Granted Patent B2

US 11,070,533 · App. 16/598,657 · Granted Jul 20, 2021

Inventors: Olli-Pekka Niemi (Helsinki, FI); Andrew Mortensen (Ann Arbor, MI); Valtteri Rahkonen (Kauniainen, FI)

Assignee: Forcepoint LLC

H04L63/0442H04L63/0485H04L63/20

Abstract

Claims (78)

1. A computer-implementable method for managing network communication, comprising:

determining if a server response from a server received at a security device and intended for a client includes original encryption key information for encrypting identifying information associated with the server;

if the server response includes original encryption key information for encrypting identifying information associated with the server, determining if a network policy provides for decryption of identifying information associated with the server; and

if the network policy provides for decryption of identifying information associated with the server:

replacing the original encryption key information with modified encryption key information associated with the security device; and

communicating the server response to the client with the modified encryption key information associated with the security device.

2. The method of claim 1 , further comprising:

receiving at the security device a message from the client in response to the server response received by the client, the message including identifying information associated with the server encrypted with the modified encryption key information;

decrypting the identifying information associated with the server encrypted with the modified encryption key information;

encrypting the identifying information with the original encryption key information; and

communicating the message to the server including the identifying information encrypted with the original encryption key information.

3. The method of claim 2 , further comprising:

responsive to receiving the server response, storing a mapping of identifying information associated with the server response to a mapping cache, wherein the mapping maps identifying information associated with the server response to the original encryption key information; and

responsive to receiving the message, using the mapping cache to determine the original encryption key information for encrypting the identifying information with the original encryption key information.

4. The method of claim 1 , further comprising, if the network policy does not provide for decryption of identifying information associated with the server, communicating the server response to the client with the original encryption key information.

5. The method of claim 4 , further comprising:

receiving at the security device a message from the client in response to the server response received by the client, the message including identifying information associated with the server encrypted with the original encryption key information;

determining if a network policy exists for bypassing decryption of a connection between the server and the client;

if the network policy exists for bypassing decryption of the connection between the server and the client, communicating the message to the server without decryption; and

if no network policy exists for bypassing decryption of the connection between the server and the client, performing decryption of the message.

6. The method of claim 5 , further comprising:

responsive to receiving the server response, storing a mapping of identifying information associated with the server response to a mapping cache, wherein the mapping maps identifying information associated with the server response to then network policy for the connection between the server and the client; and

responsive to receiving the message, using the mapping cache to determine whether the network policy exists for bypassing decryption of the connection between the server and the client.

7. The method of claim 1 , wherein the server response comprises a Domain Name Service response.

8. The method of claim 1 , wherein the identifying information associated with the server is a Server Name Indication associated with the server.

9. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

determining if a server response from a server received at a security device and intended for a client includes original encryption key information for encrypting identifying information associated with the server;

if the server response includes original encryption key information for encrypting identifying information associated with the server, determining if a network policy provides for decryption of identifying information associated with the server; and

if the network policy provides for decryption of identifying information associated with the server:

replacing the original encryption key information with modified encryption key information associated with the security device; and

communicating the server response to the client with the modified encryption key information associated with the security device.

10. The system of claim 9 , the instructions further configured for:

receiving at the security device a message from the client in response to the server response received by the client, the message including identifying information associated with the server encrypted with the modified encryption key information;

decrypting the identifying information associated with the server encrypted with the modified encryption key information;

encrypting the identifying information with the original encryption key information; and

communicating the message to the server including the identifying information encrypted with the original encryption key information.

11. The system of claim 10 , the instructions further configured for:

responsive to receiving the server response, storing a mapping of identifying information associated with the server response to a mapping cache, wherein the mapping maps identifying information associated with the server response to the original encryption key information; and

responsive to receiving the message, using the mapping cache to determine the original encryption key information for encrypting the identifying information with the original encryption key information.

12. The system of claim 9 , the instructions further configured for, if the network policy does not provide for decryption of identifying information associated with the server, communicating the server response to the client with the original encryption key information.

13. The system of claim 12 , the instructions further configured for:

receiving at the security device a message from the client in response to the server response received by the client, the message including identifying information associated with the server encrypted with the original encryption key information;

determining if a network policy exists for bypassing decryption of a connection between the server and the client;

if the network policy exists for bypassing decryption of the connection between the server and the client, communicating the message to the server without decryption; and

if no network policy exists for bypassing decryption of the connection between the server and the client, performing decryption of the message.

14. The system of claim 13 , the instructions further configured for:

responsive to receiving the server response, storing a mapping of identifying information associated with the server response to a mapping cache, wherein the mapping maps identifying information associated with the server response to then network policy for the connection between the server and the client; and

responsive to receiving the message, using the mapping cache to determine whether the network policy exists for bypassing decryption of the connection between the server and the client.

15. The system of claim 9 , wherein the server response comprises a Domain Name Service response.

16. The system of claim 9 , wherein the identifying information associated with the server is a Server Name Indication associated with the server.

17. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

determining if a server response from a server received at a security device and intended for a client includes original encryption key information for encrypting identifying information associated with the server;

if the server response includes original encryption key information for encrypting identifying information associated with the server, determining if a network policy provides for decryption of identifying information associated with the server; and

if the network policy provides for decryption of identifying information associated with the server:

replacing the original encryption key information with modified encryption key information associated with the security device; and

communicating the server response to the client with the modified encryption key information associated with the security device.

18. The storage medium of claim 17 , the instructions further configured for:

receiving at the security device a message from the client in response to the server response received by the client, the message including identifying information associated with the server encrypted with the modified encryption key information;

decrypting the identifying information associated with the server encrypted with the modified encryption key information;

encrypting the identifying information with the original encryption key information; and

communicating the message to the server including the identifying information encrypted with the original encryption key information.

19. The storage medium of claim 18 , the instructions further configured for:

responsive to receiving the server response, storing a mapping of identifying information associated with the server response to a mapping cache, wherein the mapping maps identifying information associated with the server response to the original encryption key information; and

responsive to receiving the message, using the mapping cache to determine the original encryption key information for encrypting the identifying information with the original encryption key information.

20. The storage medium of claim 17 , the instructions further configured for, if the network policy does not provide for decryption of identifying information associated with the server, communicating the server response to the client with the original encryption key information.

21. The storage medium of claim 20 , the instructions further configured for:

receiving at the security device a message from the client in response to the server response received by the client, the message including identifying information associated with the server encrypted with the original encryption key information;

determining if a network policy exists for bypassing decryption of a connection between the server and the client;

if the network policy exists for bypassing decryption of the connection between the server and the client, communicating the message to the server without decryption; and

if no network policy exists for bypassing decryption of the connection between the server and the client, performing decryption of the message.

22. The storage medium of claim 21 , the instructions further configured for:

responsive to receiving the server response, storing a mapping of identifying information associated with the server response to a mapping cache, wherein the mapping maps identifying information associated with the server response to then network policy for the connection between the server and the client; and

responsive to receiving the message, using the mapping cache to determine whether the network policy exists for bypassing decryption of the connection between the server and the client.

23. The storage medium of claim 17 , wherein the server response comprises a Domain Name Service response.

24. The storage medium of claim 17 , wherein the identifying information associated with the server is a Server Name Indication associated with the server.

Assignments (8)