Granted Patent B2

US 12,592,915 · App. 18/526,253 · Granted Mar 31, 2026

Inventors: Andrew E Ossipov (Lewisville, TX); James W. Kasper (Leander, TX)

Assignee: Cisco Technology, Inc.

H04L63/0428H04L63/1425

Abstract

Claims (78)

1 . A method comprising:

receiving, at a first network device associated with a network, a decryption policy comprising one or more traffic rules for decrypting network traffic associated with connection flows through the network;

receiving network traffic associated with a first connection flow between a first client device and a first application executing on a second network device of the network;

generating a first connection fingerprint associated with the first connection flow based at least in part on first behavioral characteristics of the first client device;

generating a second connection fingerprint associated with the first connection flow based at least in part second behavioral characteristics of the first application;

generating a first risk score associated with the first connection flow based at least in part on the first connection fingerprint and the second connection fingerprint; and

based at least in part on the first risk score and the decryption policy, one of:

decrypting, by the first network device, at least a portion of the network traffic associated with the first connection flow, wherein at least the portion of the network traffic is required to be decrypted to perform one or more security services with respect to the first connection flow; or

refraining from decrypting, by the first network device, the network traffic associated with the first connection flow.

2 . The method of claim 1 , wherein the first risk score indicates at least one of:

a first likelihood that the first connection flow is malicious;

a second likelihood that the first client device is malicious;

a third likelihood that the first application is malicious; and

a fourth likelihood that the second network device is malicious.

3 . The method of claim 1 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the method further comprising:

determining that the first risk score is less than the first risk score threshold; and

refraining from decrypting the network traffic associated with the first connection flow based at least in part on determining that the first risk score is less than the first risk score threshold.

4 . The method of claim 1 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the method further comprising:

determining that the first risk score is greater than the first risk score threshold; and

decrypting at least the portion of the network traffic associated with the first connection flow based at least in part on determining that the first risk score is greater than the first risk score threshold.

5 . The method of claim 1 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the method further comprising:

determining that the first application is a trusted application in the network;

determining that the first risk score is greater than the first risk score threshold; and

decrypting at least the portion of the network traffic associated with the first connection flow based at least in part on determining that the first risk score is greater than the first risk score threshold.

6 . The method of claim 1 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the method further comprising:

determining that the first risk score is less than the first risk score threshold;

determining that the first application is an untrusted application in the network; and

decrypting at least the portion of the network traffic associated with the first connection flow based at least in part on determining that the first application is an untrusted application in the network.

7 . The method of claim 1 , wherein the first behavioral characteristics comprise at least one of:

data fields of the first connection flow that are associated with the first client device;

historical data associated with the first client device, the historical data comprising previous connections flows associated with the first client device; or

an average inter-arrival time of the network traffic associated with the previous connection flows associated with the first client device.

8 . A system comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, at a first network device associated with a network, a decryption policy comprising one or more traffic rules for applying the decryption policy to network traffic associated with connection flows through the network;

receiving network traffic associated with a first connection flow between a first client device and a first application executing on a second network device of the network;

generating a connection pattern associated with the first connection flow based at least in part on first behavioral characteristics of the first client device and second behavioral characteristics of the first application;

generating a first risk score associated with the first connection flow based at least in part on the connection pattern associated with the first connection flow; and

decrypting, by the first network device, at least a portion of the network traffic based at least in part on the first risk score and the decryption policy, wherein at least the portion of the network traffic is required to be decrypted to perform one or more security services with respect to the first connection flow.

9 . The system of claim 8 , wherein the first risk score indicates a likelihood that at least one of the client device, the first application, or the second network device is malicious.

10 . The system of claim 8 , wherein the connection pattern is a first connection pattern, and the operations further comprising:

receiving network traffic associated with a second connection flow between the first client device and a second application executing on a third network device of the network;

generating a second connection pattern associated with the second connection flow based at least in part on the first behavioral characteristics of the first client device and third behavioral characteristics of the second application;

generating a second risk score associated with the second connection flow based at least in part on the second connection pattern associated with the second connection flow;

receiving the network traffic associated with the second connection flow; and

refraining from decrypting the network traffic associated with the second connection flow based at least in part on the second risk score and the decryption policy.

11 . The system of claim 8 , wherein the first behavioral characteristics comprise at least one of:

data fields of the first connection flow that are associated with the first client device;

historical data associated with the first client device, the historical data comprising previous connections flows associated with the first client device; or

an average inter-arrival time of the network traffic associated with the previous connection flows associated with the first client device.

12 . The system of claim 8 , wherein the first network device is a secure access gateway configured to apply security services to the network traffic, the security services comprising at least one of:

a firewall service; and

a deep packet inspection (DPI) service.

13 . The system of claim 8 , wherein the first network device is configured to route the network traffic between the first client device and the first application via the first connection flow.

14 . The system of claim 8 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the operations further comprising determining that the first risk score is less than the first risk score threshold, wherein refraining from decrypting the network traffic associated with the first connection flow is based at least in part on determining that the first risk score is less than the first risk score threshold.

15 . A method comprising: receiving, at a first network device associated with a network, a decryption policy comprising one or more traffic rules for applying the decryption policy to connection flows through the network;

receiving network traffic associated with a first connection flow between a first client device and a first application executing on a second network device of the network;

generating a connection pattern associated with the first connection flow based at least in part on first behavioral characteristics of first client device and second behavioral characteristics of the first application;

generating a first risk score associated with the first connection flow based at least in part on the connection pattern associated with the first connection flow;

and refraining from decrypting, by the first network device, at least a portion of the network traffic associated with the first connection flow based at least in part on the first risk score and the decryption policy, wherein at least the portion of the network traffic is decrypted to perform one or more security services with respect to the first connection flow.

16 . The method of claim 15 , wherein the connection pattern indicates a likelihood that at least one of the client device, the first application, or the second network device is malicious.

17 . The method of claim 15 , wherein the connection pattern is a first connection pattern, and the method further comprising:

receiving network traffic associated with a second connection flow between a second client device and the first application;

generating a second connection pattern associated with the second connection flow based at least in part on the second behavioral characteristics of the first application and third behavioral characteristics of the second client device;

generating a second risk score associated with the second connection flow based at least in part on the second connection pattern associated with the second connection flow; and

decrypting at least a portion of the network traffic associated with the second connection flow based at least in part on the second risk score and the decryption policy.

18 . The method of claim 15 , wherein the second behavioral characteristics comprise at least one of:

data fields of the connection flow that are associated with at least one of the first application or the second network device;

historical data associated with at least one of the first application or the second network device, the historical data comprising previous connections flows associated with at least one of the first application or the second network device; or

an average inter-arrival time of the network traffic associated with the previous connection flows associated with at least one of the first application or the second network device.

19 . The method of claim 15 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the method further comprising:

determining that the first risk score is greater than the first risk score threshold; and

decrypting at least a portion of the network traffic associated with the first connection flow based at least in part on determining that the first risk score is greater than the first risk score threshold.

20 . The method of claim 15 , wherein the decryption policy includes at least a first traffic rule representing a first risk score threshold, and the method further comprising:

determining that the first application is a trusted application in the network;

determining that the first risk score is greater than the first risk score threshold; and

decrypting at least a portion of the network traffic associated with the first connection flow based at least in part on determining that the first risk score is greater than the first risk score threshold.

Assignments (1)

Continuity (2)

References Cited (21)