IP Library › Granted Patent US 11,310,256
Granted Patent B2
US 11,310,256 · App. 17/483,148 · Granted Apr 19, 2022

Monitoring encrypted network traffic

Inventors: Benjamin Thomas Higgins (Shoreline, WA); Jeff James Costlow (Kingston, WA); John Gemignani, Jr. (Bremerton, WA); Michael Kerber Krause Montague (Lake Forest Park, WA); Eric James Rongo (Seattle, WA); Xue Jun Wu (Seattle, WA)
Assignee: ExtraHop Networks, Inc.
H04L63/1425H04L9/0819H04L43/062H04L43/0876H04L63/0209H04L63/0428H04L63/0807H04L63/0869
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,310,256
App. No.
17/483,148
Filed
Sep 23, 2021
Granted
Apr 19, 2022
Kind
B2
Art Unit
2494
USPC
713/169
Abstract

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers.

Claims (125)

1. A method for monitoring communication over a network between one or more computers, with one or more network monitoring computers (NMCs) that perform actions, comprising:

providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and

in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:

monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;

monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;

monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;

generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;

correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and

generating one or more reports that include information associated with one or more of the client, the resource server, or the control server.

2. The method of claim 1 , further comprising:

providing the one or more keys to the NMC;

employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

3. The method of claim 1 , further comprising:

providing one or more sharing agents to the one or more computers;

determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents;

employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

4. The method of claim 1 , wherein monitoring the first communication between the client and the control server further comprises:

generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and

generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication.

5. The method of claim 1 , wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises:

determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol;

determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and

updating the one or more metrics based on the one or more anomalous characteristics.

6. The method of claim 1 , further comprising:

determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and

generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols.

7. The method of claim 1 , wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol.

8. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more networking monitoring computers perform the method comprising:

providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and

in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:

monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;

monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;

monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;

generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;

correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and

generating one or more reports that include information associated with one or more of the client, the resource server, or the control server.

9. The media of claim 8 , further comprising:

providing the one or more keys to the NMC;

employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

10. The media of claim 8 , further comprising:

providing one or more sharing agents to the one or more computers;

determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents;

employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

11. The media of claim 8 , wherein monitoring the first communication between the client and the control server further comprises:

generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and

generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication.

12. The media of claim 8 , wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises:

determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol;

determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and

updating the one or more metrics based on the one or more anomalous characteristics.

13. The media of claim 8 , further comprising:

determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and

generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols.

14. The media of claim 8 , wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol.

15. A system for monitoring network traffic in a network:

one or more network monitoring computers (NMCs), comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and

in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:

monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;

monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;

monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;

generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;

correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and

generating one or more reports that include information associated with one or more of the client, the resource server, or the control server; and

one or more client computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing at least a portion of one or more of the first communication, the second communication, or the other communication.

16. The system of claim 15 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

providing the one or more keys to the NMC;

employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

17. The system of claim 15 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

providing one or more sharing agents to the one or more computers;

determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents;

employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

18. The system of claim 15 , wherein monitoring the first communication between the client and the control server further comprises:

generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and

generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication.

19. The system of claim 15 , wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises:

determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol;

determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and

updating the one or more metrics based on the one or more anomalous characteristics.

20. The system of claim 15 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and

generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols.

21. The system of claim 15 , wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol.

22. A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing a control server that distributes one or more client keys to the one or more computers, wherein the one or more computers are one or more of a client or a resource server; and

in response to determining network traffic associated with a request from the client to access the resource server, performing further actions, including:

monitoring a first communication between the client and the control server that authenticates the client with the control server and authenticates the control server with the client, wherein a portion of the first communication is encrypted with a client key associated with the client, and wherein the client is provided an authentication token associated with the control server;

monitoring a second communication between the client and the control server that includes a request to access the resource server, wherein a portion of the second communication is encrypted with one or more of the client key or the authentication token, and wherein the control server provides an access token to the client that enables the client to access the resource server;

monitoring other communication between the client and the resource server that includes the access token, wherein one or more portions of the other communication are encrypted with one or more of the access token or one or more other keys derived from one or more of the access token or one or more other portions of the other communication, and wherein the other communication enables the client to access the resource server;

generating one or more metrics based on the network traffic associated with one or more of the first communication, the second communication, or the other communication;

correlating the first communication to the second communication with a first portion of the one or more metrics that is based on one or more non-encrypted portions of the network traffic and a second portion of the one or more metrics that is based on one or more other non-encrypted portions of the network traffic; and

generating one or more reports that include information associated with one or more of the client, the resource server, or the control server.

23. The NMC of claim 22 , wherein the one or more processors execute instructions that perform actions, further comprising:

providing the one or more keys to the NMC;

employing the one or more keys to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

24. The NMC of claim 22 , wherein the one or more processors execute instructions that perform actions, further comprising:

providing one or more sharing agents to the one or more computers;

determining one or more of the client key, the authentication token, or the access token based on information provided by the one or more sharing agents;

employing the one or more of the client key, the authentication token, or the access token to decrypt one or more portions of one or more of the first communication, the second communication, or the other communication; and

updating the one or more metrics based on the one or more decrypted portions of the one or more of the first communication, the second communication, or the other communication.

25. The NMC of claim 22 , wherein monitoring the first communication between the client and the control server further comprises:

generating the first portion of the one or more metrics based on one or more characteristics of the network traffic associated with the first communication; and

generating the second portion of the one or more metrics based on one or more other characteristics of the network traffic associated with the second communication.

26. The NMC of claim 22 , wherein generating the one or more metrics based on the network traffic associated with the first communication, the second communication, or the other communication, further comprises:

determining one or more characteristics associated with one or more of the first communication, the second communication, or the other communication based on one or more portions of non-encrypted network traffic, wherein the one or more characteristics include one or more of time of transmission, packet size, latency, source client, target resource server, tuple information, or application protocol;

determining one or more anomalous characteristics based on one or more values associated with the one or more characteristics, wherein the one or more values exceed one or more threshold values or violate one or more policies, and wherein the one or more anomalous characteristics include one or more of anomalous amount of time for a communication, an anomalous packet size, an anomalous latency, an anomalous source client, an anomalous target resource server, anomalous tuple information, or an anomalous application protocol; and

updating the one or more metrics based on the one or more anomalous characteristics.

27. The NMC of claim 22 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining one or more application protocols employed for one or more of the first communication, the second communication, or the other communication based on one or more characteristics of the network traffic associated with the one or more of the first communication, the second communication, or the other communication; and

generating one or more portions of the one or more metrics based on one or more portions of the first communication, the second communication, or the other communication that are included in payload network traffic associated with the one or more application protocols.

28. The NMC of claim 22 , wherein the first communication, the second communication, and the other communication conform to a Kerberos authentication protocol.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 23, 2021
From: HIGGINS, BENJAMIN THOMAS; COSTLOW, JEFF JAMES; GEMIGNANI, JOHN, JR.; MONTAGUE, MICHAEL KERBER KRAUSE; RONGO, ERIC JAMES; WU, XUE JUN
To: EXTRAHOP NETWORKS, INC.
Reel/Frame 057579/0713 →
Continuity (2)
Provisional Application 63082262 · Sep 23, 2020
Related Publication 20220094706A1 · Mar 24, 2022
Cited By (7)
US 12,225,030 US 12,309,192 US 12,355,816 US 12,483,384 US 12,587,535 US 12,647,441 US 12,652,312