Patent ID: 9176838
Filing Date: 2015-11-03
Classification: G06F,H04L

Abstract:
1. A method for analyzing an encrypted network flow, comprising: monitoring, by a firewall, the encrypted network flow of an encryption protocol session between a first node and a second node, the encryption protocol session initiated by a process associated with an application on the first node; duplicating the encrypted network flow to form a copy of the encrypted network flow; receiving, at the firewall from an extraction module on the first node, a message containing a shared secret associated with the encrypted network flow, wherein the shared secret is determined by the first and second nodes based, at least in part, on information exchanged between the first and second nodes, and wherein, responsive to identifying at the first node an initiation of a handshake of the encrypted protocol session, the extraction module is to open a memory space of the process to extract the shared secret to send to the firewall; decrypting, by the firewall, the copy of the encrypted network flow using the shared secret received from the extraction module to form a network flow copy; and scanning the network flow copy for targeted data.