Dynamic Session Key Acquisition for Encrypted Traffic Monitoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Active SSL inspection methods introduce performance bottlenecks in processing live network traffic by requiring decryption and re-encryption of SSL traffic, which is computationally expensive and resource-intensive in virtual network environments.

Innovation Solution

A dynamic session key acquisition (DSKA) engine is used to obtain and provide session decryption information to a network traffic monitoring agent, allowing for passive decryption of encrypted network traffic flows without the need for active proxy functionality, thereby reducing the computational burden.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If active SSL inspection is used to monitor encrypted network traffic, then network traffic visibility is improved, but system performance and resource utilization deteriorate due to decryption and re-encryption overhead

Engineering Contradiction:

Improvenetwork traffic visibilityVSAvoidsystem throughput

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The patent extracts only the session decryption information (cryptographic keys) from the SSL session, separating this essential monitoring data from the actual encrypted traffic flow. The NTM agent receives and stores these keys to enable selective decryption of only the portions of traffic needed for monitoring, rather than decrypting and re-encrypting all traffic as in traditional MITM approaches.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs preliminary acquisition of session decryption information during the SSL session establishment phase. The DSKA engine captures cryptographic keys before the actual data transfer begins, storing them for later use by the NTM agent. This preliminary action enables efficient monitoring without requiring real-time decryption operations during traffic flow.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If SSL proxy architecture is used to decrypt and re-encrypt traffic, then encrypted traffic monitoring capability is improved, but computational cost and processing time increase significantly

Engineering Contradiction:

Improveencrypted traffic monitoring capabilityVSAvoidprocessing time

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The patent creates a copy of the session decryption information (cryptographic keys) and provides it to the NTM agent. Instead of requiring the NTM agent to perform complex decryption operations on all traffic, the system uses these copied keys to enable selective decryption only when needed for monitoring specific events or data patterns, dramatically reducing processing time.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system implements partial decryption by using the acquired session keys to decrypt only the specific portions of encrypted traffic that are relevant for monitoring purposes, rather than decrypting the entire traffic flow. This selective approach reduces computational overhead and processing time while maintaining monitoring capability.

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If full SSL inspection is implemented to obtain clear-text data for analysis, then monitoring accuracy is improved, but resource consumption and system burden increase

Engineering Contradiction:

Improvemonitoring accuracyVSAvoidresource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent introduces session decryption information (cryptographic keys) as an intermediary element that enables the NTM agent to access clear-text data for monitoring without requiring the agent to perform full decryption operations. The keys act as a mediator between the encrypted traffic and the monitoring function, providing accurate monitoring capability while minimizing resource consumption.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11489666B2Monitoring encrypted network traffic flows in a virtual environment using dynamic session key acquisition techniques

Publication Date: 2022.11.01 KEYSIGHT TECH SINGAPORE (SALES) PTE LTD

AI summary

A method executed by a dynamic session key acquisition (DSKA) engine residing in a virtual environment includes receiving session decryption information extraction instructions that configure the DSKA engine to obtain session decryption information for at least one communication session involving a virtual machine and obtaining the session decryption information from the virtual machine in accordance with the session decryption information extraction instructions. The session decryption information includes cryptographic keys utilized by an application server instance in the virtual machine to establish the at least one communication session. The session decryption information obtained from the virtual machine is stored and provided to a network traffic monitoring (NTM) agent. The NTM agent utilizes the session decryption information to decrypt copies of encrypted network traffic flows belonging to the at least one communication session involving the virtual machine.