Encrypted Traffic Analysis via Browser Code Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus protection systems face challenges in analyzing encrypted network traffic without interfering with security protocols, leading to a negative user experience and reduced effectiveness in detecting malicious objects.
Innovation Solution
A method and system that reroute traffic between processes to a server to determine if a protected connection is established, obtain a session key, decrypt and analyze the traffic for malicious objects, and counteract them by blocking or rerouting, without intervening in the security protocols, using a proxy server that can perform synchronous or asynchronous analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a proxy server substitutes the certificate of the web site to enable analysis of encrypted traffic, then the ability to detect malicious objects is improved, but the user experience deteriorates due to loss of EV status and green bar indication
Solution Approach 1:
The patent introduces a code injection mechanism that acts as an intermediary between the browser and the TLS handshake process. By injecting code into the browser process, the system can extract the private key and session keys without substituting certificates or intercepting the TLS handshake at the network level. This allows analysis of encrypted traffic while preserving the original certificate validation and EV status display, thus maintaining user experience while enabling malicious object detection.
2Reliability
If synchronous analysis is performed on rerouted traffic, then malicious objects are detected before reaching the user, but traffic flow is delayed affecting performance
Solution Approach 1:
The patent implements a dynamic analysis approach where the system can switch between synchronous and asynchronous analysis modes based on traffic characteristics and security requirements. For high-risk traffic patterns, synchronous analysis is performed to ensure thorough inspection before forwarding. For normal traffic, asynchronous analysis is used where traffic is forwarded immediately and analysis follows in parallel, thus maintaining security effectiveness while minimizing impact on traffic flow speed.
3Ease of operation
If code injection is used to obtain session keys without intervening in security protocols, then user experience is maintained, but system complexity increases
Solution Approach 1:
The patent leverages the browser's own cryptographic implementation by injecting code into the browser process to access session keys that the browser itself generates and manages during the TLS handshake. This self-service approach allows the security system to obtain decryption keys without needing to implement its own certificate authority or interfere with the browser's native security protocols, thus maintaining user experience while managing system complexity through reuse of existing browser functionality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for analyzing content of encrypted traffic between processes are disclosed herein. In one example, a method comprises rerouting traffic between a first process executing on a first computing device and a second process, to a server, to determine that there is a protected connection established between the first process and the second process, determining information related to an application pertaining to the first process, obtaining a session key for the protected connection by calling a function, wherein the information comprises an address of the function to call to obtain the session key, decrypting and analyzing the rerouted traffic on the server between the first process and the second process using the session key to determine whether the traffic contains malicious objects and in response to determining the traffic contains malicious objects, counteracting the malicious objects by blocking or rerouting the traffic.