US 11,916,932 B2
Endpoint-assisted inspection of encrypted network traffic
Martin Rehak, Prague (CZ); David McGrew, Poolesville, MD (US); Blake Harrell Anderson, Chapel Hill, NC (US); and Scott William Dunlop, Des Moines, WA (US)
Assigned to CISCO TECHNOLOGY, INC., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Apr. 15, 2022, as Appl. No. 17/722,131.
Application 17/722,131 is a continuation of application No. 16/100,361, filed on Aug. 10, 2018, granted, now 11,310,246.
Prior Publication US 2022/0239678 A1, Jul. 28, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 63/02 (2013.01); H04L 63/0428 (2013.01); H04L 63/1425 (2013.01); H04L 63/1441 (2013.01); H04L 63/20 (2013.01); H04L 63/166 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A method, comprising:
obtaining, by a traffic inspection service executed by an intermediary device and from a monitoring agent executed by an endpoint device, a keying information for an encrypted traffic session between the endpoint device and a remote entity, wherein the keying information a) comprises encryption keys exchanged between the endpoint device and the remote entity and b) is obtained, after the encrypted traffic session is formed, by the monitoring agent from a memory space of the endpoint device;
providing, by the traffic inspection service, a notification to the monitoring agent that acknowledges receipt of the keying information, wherein the monitoring agent delays transmission of packets via the encrypted traffic session by the endpoint device until the monitoring agent receives acknowledgement of the receipt of the keying information from the traffic inspection service;
using, by the traffic inspection service, the keying information to decrypt encrypted traffic from the encrypted traffic session, resulting in decrypted traffic;
applying, by the traffic inspection service and based on the decrypted traffic comprising a file from the encrypted traffic session suspected of containing protected information, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine whether the decrypted traffic is against a privacy policy; and
performing, by the traffic inspection service, a mitigation action in response to a determination that the decrypted traffic is against the privacy policy.