Decrypting TLS Traffic Without Man-in-the-Middle Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security platforms struggle to maintain effective malware and virus protection for web servers when using stronger, ephemeral encryption keys, as existing methods like the 'known key' approach become impractical due to frequent key changes, leading to degraded capabilities in inspecting network packets and protecting against malicious data.
Innovation Solution
Implementing a system that intercepts and automatically obtains ephemeral encryption keys for network appliances, allowing them to decrypt TLS communication securely and efficiently, even when the web server encryption key changes frequently, using a secure secondary communication path and interceptor logic within the web server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the web server uses stronger, ephemeral encryption keys frequently changed for enhanced security, then the security strength and forward secrecy are improved, but the network security platform's ability to inspect and analyze encrypted traffic deteriorates because administrators cannot practically update keys on the NSP for each change
Solution Approach 1:
The patent introduces an intermediary component - a secure communication interface and key exchange mechanism between the web server and NSP. This intermediary automatically receives ephemeral decryption keys from the web server through a secure channel (such as a dedicated port or out-of-band communication) and makes them available to the decryption module, eliminating the need for manual key management while maintaining security
Solution Approach 2:
The system enables self-service by allowing the web server to automatically provide its own ephemeral keys to the NSP through the secure communication interface. The key exchange process occurs automatically without administrator intervention, with the web server initiating key distribution as part of its normal operation, thus making the system self-maintaining regarding key updates
2Productivity
If the NSP uses the 'known key' approach to decrypt traffic efficiently for heavy loads, then the processing efficiency and productivity are improved, but the adaptability to support newer cipher suites with ephemeral keys deteriorates
Solution Approach 1:
The patent implements dynamic key management where the NSP transitions from static key storage to dynamic key reception. The decryption module is designed to accept and process keys that are continuously updated from the web server, allowing the system to adapt to different cipher suites and key rotation frequencies while maintaining high processing efficiency through optimized decryption pathways
3Measurement precision
If administrators manually manage key changes on NSP devices, then the decryption accuracy and inspection capability are maintained, but the time consumption and operational complexity increase significantly
Solution Approach 1:
The system implements preliminary action by pre-establishing a secure communication channel between the web server and NSP during initial configuration. This channel is prepared in advance to automatically receive and distribute ephemeral keys as they are generated, eliminating the need for reactive manual key updates and ensuring decryption capability is always maintained without time loss
Data Source
AI summary
A network security platform (NSP) device and interaction method are disclosed. The interaction method provides network packet analysis for secure transmission protocols using ephemeral keys or keys that are negotiated dynamically. The NSP may be part of an Intrusion Protection System, or firewall. The disclosed approach does not use man-in-the-middle proxy. Instead, it includes monitoring connections ends: client and/or server, to intercept the required data or negotiated (or changed) encryption keys. Decrypted data may be sent to an NSP sensor in a secure manner for analysis. Alternatively, intercepted keys used for the encrypt/decrypt operations may be sent to an NSP sensor in a secure manner every time they are changed. The NSP sensor may then use the obtained keys to decrypt traffic prior to providing it to the inspection engines. Embodiments focused on inbound traffic to a web server may coordinate between a web server and an NSP.