Destination domain extraction for secure protocols

1. A system for destination domain extraction for secure protocols, comprising:

a processor configured to:

monitor network communications between a client and a remote server;

determine if a resumed session of a secure connection has occurred, wherein the resumed session omits including a public certificate sent from the remote server;

extract a destination domain from the resumed session to resume the secure connection with the remote server, comprising to:

extract the destination domain from a server name indication (SNI) of a client hello message sent from the client to the remote server, comprising to:

identify the SNI from the client hello message by parsing handshaking traffic for setting the resumed session between the client and the remote server; and

resume the secure connection based on the extracted destination domain without requiring decryption of the secure connection; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein a secure protocol is a secure sockets layer (SSL) protocol or transport layer security (TLS) protocol.

3. The system recited in claim 1 , wherein a secure protocol is a secure sockets layer (SSL) protocol or transport layer security (TLS) protocol, wherein the client hello message is an unencrypted communication.

4. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the destination domain extracted from the server name indication (SNI) of a client hello message sent from the client to the remote server matches a domain identified in the public certificate sent from the remote server to the client during an initial setup of the secure connection.

5. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device.

6. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device, wherein the security policy includes a malware detection policy.

7. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device, wherein the security policy includes a uniform resource locator (URL)/category filtering related policy.

8. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device, wherein the security policy includes a whitelist/blacklist policy.

9. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device, wherein the security policy includes a whitelist/blacklist policy, and wherein a session associated with the network communications between the client and the remote server are not decrypted if the destination domain is included in a whitelist of the whitelist/blacklist policy.

10. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device, wherein the security policy includes a whitelist/blacklist policy, and wherein a session associated with the network communications between the client and the remote server are decrypted if the destination domain is included in a blacklist of the whitelist/blacklist policy.

11. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

apply a security policy based on the destination domain to filter traffic at the security device, wherein a session associated with the network communications between the client and the remote server are decrypted to verify that the destination domain extracted from a server name indication (SNI) matches a domain associated with a uniform resource locator (URL) for the session associated with the network communications between the client and the remote server.

12. The system recited in claim 1 , wherein the processor is further configured to:

decrypt a monitored encrypted network communications of a session associated with the network communications between the client and the remote server to verify that the destination domain extracted from the server name indication (SNI) matches a domain associated with a uniform resource locator (URL) for the session associated with the network communications between the client and the remote server.

13. The system recited in claim 1 , wherein the system includes a security device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the remote server;

send a request to establish the encrypted session on behalf of the client to the remote server;

send an encrypted session response to the client on behalf of the remote server using a session key associated with the security device;

decrypt encrypted traffic between the client and the remote server to monitor for a request from the client to create a tunnel using a first protocol with the remote server;

allow the request to create the tunnel;

monitor decrypted session traffic between the client and the remote server over the tunnel based on one or more firewall policies; and

block the session traffic using the security device if a violation of a first firewall policy is determined, wherein the first firewall policy includes a policy for verifying that a destination domain name extracted from the server name indication (SNI) matches a domain associated with a uniform resource locator (URL) for a session associated with the network communications between the client and the remote server.

14. A method for destination domain extraction for secure protocols, comprising:

monitoring network communications between a client and a remote server using a security device;

determine if a resumed session of a secure connection has occurred, wherein the resumed session omits including a public certificate sent from the remote server;

extracting a destination domain from the resumed session to resume the secure connection with the remote server, comprising:

extracting the destination domain from a server name indication (SNI) of a client hello message sent from the client to the remote server, comprising:

identifying the SNI from the client hello message by parsing handshaking traffic for setting the resumed session between the client and the remote server; and

resuming the secure connection based on the extracted destination domain without requiring decryption of the secure connection.

15. The method of claim 14 , wherein a secure protocol is a secure sockets layer (SSL) protocol or transport layer security (TLS) protocol.

16. The method of claim 14 , further comprising:

applying a security policy based on the destination domain to filter traffic at the security device.

17. A computer program product for destination domain extraction for secure protocols, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network communications between a client and a remote server;

determining if a resumed session of a secure connection has occurred, wherein the resumed session omits including a public certificate sent from the remote server;

extracting a destination domain from the resumed session to resume the secure connection with the remote server, comprising:

extracting the destination domain from a server name indication (SNI) of a client hello message sent from the client to the remote server, comprising:

identifying the SNI from the client hello message by parsing handshaking traffic for setting the resumed session between the client and the remote server; and

resuming the secure connection based on the extracted destination domain without requiring decryption of the secure connection.

18. The computer program product recited in claim 17 , wherein a secure protocol is a secure sockets layer (SSL) protocol or transport layer security (TLS) protocol.

19. The computer program product recited in claim 17 , further comprising computer instructions for:

applying a security policy based on the destination domain to filter traffic.