Granted Patent B1

US 12,255,877 · App. 18/661,092 · Granted Mar 18, 2025

Inventors: Oleg Murat Smolsky (Sunnyvale, CA); Vishwanath U. Shenoy (Bengaluru, IN); Krishna Narayanaswamy (Saratoga, CA); Piyush Patel (San Jose, CA)

Assignee: Netskope, Inc.

H04L63/0281H04L63/0428

Abstract

Claims (87)

1. A system, comprising:

a gateway, interposed on a network between a client device associated with a first network address and a cloud hosted service associated with a second network address, wherein the gateway is configured to:

intercept packets of a communication session on the network between the client device and the cloud hosted service,

transmit the packets to an uploader, and

transmit the packets to a proxy;

the uploader configured to:

transmit the packets to a cloud storage location;

the proxy configured to:

derive a session key associated with the communication session, and

transmit the session key to the cloud storage location; and

a stitcher configured to:

obtain the packets and the session key from the cloud storage location,

correlate the packets of the communication session with the session key,

decrypt the packets using the session key to produce plain-text payloads of the packets, and

generate a synthetic packet stream of bidirectional data representing at least a portion of the communication session between the client device and the cloud hosted service based on the packets and using the plain-text payloads of the packets, wherein to generate the synthetic packet stream comprises:

ordering the packets into a sequential order; and

modifying at least one of a destination network address and a source network address in each packet to one of the first network address and the second network address based on an intended destination and a source of the respective packet.

2. The system of claim 1 , wherein the proxy is further configured to:

encrypt the session key, wherein the transmit the session key transmits the encrypted session key.

3. The system of claim 1 , wherein the stitcher is further configured to:

modify level 3 headers, level 4 headers, or both in the packets to generate the synthetic packet stream.

4. The system of claim 1 , further comprising:

a plurality of gateways, wherein:

each gateway of the plurality of gateways has a distinct geographic location;

a plurality of uploaders, wherein:

the uploader is co-located with the gateway, and

the cloud storage location is geo-optimized with the uploader; and

a plurality of stitchers, wherein:

the cloud storage location is geo-optimized with the stitcher.

5. The system of claim 1 , wherein the stitcher is further configured to:

export the synthetic packet stream to a requested format.

6. The system of claim 1 , wherein the stitcher is further configured to:

transmit the synthetic packet stream to an enterprise packet analysis system.

7. The system of claim 6 , wherein the stitcher is further configured to:

transmit the session key to the enterprise packet analysis system with the synthetic packet stream.

8. The system of claim 1 , wherein the stitcher is further configured to:

receive a request for the communication session, wherein the request comprises one or more filtering parameters;

access a time-based slice of data from the cloud storage location in response to the request, wherein the time-based slice of data comprises the packets;

filter the packets in the time-based slice based on the one or more filtering parameters; and

generate the synthetic packet stream using the filtered packets.

9. The system of claim 1 , wherein the uploader is further configured to:

batch the packets as they are transmitted from the gateway; and

transmit the packets to the cloud storage location in batches.

10. The system of claim 1 , wherein the stitcher is further configured to:

periodically poll the cloud storage location for new packets;

obtain the new packets; and

continuously generate synthetic packet streams using the new packets.

11. A computer-implemented method, comprising:

intercepting, at a gateway of a network security system interposed on a network between a client device associated with a first network address and a cloud hosted service associated with a second network address, packets of a communication session on the network between the client device and the cloud hosted service;

transmitting, by an uploader of the network security system, the packets to a cloud storage location;

deriving, by a proxy of the network security system, a session key associated with the communication session from the packets;

transmitting, by the proxy, the session key to the cloud storage location;

obtaining, by a stitcher, the packets and the session key from the cloud storage location;

correlating, by the stitcher, the packets of the communication session with the session key;

decrypting, by the stitcher, the packets using the session key to produce plain-text payloads of the packets; and

stitching, by the stitcher, the packets together into a synthetic packet stream of bidirectional data representing at least a portion of the communication session using the plain-text payloads of the packets, wherein the stitching the packets together comprises:

ordering the packets into a sequential order; and

modifying at least one of a destination address and a source address in each packet to one of the first network address and the second network address based on an intended destination and a source of the respective packet.

12. The method of claim 11 , further comprising:

encrypting, by the proxy, the session key, wherein transmitting the session key transmits the encrypted session key.

13. The method of claim 11 , wherein the stitching the packets together further comprises modifying level 3 headers, level 4 headers, or both in the packets to generate the synthetic packet stream.

14. The method of claim 11 , wherein:

the gateway is a first gateway of a plurality of gateways;

each gateway of the plurality of gateways has a distinct geographic location;

the uploader is a first uploader of a plurality of uploaders;

the first uploader is co-located with the first gateway;

the cloud storage location is geo-optimized with the first uploader;

the stitcher is a first stitcher of a plurality of stitchers; and

the first stitcher is geo-optimized with the cloud storage location.

15. The method of claim 11 , further comprising:

exporting, by the stitcher, the synthetic packet stream to a requested format.

16. The method of claim 11 , further comprising:

transmitting, by the stitcher, the synthetic packet stream to a packet analysis system.

17. The method of claim 16 , further comprising:

transmitting, by the stitcher, the session key to the packet analysis system with the synthetic packet stream.

18. The method of claim 11 , further comprising:

receiving, by the stitcher, a request for the communication session, wherein the request includes one or more filtering parameters;

accessing, by the stitcher, a time-based slice of data from the cloud storage location based on the request, wherein the time-based slice of data comprises the packets;

filtering, by the stitcher, the packets in the time-based slice based on the one or more filtering parameters; and

generating, by the stitcher, the synthetic packet stream using the filtered packets.

19. The method of claim 11 , further comprising:

batching, by the uploader, the packets as they are intercepted by the gateway; and

transmitting, by the uploader the packets to the cloud storage location in batches.

20. The method of claim 11 , further comprising;

periodically polling, by the stitcher, the cloud storage location for new packets;

obtaining, by the stitcher, the new packets; and

continuously generating, by the stitcher, synthetic packet streams using the new packets.

Assignments (1)

References Cited (117)

Cited By (1)

US 12,615,242