Patent SG-11201807964U-A (SG)
Title: System and methods for decrypting network traffic in a virtualized environment
Inventor: CARAGEA RADU
IPC: G06F21/56
Filed: 2017-03-29
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property -, Organization 11111111011110111010101111101011111011101011101110111110111101111101111011111 International Bureau 0.. .... .. ..... ..... (10) International Publication Number (43) International Publication Date WO 2017/174418 Al 12 October 2017(12.10.2017) WIPO I PCT (51) International Patent Classification: AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, GOOF 21/56 (2013.01) BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FL GB, GD, GE, GH, GM, GT, (21) International Application Number: HN, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KH, KN, PCT/EP2017/057422 KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, (22) International Filing Date: MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, 29 March 2017 (29.03.2017) NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, (25) Filing Language: English TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, (26) Publication Language: English ZA, ZM, ZW. (30) Priority Data: (84) Designated States (unless otherwise indicated, for every 62/317,804 4 April 2016 (04.04.2016) US kind of regional protection available): ARIPO (BW, GH, 15/471,981 28 March 2017 (28.03.2017) US GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, (71) Applicant: BITDEFENDER IPR MANAGEMENT TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, LTD [CY/CY]; Kreontos 12, 1076 Nicosia (CY). DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, (72) Inventor: CARAGEA, Radu; Ale. Emil Botta nr. 3 bl. M105 sc.1 et.6 ap. 25, Sector 3, 031073 Bucuresti (RO). SM, TR), OAPI (BF, BJ, CF, CG, CL CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). (74) Agent: TULUCA, Doina; Bd. Lacul Tei 56, bl. 19, sc. B, Published: ap. 52, sector 2, 020392 Bucuresti (RO). — with international search report (Art. 21(3)) (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, _ (54) Title: SYSTEM AND METHODS FOR DECRYPTING NETWORK TRAFFIC IN A VIRTUALIZED ENVIRONMENT 32 Guest virtual machine 36a 36b 44 pp App. 1 -- 1 I h , 01. I 34 agent Guest OS L — — J 30 Hypervisor Introspection engine Network filter 42 11 12 (lent system hardware GC 40 1-1 FIG. 3 71' 71' IN 1-1 ----. (57) : Described systems and methods enable a decryption of encrypted communication between a client system and a re - IN mote party, for applications such as detection and analysis of malicious software, intrusion detection, and surveillance, among oth - C ers. The client system executes a virtual machine and an introspection engine outside the virtual machine. The introspection engine ei is configured to identify memory pages whose contents have changed between a first session event (e.g., a ServerHello message) and O a second session event (e.g., a ClientFinished message). The respective memory pages are likely to contain encryption key material for the respective communication session. A decryption engine may then attempt to decrypt an encrypted payload of the respective communication session using information derived from the content of the identified memory pages.