlebox that is recognized as globally trusted by the client computing device; and

sending, from the middlebox to the client computing device, via the side protocol, the certificate for each successive device immediately upstream from the most recent device for which the middlebox has sent a certificate until the client computing device receives the certificate from the middlebox that is recognized as globally trusted by the client computing device.

4. The computer-implemented method of claim 1 , wherein altering the data bound for the client computing device comprises decrypting the data bound for the client computing device in order to examine the data.

5. The computer-implemented method of claim 1 , further comprising, by the middlebox and via the side protocol executing independently he transport layer security protocol:

receiving, from the server, a request for a certificate for the middlebox that attests to the trustworthiness of the client computing device;

sending, the certificate for the middlebox to the server;

receiving, from the server, a request for a certificate from the client computing device that attests to the trustworthiness of the client computing device;

requesting, from the client computing device, the certificate for the client computing device;

receiving, from the client computing device, the certificate for the client computing device that attests to the trustworthiness of the client computing device; and

sending, from the middlebox to the server, the certificate for the client computing device.

6. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

configure a middlebox that is capable of examining traffic between a client computing device and a server to execute a middlebox security application distributed by a security vendor;

receive, by the middlebox, a request from the client computing device to initiate a connection to the server via the middlebox using a transport layer security protocol;

determine that the client computing device is configured to execute a client security application distributed by the security vendor;

by the middlebox and via a side protocol that facilitates communication between the middlebox security application and the client security application, and operates independently of the transport layer security protocol:

receive, from the client computing device, a request for a certificate for the middlebox that attests to a trustworthiness of the middlebox;

send the certificate for the middlebox to the client computing device, thereby enabling the client computing device to evaluate a trustworthiness of the transport layer security protocol between the middlebox and the client computing device;

receive a request from the client computing device that requests an additional certificate from a device upstream of the middlebox that attests to the device upstream of the middlebox, wherein the device upstream of the middlebox comprises at least one of an additional middlebox and a server;

request the additional certificate from the device upstream from the middlebox; receive, from the device upstream of the middlebox, the additional certificate for the device upstream of the middlebox; and

send the additional certificate to the client computing device, thereby enabling the client computing device to evaluate the trustworthiness of the device upstream of the middlebox;

relay data from the client computing device to the server, using the transport layer security protocol, via the connection that was validated by the client computing device, based at least in part on the client computing device evaluating the trustworthiness of the device upstream of the middlebox, in response to the middlebox sending the additional certificate;

receive, via the connection, using transport layer security protocol, from the device upstream of the middlebox, data originating from the server and bound for the client computing device;

receive, from the device upstream of the middlebox via the side protocol, a manifest that describes the data;

alter the data bound for the client computing device;

create a new manifest that describes the altered data;

sign the new manifest that describes the altered data with a key corresponding to the certificate for the middlebox;

send the altered data to the client computing device via the via the connection, using transport layer security protocol; and

send the new manifest that describes the altered data to the client computing device via the side protocol.

7. The computer-readable medium of claim 6 , wherein the instructions cause the one or more physical processors to, by the client computing device, via the side protocol, request the additional certificate by:

requesting, by the client computing device, from the middlebox, via the side protocol, a certificate for a device immediately upstream of the middlebox;

receiving, by the client computing device, from the middlebox, via the side protocol, the certificate for the device immediately upstream of the middlebox; and

continuing to request, by the client computing device, from the middlebox, via the side protocol, a certificate for each successive device immediately upstream from a most recent device for which the client computing device has received a certificate until the client computing device receives a certificate that is recognized as globally trusted by the client computing device.

8. The computer-readable medium of claim 7 , wherein the client computing device continues to request the certificate for each successive device until the client computing device receives a certificate for the server.

9. The computer-readable medium of claim 6 , wherein the middlebox is capable of modifying traffic between the client computing device and the server.

10. The computer-readable medium of claim 6 , further comprising displaying to a user of a client computing device a notification indicating that the data from the server was altered by the middlebox.

11. The computer-readable medium of claim 6 , wherein evaluating the trustworthiness of the device upstream of the middlebodetermining that the additional certificate for the device upstream from the middlebox is recognized as globally trusted by the client computing device comprises determining, by the client computing device, that the additional certificate is chained to a globally trusted root certificate.

12. A system for verifying connection integrity, the system comprising:

one or more physical processors;

one or more memory devices comprising instructions that, when executed by the one or more physical processors, cause the one or more physical processors to:

configure a middlebox that is capable of examining traffic between a client computing device and a server to execute a middlebox security application distributed by a security vendor;

receive, by the middlebox, a request from the client computing device to initiate a connection to the server via the middlebox using a transport layer security protocol;

determine that the client computing device is configured to execute a client security application distributed by the security vendor;

by the middlebox and via a side protocol that facilitates communication between the middlebox security application and the client security application, and operates independently of the transport layer security protocol:

receive, from the client computing device, a request for a certificate for the middlebox that attests to a trustworthiness of the middlebox;

send the certificate for the middlebox to the client computing device, thereby enabling the client computing device to evaluate a trustworthiness of the transport layer security protocol between the middlebox and the client computing device;

receive a request from the client computing device that requests an additional certificate from a device upstream of the middlebox that attests to the device upstream of the middlebox, wherein the device upstream of the middlebox comprises at least one of an additional middlebox and a server;

request the additional certificate from the device upstream from the middlebox;

receive, from the device upstream of the middlebox, the additional certificate for the device upstream of the middlebox; and

send sending the additional certificate to the client computing device, thereby enabling the client computing device to evaluate the trustworthiness of the device upstream of the middlebox; and

relay data from the client computing device to the server, using the transport layer security protocol, via the connection that was validated by the client computing device, based at least in part on the client computing device determining that the additional certificate is globally trusted, in response to the middlebox sending the additional certificate;

receive, via the connection, using transport layer security protocol, from the device upstream of the middlebox, data originating from the server and bound for the client computing device;

receive, from the device upstream of the middlebox via the side protocol, a manifest that describes the data;

alter the data bound for the client computing device;

create a new manifest that describes the altered data;

sign the new manifest that describes the altered data with a key corresponding to the certificate for the middlebox;

send the altered data to the client computing device via the via the connection, using transport layer security protocol; and

send the new manifest that describes the altered data to the client computing device via the side protocol.

13. The system of claim 12 , wherein the certificate for the middlebox that attests to the trustworthiness of the middlebox comprises a dynamically generated certificate that identifies the middlebox as being the server.

14. The system of claim 12 , wherein the instructions cause the one or more physical processors to, by the client computing device, via the side protocol, request the additional certificate by:

requesting, by the client computing device, from the middlebox, via the side protocol, a certificate for a device immediately upstream of the middlebox;

receiving, by the client computing device, from the middlebox, via the side protocol, the certificate for the device immediately upstream of the middlebox; and

continuing to request, by the client computing device, from the middlebox, via the side protocol, a certificate for each successive device immediately upstream from a most recent device for which the client computing device has received a certificate until the client computing device receives a certificate that is recognized as globally trusted by the client computing device.

15. The system of claim 12 , wherein the instructions cause the one or more physical processors to, by the middlebox, alter the data bound for the client computing device by decrypting the data bound for the client computing device in order to examine the data.

16. The system of claim 12 , wherein the instructions cause the one or more physical processors to:

receive, by the middlebox, from the server, via the side protocol executing independently of the transport layer security protocol, a request for a certificate for the middlebox that attests to the trustworthiness of the middlebox;

send, by the middlebox to the server, via the side protocol, the certificate for the middlebox;

receive, by the middlebox, from the server, via the side protocol, a request for a certificate from the client computing device that attests to the trustworthiness of the client computing device;

request, by the middlebox, from the client computing device, via the side protocol, the certificate for the client computing device;

receive, by the middlebox, from the client computing device, via the side protocol, the certificate for the client computing device that attests to the trustworthiness of the client computing device; and

send, from the middlebox to the server, via the side protocol, the certificate for the client computing device.

17. The system of claim 12 , wherein the instructions cause the one or more physical processors to determine that the additional certificate for the device upstream from the middlebox is recognized as globally trusted by the client computing device by determining, by the client computing device, that the additional certificate is chained to a globally trusted root certificate.

Assignments (6)