Encrypted Traffic Analysis via Session Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus protection systems face challenges in analyzing encrypted network traffic without interfering with security protocols, leading to negative user experiences and reduced effectiveness in detecting malicious objects.
Innovation Solution
A method and system that reroute encrypted traffic to a server, where a session key is obtained and used to decrypt and analyze the traffic for malicious objects, allowing for counteraction without disrupting the security protocols, using a proxy server and program modules to intercept and analyze the traffic synchronously or asynchronously.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a proxy server substitutes the certificate of the web site to enable analysis of encrypted data, then access to encrypted data is provided for security analysis, but the user experience deteriorates with negative impressions and loss of EV status
Solution Approach 1:
The patent introduces a specialized intermediary component (certificate substitution module) that acts as a mediator between the proxy server and the security analysis system. This module selectively substitutes certificates only for suspicious connections while allowing legitimate connections to proceed normally, thus enabling security analysis without broadly degrading user experience across all connections
2Reliability
If antivirus protection routes network traffic through a proxy server for analysis, then security protection is improved, but the complexity of the system increases
Solution Approach 1:
The patent segments the antivirus protection system into distinct functional modules: a traffic interception component, a certificate substitution module, an encrypted data extraction component, and an analysis engine. This segmentation allows each module to perform its specific function independently, making the overall complex system more manageable and maintainable while preserving security effectiveness
3Reliability
If the proxy server extracts and analyzes data from web site pages and files to ensure security, then user and computer security is improved, but the time required for data transmission increases
Solution Approach 1:
The patent implements partial action by selectively analyzing only the portions of encrypted traffic that are suspected of containing malicious content, rather than decrypting and analyzing all traffic uniformly. The certificate substitution is applied only to connections showing suspicious characteristics, allowing legitimate traffic to pass through with minimal processing and thus reducing overall transmission time while maintaining security
Data Source
AI summary
Systems and methods for analyzing content of encrypted traffic between processes are disclosed herein. According to one aspect, an exemplary method comprises rerouting traffic between a first process executing on a first computing device and a second process, to a server, to determine that there is a protected connection established between the first process and the second process, determining information related to an application pertaining to the first process, obtaining a session key for the protected connection by calling a function, wherein the information comprises an address of the function to call to obtain the session key, decrypting and analyzing the rerouted traffic on the server between the first process and the second process using the session key to determine whether the traffic contains malicious objects and in response to determining the traffic contains malicious objects, counteracting the malicious objects by blocking or rerouting the traffic.