Zscaler, Inc.
Encrypted traffic inspection in a cloud-based security system

Abstract:

Systems and methods include, in a node operating as a snooping proxy, monitoring traffic between a user device and the Internet; detecting and monitoring a handshake between the user device and an endpoint for determining keys associated with encryption between the user device and the endpoint; monitoring encrypted traffic between the user device and the endpoint subsequent to the handshake based on the keys; and performing one or more security functions on the encrypted traffic based on the monitoring. The node can be part of a cloud-based security system and configured inline between the user device and the endpoint.