Granted Patent B2

US 10,834,131 · App. 15/824,214 · Granted Nov 10, 2020

Inventors: Tuomo Syvänne (Helsinki, FI); Olli-Pekka Niemi (Helsinki, FI); Valtteri Rahkonen (Helsinki, FI)

Assignee: Forcepoint LLC

H04L63/166H04L63/0227H04L63/0281H04L63/0823H04L63/20H04L63/1408

Abstract

Claims (78)

1. A method for securing network communication, comprising:

responsive to communication of a client handshake from a client to a server for establishing encrypted communications between the client and the server:

holding open, by an intermediate verification system interfaced between the server and the client, the client handshake; and

opening a connection between the intermediate verification system and the server via which the intermediate verification system issues a server verification handshake to the server;

responsive to issuance of the server verification handshake to the server, receiving a server certificate associated with the server by the intermediate verification system;

responsive to receipt of the server certificate, processing, by the intermediate verification system, the server certificate to determine an identity of the server and a geographical area associated with the server; and

rendering, by the intermediate verification system, a security policy decision regarding traffic between the server and the client based on the identity;

wherein the security policy decision includes determining, based on a legal or regulatory requirement associated with the geographical area and associated with the traffic between the server and the client, whether or not to decrypt the traffic between the server and the client for further inspection, wherein the determining whether or not to decrypt the traffic is further based on the server certificate, such that the decryption is prevented when the server certificate is indicative of a type of traffic for which decryption is prohibited by the legal or regulatory requirement within the geographical area.

2. The method of claim 1 , wherein the security policy decision comprises one of:

allowing traffic to be communicated between the server and the client;

disallowing traffic to be communicated between the server and the client; and

decrypting and inspecting traffic between the server and the client and determining whether to allow or disallow traffic to be communicated between the server and the client based on such inspection.

3. The method of claim 1 , further comprising storing, by the intermediate verification system, a new entry in a cache setting forth information regarding the server identity and the security policy decision rendered by the intermediate verification system.

4. The method of claim 3 , further comprising:

responsive to communication of a second client handshake from the client or another client to the server or another server for establishing encrypted communications between the client or other client and the server or other server, determining Mill whether an existing entry for the server or other server exists within the cache;

responsive to the existing entry for the server or other server existing within the cache, reading, by the intermediate verification system, the existing entry from the cache; and

rendering, by the intermediate verification system, another security policy decision regarding traffic between the server or other server and the client or other client based on contents of the existing entry.

5. The method of claim 4 , further comprising:

responsive to no existing entry for the server or other server existing within the cache:

holding open, by the intermediate verification, the second client handshake; and

opening a connection between the intermediate verification system and the server or other server via which the intermediate verification system issues a second server verification handshake to the server or other server;

responsive to issuance of the server verification handshake to the server or other server, receiving a second server certificate associated with the server or other server by the intermediate verification system;

responsive to receipt of the second server certificate, processing, by the intermediate verification system, the second server certificate to determine a second identity of the server or other server; and

rendering, by the intermediate verification system, a second security policy decision regarding traffic between the server or other server and the client or other client based on the second identity.

6. The method of claim 1 , wherein the intermediate verification system is embodied with one of a firewall and a proxy-based gateway.

7. The method of claim 1 , wherein the client handshake and the server verification handshake each comprise a handshake communicated in accordance with Transport Layer Security protocol.

8. A system comprising:

a processor; and

a non-transitory, computer-readable storage medium embodying instructions executable by the processor for:

responsive to communication of a client handshake from a client to a server for establishing encrypted communications between the client and the server:

holding open, by an intermediate verification system interfaced between the server and the client, the client handshake; and

opening a connection between the intermediate verification system and the server via which the intermediate verification system issues a server verification handshake to the server;

responsive to issuance of the server verification handshake to the server, receiving a server certificate associated with the server by the intermediate verification system;

responsive to receipt of the server certificate, processing, by the intermediate verification system, the server certificate to determine an identity of the server and a geographical area associated with the server; and

rendering, by the intermediate verification system, a security policy decision regarding traffic between the server and the client based on the identity;

wherein the security policy decision includes determining, based on a legal or regulatory requirement associated with the geographical area and associated with the traffic between the server and the client, whether or not to decrypt the traffic between the server and the client for further inspection, wherein the determining whether or not to decrypt the traffic is further based on the server certificate, such that the decryption is prevented when the server certificate is indicative of a type of traffic for which decryption is prohibited by the legal or regulatory requirement within the geographical area.

9. The system of claim 8 , wherein the security policy decision comprises one of:

allowing traffic to be communicated between the server and the client;

disallowing traffic to be communicated between the server and the client; and

decrypting and inspecting traffic between the server and the client and determining whether to allow or disallow traffic to be communicated between the server and the client based on such inspection.

10. The system of claim 8 , the instructions further configured for storing, by the intermediate verification system, a new entry in a cache setting forth information regarding the server identity and the security policy decision rendered by the intermediate verification system.

11. The system of claim 10 , the instructions further configured for:

responsive to communication of a second client handshake from the client or another client to the server or another server for establishing encrypted communications between the client or other client and the server or other server, determining Mill whether an existing entry for the server or other server exists within the cache;

responsive to the existing entry for the server or other server existing within the cache, reading, by the intermediate verification system, the existing entry from the cache; and

rendering, by the intermediate verification system, another security policy decision regarding traffic between the server or other server and the client or other client based on contents of the existing entry.

12. The system of claim 11 , the instructions further configured for:

responsive to no existing entry for the server or other server existing within the cache:

holding open, by the intermediate verification, the second client handshake; and opening a connection between the intermediate verification system and the server or other server via which the intermediate verification system issues a second server verification handshake to the server or other server;

responsive to issuance of the server verification handshake to the server or other server, receiving a second server certificate associated with the server or other server by the intermediate verification system;

responsive to receipt of the second server certificate, processing, by the intermediate verification system, the second server certificate to determine a second identity of the server or other server; and

rendering, by the intermediate verification system, a second security policy decision regarding traffic between the server or other server and the client or other client based on the second identity.

13. The system of claim 8 , wherein the intermediate verification system is embodied with one of a firewall and a proxy-based gateway.

14. The system of claim 8 , wherein the client handshake and the server verification handshake each comprise a handshake communicated in accordance with Transport Layer Security protocol.

15. A non-transitory, computer-readable storage medium embodying computer executable instructions configured for:

responsive to communication of a client handshake from a client to a server for establishing encrypted communications between the client and the server:

holding open, by an intermediate verification system interfaced between the server and the client, the client handshake; and

opening a connection between the intermediate verification system and the server via which the intermediate verification system issues a server verification handshake to the server;

responsive to issuance of the server verification handshake to the server, receiving a server certificate associated with the server by the intermediate verification system;

responsive to receipt of the server certificate, processing, by the intermediate verification system, the server certificate to determine an identity of the server and a geographical area associated with the server; and

rendering, by the intermediate verification system, a security policy decision regarding traffic between the server and the client based on the identity;

wherein the security policy decision includes determining, based on a legal or regulatory requirement associated with the geographical area and associated with the traffic between the server and the client, whether or not to decrypt the traffic between the server and the client for further inspection, wherein the determining whether or not to decrypt the traffic is further based on the server certificate, such that the decryption is prevented when the server certificate is indicative of a type of traffic for which decryption is prohibited by the legal or regulatory requirement within the geographical area.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein the security policy decision comprises one of:

allowing traffic to be communicated between the server and the client;

disallowing traffic to be communicated between the server and the client; and

decrypting and inspecting traffic between the server and the client and determining whether to allow or disallow traffic to be communicated between the server and the client based on such inspection.

17. The non-transitory, computer-readable storage medium of claim 15 , the computer executable instructions further configured for storing, by the intermediate verification system, a new entry in a cache setting forth information regarding the server identity and the security policy decision rendered by the intermediate verification system.

18. The non-transitory, computer-readable storage medium of claim 17 , the computer executable instructions further configured for:

responsive to communication of a second client handshake from the client or another client to the server or another server for establishing encrypted communications between the client or other client and the server or other server, determining Mill whether an existing entry for the server or other server exists within the cache;

responsive to the existing entry for the server or other server existing within the cache, reading, by the intermediate verification system, the existing entry from the cache; and

rendering, by the intermediate verification system, another security policy decision regarding traffic between the server or other server and the client or other client based on contents of the existing entry.

19. The non-transitory, computer-readable storage medium of claim 18 , the computer executable instructions further configured for:

responsive to no existing entry for the server or other server existing within the cache:

holding open, by the intermediate verification, the second client handshake; and opening a connection between the intermediate verification system and the server or other server via which the intermediate verification system issues a second server verification handshake to the server or other server;

responsive to issuance of the server verification handshake to the server or other server, receiving a second server certificate associated with the server or other server by the intermediate verification system;

responsive to receipt of the second server certificate, processing, by the intermediate verification system, the second server certificate to determine a second identity of the server or other server; and

rendering, by the intermediate verification system, a second security policy decision regarding traffic between the server or other server and the client or other client based on the second identity.

20. The non-transitory, computer-readable storage medium of claim 15 , wherein the intermediate verification system is embodied with one of a firewall and a proxy-based gateway.

21. The non-transitory, computer-readable storage medium of claim 15 , wherein the client handshake and the server verification handshake each comprise a handshake communicated in accordance with Transport Layer Security protocol.

Assignments (10)

Continuity (1)

Cited By (1)

US 12,526,729