Granted Patent B2

US 11,005,659 · App. 15/877,974 · Granted May 11, 2021

Inventors: Otto Airamo (Helsinki, FI); Tuomo Syvänne (Helsinki, FI); Ville Mattila (Helsinki, FI)

Assignee: Forcepoint LLC

H04L9/3226H04L9/14H04L63/0281H04L63/0428H04L63/20H04L67/141H04L67/28H04L67/42H04L69/161

Abstract

Claims (29)

1. A computer-implemented method for managing network communication, comprising:

responsive to an attempted connection from a client to a server for establishing communications between the client and the server:

redirecting the connection to a proxy; and

injecting protocol-independent header information into a datagram as an encrypted portion of the datagram at a beginning of a Transmission Control Protocol (TCP) stream of traffic between the client and the server, the protocol-independent header information including information based upon which the proxy enforces a security policy, wherein the protocol-independent header information includes identifying information associated with the client and is encrypted with a user-specific key.

2. The method of claim 1 , wherein the security policy relates to a content inspection service performed by the proxy.

3. The method of claim 1 , wherein the user-specific key is defined by user-specific information within the protocol-independent header information, such that the user-specific information is usable by the proxy to decrypt the protocol-independent header information.

4. The method of claim 3 , wherein encrypting the protocol-independent header information with the user-specific key comprises encrypting the protocol-independent header information with a key selected from a plurality of keys associated with a user, wherein the user-specific key selected from the plurality of keys is defined by a key identifier associated with the user within the protocol-independent header information.

5. A system comprising:

a processor; and

a non-transitory, computer-readable storage medium embodying instructions executable by the processor for:

responsive to an attempted connection from a client to a server for establishing communications between the client and the server:

redirecting the connection to a proxy; and

injecting protocol-independent header information into a datagram as an encrypted portion of the datagram at a beginning of a Transmission Control Protocol (TCP) stream of traffic between the client and the server, the protocol-independent header information including information based upon which the proxy enforces a security policy, wherein the protocol-independent header information includes identifying information associated with the client and is encrypted with a user-specific key.

6. The system of claim 5 , wherein the security policy relates to a content inspection service performed by the proxy.

7. The system of claim 5 , wherein the user-specific key is defined by user-specific information within the protocol-independent header information, such that the user-specific information is usable by the proxy to decrypt the protocol-independent header information.

8. The system of claim 7 , wherein encrypting the protocol-independent header information with the user-specific key comprises encrypting the protocol-independent header information with a key selected from a plurality of keys associated with a user, wherein the user-specific key selected from the plurality of keys is defined by a key identifier associated with the user within the protocol-independent header information.

9. A non-transitory, computer-readable storage medium embodying computer executable instructions configured for:

responsive to an attempted connection from a client to a server for establishing communications between the client and the server:

redirecting the connection to a proxy; and

injecting protocol-independent header information into a datagram as an encrypted portion of the datagram at a beginning of a Transmission Control Protocol (TCP) stream of traffic between the client and the server, the protocol-independent header information including information based upon which the proxy enforces a security policy, wherein the protocol-independent header information includes identifying information associated with the client and is encrypted with a user-specific key.

10. The computer-readable storage medium of claim 9 , wherein the security policy relates to a content inspection service performed by the proxy.

11. The computer-readable storage medium of claim 9 , wherein the user-specific key is defined by user-specific information within the protocol-independent header information, such that the user-specific information is usable by the proxy to decrypt the protocol-independent header information.

12. The computer-readable storage medium of claim 11 , wherein encrypting the protocol-independent header information with the user-specific key comprises encrypting the protocol-independent header information with a key selected from a plurality of keys associated with a user, wherein the user-specific key selected from the plurality of keys is defined by a key identifier associated with the user within the protocol-independent header information.

13. The method of claim 1 , wherein the security policy is a user-specific security policy.

14. The method of claim 1 , wherein the security policy is an application-specific security policy.

15. The system of claim 5 , wherein the security policy is a user-specific security policy.

16. The system of claim 5 , wherein the security policy is an application-specific security policy.

17. The computer-readable storage medium of claim 9 , wherein the security policy is a user-specific security policy.

18. The computer-readable storage medium of claim 9 , wherein the security policy is an application-specific security policy.

Assignments (10)