Managing session secrets for continuous packet capture systems

1. A method for monitoring communication over a network between one or more computers, with one or more network monitoring computers (NMCs) that perform actions, comprising:

identifying a secure communication session based on detected network traffic patterns that are associated with one or more secure communication protocols;

capturing a plurality of network packets that are securely communicated between the one or more computers in the secure communication session, wherein the plurality of captured network packets is stored in a data store;

providing a query of the captured network packets, by one or more applications or services, that includes one or more expressions in the query to exclude those stored network packets that are encrypted from a result for the query, wherein the query result includes one or more non-encrypted packets that are provided to the one or more applications or services that provided the query, and wherein one or more of the encrypted network packets that are excluded from the query result are provided to the one or more other applications or services;

classifying the one or more secure communication protocols responsive to generating a state machine that mimics state changes of the one or more secure communication protocols associated with the secure communication session based on payload data for the captured network packets, wherein classification of the one or more secure communication protocols is a precondition for classification of the one or more applications;

employing a hardware security module (HSM) to provide key information to one or more of the NMC and the one or more endpoints of the secure communication session, wherein the HSM is stored at the NMC or an endpoint of the secure communication session; and

choosing one or more of an NMC, another application, or a service to employ the key information for selectively decrypting encrypted network packets associated with the secure communication, wherein selective choosing of the encrypted network packets for decryption is based on one or more of configuration information, policy rules, or parameters.

2. The method of claim 1 , further comprising:

employing the one or more NMCs to identify a secure communication session established between two of the one or more computers;

obtaining the key information that corresponds to the secure communication session, wherein the key information includes a session key that is provided by a key provider.

3. The method of claim 1 , further comprising:

providing correlation information associated with a secure communication session between two of the one or more computers, wherein the correlation information includes tuple information associated with the secure communication session; and

storing the key information and the correlation information in a key escrow, wherein the key information is indexed in the key escrow based on the correlation information.

4. The method of claim 1 , further comprising:

when network packets associated with the key information and correlation information are absent from the data store, discarding the key information and the correlation information.

5. The method of claim 1 , further comprising:

providing one or more previously captured encrypted network packets that are associated with one or more secure communication sessions;

providing the key information that is associated with the one or more previously captured encrypted network packets based on correlation information that is associated with the one or more previously captured network packets; and

providing access for one or more services or applications to the one or more previously captured encrypted network packets and the associated key information.

6. The method of claim 1 , further comprising:

providing one or more previously captured network packets that are associated with one or more secure communication sessions;

providing the key information that is associated with the one or more previously captured network packets based on the correlation information that is associated with the one or more previously captured network packets; and

decrypting the one or more previously captured network packets using the key information.

7. A system for monitoring communication over a network between one or more computers comprising:

one or more network monitoring computers (NMCs), comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

identifying a secure communication session based on detected network traffic patterns that are associated with one or more secure communication protocols;

capturing a plurality of network packets that are securely communicated between the one or more computers in the secure communication session, wherein the plurality of captured network packets is stored in a data store;

providing a query of the captured network packets, by one or more applications or services, that includes one or more expressions in the query to exclude those stored network packets that are encrypted from a result for the query, wherein the query result includes one or more non-encrypted packets that are provided to the one or more applications or services that provided the query, and wherein one or more of the encrypted network packets that are excluded from the query result are provided to the one or more other applications or services;

classifying the one or more secure communication protocols responsive to generating a state machine that mimics state changes of the one or more secure communication protocols associated with the secure communication session based on payload data for the captured network packets, wherein classification of the one or more secure communication protocols is a precondition for classification of the one or more applications;

employing a hardware security module (HSM) to provide key information to one or more of the NMC and the one or more endpoints of the secure communication session, wherein the HSM is stored at the NMC or an endpoint of the secure communication session; and

choosing one or more of an NMC, another application, or a service to employ the key information for selectively decrypting encrypted network packets associated with the secure communication, wherein selective choosing of the encrypted network packets for decryption is based on one or more of configuration information, policy rules, or parameters; and

the one or more computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing the plurality of network packets.

8. The system of claim 7 , further comprising:

employing the one or more NMCs to identify a secure communication session established between two of the one or more computers;

obtaining the key information that corresponds to the secure communication session, wherein the key information includes a session key that is provided by a key provider.

9. The system of claim 7 , further comprising:

providing correlation information associated with a secure communication session between two of the one or more computers, wherein the correlation information includes tuple information associated with the secure communication session; and

storing the key information and the correlation information in a key escrow, wherein the key information is indexed in the key escrow based on the correlation information.

10. The system of claim 7 , further comprising:

when network packets associated with the key information and correlation information are absent from the data store, discarding the key information and the correlation information.

11. The system of claim 7 , further comprising:

providing one or more previously captured encrypted network packets that are associated with one or more secure communication sessions;

providing the key information that is associated with the one or more previously captured encrypted network packets based on correlation information that is associated with the one or more previously captured network packets; and

providing access for one or more services or applications to the one or more previously captured encrypted network packets and the associated key information.

12. The system of claim 7 , further comprising:

providing one or more previously captured network packets that are associated with one or more secure communication sessions;

providing the key information that is associated with the one or more previously captured network packets based on the correlation information that is associated with the one or more previously captured network packets; and

decrypting the one or more previously captured network packets using the key information.

13. A network monitoring computer (NMC) for monitoring communication over a network between one or more computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

identifying a secure communication session based on detected network traffic patterns that are associated with one or more secure communication protocols;

capturing a plurality of network packets that are securely communicated between the one or more computers in the secure communication session, wherein the plurality of captured network packets is stored in a data store;

providing a query of the captured network packets, by one or more applications or services, that includes one or more expressions in the query to exclude those stored network packets that are encrypted from a result for the query, wherein the query result includes one or more non-encrypted packets that are provided to the one or more applications or services that provided the query, and wherein one or more of the encrypted network packets that are excluded from the query result are provided to the one or more other applications or services;

classifying the one or more secure communication protocols responsive to generating a state machine that mimics state changes of the one or more secure communication protocols associated with the secure communication session based on payload data for the captured network packets, wherein classification of the one or more secure communication protocols is a precondition for classification of the one or more applications;

employing a hardware security module (HSM) to provide key information to one or more of the NMC and the one or more endpoints of the secure communication session, wherein the HSM is stored at the NMC or an endpoint of the secure communication session; and

choosing one or more of an NMC, another application, or a service to employ the key information for selectively decrypting encrypted network packets associated with the secure communication, wherein selective choosing of the encrypted network packets for decryption is based on one or more of configuration information, policy rules, or parameters.

14. The NMC of claim 13 , further comprising:

employing the one or more NMCs to identify a secure communication session established between two of the one or more computers;

obtaining the key information that corresponds to the secure communication session, wherein the key information includes a session key that is provided by a key provider.

15. The NMC of claim 13 , further comprising:

providing correlation information associated with a secure communication session between two of the one or more computers, wherein the correlation information includes tuple information associated with the secure communication session; and

storing the key information and the correlation information in a key escrow, wherein the key information is indexed in the key escrow based on the correlation information.

16. The NMC of claim 13 , further comprising:

when network packets associated with the key information and correlation information are absent from the data store, discarding the key information and the correlation information.

17. The NMC of claim 13 , further comprising:

providing one or more previously captured encrypted network packets that are associated with one or more secure communication sessions;

providing the key information that is associated with the one or more previously captured encrypted network packets based on correlation information that is associated with the one or more previously captured network packets; and

providing access for one or more services or applications to the one or more previously captured encrypted network packets and the associated key information.

18. The NMC of claim 13 , further comprising:

providing one or more previously captured network packets that are associated with one or more secure communication sessions;

providing the key information that is associated with the one or more previously captured network packets based on the correlation information that is associated with the one or more previously captured network packets; and

decrypting the one or more previously captured network packets using the key information.

19. A processor readable non-transitory storage media that includes instructions for monitoring communication over a network between one or more computers, wherein execution of the instructions by one or more processors on one or more network monitoring computers (NMCs) performs actions, comprising:

identifying a secure communication session based on detected network traffic patterns that are associated with one or more secure communication protocols;

capturing a plurality of network packets that are securely communicated between the one or more computers in the secure communication session, wherein the plurality of captured network packets is stored in a data store;

providing a query of the captured network packets, by one or more applications or services, that includes one or more expressions in the query to exclude those stored network packets that are encrypted from a result for the query, wherein the query result includes one or more non-encrypted packets that are provided to the one or more applications or services that provided the query, and wherein one or more of the encrypted network packets that are excluded from the query result are provided to the one or more other applications or services;

classifying the one or more secure communication protocols responsive to generating a state machine that mimics state changes of the one or more secure communication protocols associated with the secure communication session based on payload data for the captured network packets, wherein classification of the one or more secure communication protocols is a precondition for classification of the one or more applications;

employing a hardware security module (HSM) to provide key information to one or more of the NMC and the one or more endpoints of the secure communication session, wherein the HSM is stored at the NMC or an endpoint of the secure communication session; and

choosing one or more of an NMC, another application, or a service to employ the key information for selectively decrypting encrypted network packets associated with the secure communication, wherein selective choosing of the encrypted network packets for decryption is based on one or more of configuration information, policy rules, or parameters.

20. The media of claim 19 , further comprising:

employing the one or more NMCs to identify a secure communication session established between two of the one or more computers;

obtaining the key information that corresponds to the secure communication session, wherein the key information includes a session key that is provided by a key provider.