Intelligent certificate discovery in physical and virtualized networks
Mechanisms are provided, in a communication device associated with a first computing device, for capturing security data exchanged between the first computing device and a second computing device. The mechanisms receive a data message from either the first computing device or the second computing device. The data message is part of an operation for establishing a secure communication connection between the first computing device and the second computing device. The mechanisms filter the received data message for security data passed in the received data message and mirror the security data to an analysis port of the communication device. Moreover, the mechanisms output, via the analysis port, the security data to a data collection and analysis system that analyzes the security data with regard to security requirement compliance.
1 . A method, in a switch associated with a first computing device, for capturing security data exchanged between the first computing device and a second computing device, the method comprising:
in a first port of the switch, receiving data messages from either the first computing device or the second computing device to be passed from the first port of the switch to a second port of the switch;
by a switch port analyzer of the switch, identifying from the data messages a handshake operation or other negotiation to establish a secure communication connection between the first computing device and the second computing device;
by the switch port analyzer, after identifying the handshake operation or the other negotiation, monitoring the data messages between the first computing device and the second computing device for security certificate data;
by the switch port analyzer of the switch, responsive to monitoring the one or more additional data messages, identifying one of the data messages as including security certificate data and extracting the security certificate data from the one of the data messages;
after identifying the one of the data messages, by the switch port analyzer, mirroring at least the extracted security certificate data to an analysis port of the switch;
after mirroring the extracted security certificate data, by the switch via the analysis port, outputting the mirrored extracted security data to a data collection and analysis system that is distinct from the switch.
2 . The method of claim 1 , wherein identifying the one of the data messages as including security certificate data and extracting the security certificate data from the one of the data messages comprises analyzing a traffic flow of data traffic through the switch by implementing logic to identify patterns of the data messages passed between the first computing device and the second computing device, field values in headers of data messages in the traffic flow, tags in data messages in the traffic flow, or communication identifiers corresponding to types of communications used to establish secure communication connections; and
identifying the received data message as a message that is part of the operation for establishing a secure communication connection in response to the received data messages being identified by the logic as being a communication used to establish the secure communication connection.
3 . The method of claim 1 , wherein the extracted security certificate data comprises an unencrypted security certificate.
4 . The method of claim 3 , wherein the unencrypted security certificate is a security certificate of the second computing device passed in the received data message as part of a traffic flow from the second computing device to the first computing device.
5 . The method of claim 1 , further comprising analyzing the extracted security certificate data with regard to security requirement compliance.
6 . The method of claim 1 , further comprising determining whether or not one or more security compliance requirements are met by a secure communication connection.
7 . The method of claim 1 , further comprising:
analyzing, by the data collection and analysis system, the security data to identify at least one of certificate usage trends, risky certificate analytics, or security alert trigger analytics;
comparing results of the analysis with one or more security compliance requirements; and
determining whether or not the one or more security compliance requirements are met by the secure communication connection.
8 . The method of claim 1 , wherein the switch is a physically coupled to one of the first computing device or the second computing device.
9 . The method of claim 1 , wherein the analysis port is a physical port of the switch.
10 . The method of claim 1 , wherein the analysis port is a virtualized port of the switch.
11 . The method of claim 1 , wherein the first computing device is a server computing device and the second computing device is a client computing device.
12 . The method of claim 11 , wherein the data messages is part of an ingress traffic flow from the client computing device to the server computing device.
13 . A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a switch associated with a first computing device, causes the switch to perform a method including:
in a first port of the switch, receive data messages from either the first computing device or a second computing device;
by a switch port analyzer of the switch, identify from the data messages a handshake operation or other negotiation to establish a secure communication connection between the first computing device and the second computing device;
by the switch port analyzer, after the handshake operation or the other negotiation is identified, monitoring the data messages between the first computing device and the second computing device for security certificate data;
by the switch port analyzer of the switch, responsive to monitoring the data messages, identifying one of the data messages as including security certificate data and extracting the security certificate data from the one of the data messages;
after the one of the data messages is identified, by the switch port analyzer, mirror at least the extracted security certificate data to an analysis port of the switch; and
after the extracted security certificate data is mirrored, by the switch via the analysis port, output, via the analysis port, output the mirrored extracted security certificate data to a data collection and analysis system that is distinct from the switch.
14 . The computer program product of claim 13 , wherein the extracted security certificate data comprises an unencrypted security certificate.
15 . The computer program product of claim 14 , wherein the unencrypted security certificate is a security certificate of the second computing device passed in the received data message as part of a traffic flow from the second computing device to the first computing device.
16 . The computer program product of claim 13 , wherein the computer readable program, when executed on the switch, causes the switch to analyze the extracted security certificate data with regard to security requirement compliance.
17 . The computer program product of claim 13 , wherein the computer readable program, when executed on the switch, causes the switch to determine whether or not one or more security compliance requirements are met by the secure communication connection.
18 . The computer program product of claim 13 , wherein the first computing device is a server computing device and the second computing device is a client computing device.
19 . A switch, comprising:
a switch port analyzer;
a first port communicably couplable to a first computing device and a second computing device; and
an analysis port communicably couplable to a data collection and analysis system that is distinct from the switch;
wherein the switch port analyzer comprises logic configured to:
in the first port, receive data messages from either the first computing device or the second computing device;
identify from the data messages a handshake operation or other negotiation to establish a secure communication connection between the first computing device and the second computing device;
after the handshake operation or the other negotiation is identified, monitor the data messages between the first computing device and the second computing device for security certificate data;
responsive to monitoring the data messages, identify one of the data messages as including security certificate data and extract the security certificate data from the one of the data messages;
after the filtered, by the switch the one of the data messages is identified, mirror at least the extracted security certificate data to an analysis port of the switch; and
after the extracted security certificate data is mirrored, by the switch via the analysis port, output, via the analysis port, output the mirrored extracted security certificate data to a data collection and analysis system that is distinct from the switch.
20 . A system, comprising
the switch of claim 19 ;
the first computing device communicably coupled to the first port of the switch;
the second computing device communicably coupled to the first port of the switch; and
the data collection and analysis system communicably coupled to the analysis port.
21 . The method of claim 1 , wherein identifying from the data messages the handshake operation or other negotiation includes identifying from the data messages the handshake operation.