Symantec Corporation

Srinivas Yerra

Ronald A Frederick

Tammy Anita Green

Ron Frederick

Tarun Soin

Dharmendra Mohan

Krists Krilovs

In one embodiment, a first device in a network receives intercepted traffic that has been encrypted. The first device decrypts the intercepted traffic and sends the decrypted traffic to one or more analysis devices in the network. The first device receives a message indicative of a result of analysis of the decrypted traffic by the one or more analysis devices.

Controlling encrypted traffic flows using out-of-path analysis devices

Various techniques are described to authenticate the identity of a proxy in a client-proxy-server configuration. The configuration may have a client-side and a server-side SSL session. In the server-side session, if the proxy has access to the private keys of the client, the proxy may select a client certificate from a collection of client certificates and send the selected certificate to the server to satisfy a client authentication request of the server. If the proxy does not have access to the private keys, the proxy may instead send an emulated client certificate to the server. Further, the client certificate received from the client may be embedded within the emulated client certificate so as to allow the server to directly authenticate the client, in addition to the proxy. An emulated client certificate chain may be formed instead of an emulated client certificate. Similar techniques may be applied to the client-side session.

Exchange of digital certificates in a client-proxy-server network configuration

Growing community of inventors

Sunnyvale, CA, United States of America

Srinivas Yerra