Encrypted Network Flow Inspection via Client-Side Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in effectively inspecting encrypted data, particularly with SSL/TLS traffic, due to high overhead and compromised user trust, as existing methods like man-in-the-middle techniques are expensive and do not provide true SSL authentication, leading to inefficiencies and security vulnerabilities.
Innovation Solution
A client-based approach that extracts the SSL/TLS master secret and session keys using a trusted agent on the client, securely sharing this information with a security module via a separate channel, allowing for decryption and inspection of encrypted network flows without compromising end-to-end authentication, and reducing overhead on security devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If man-in-the-middle techniques are used to inspect encrypted data, then inspection capability is improved, but user trust is compromised and overhead increases
Solution Approach 1:
The patent introduces a key broker as an intermediary component that mediates between the client and security module. The key broker securely distributes decryption keys to authorized security modules without compromising the end-to-end encryption between client and server. This allows inspection capability while preserving user trust by maintaining the original encryption integrity.
Solution Approach 2:
The patent extracts the key management function from the traditional man-in-the-middle approach and places it in a dedicated key broker component. This separation allows the security module to obtain decryption keys without actually intercepting or terminating the SSL/TLS connection, thus preserving the original encrypted channel while enabling selective inspection.
2Difficulty of detecting and measuring
If traditional security modules inspect encrypted traffic, then malware detection is improved, but overhead on security devices increases
Solution Approach 1:
The patent extracts the computationally intensive decryption operation from the security module and performs it using the shared secret obtained from the key broker. This separation allows the security module to focus on inspection tasks while the actual decryption is handled efficiently using pre-shared keys, reducing the overhead on security devices.
3Reliability
If end-to-end encryption is implemented, then user trust is improved, but inspection capability deteriorates
Solution Approach 1:
The key broker acts as a trusted intermediary that enables inspection capability without breaking end-to-end encryption. By securely distributing decryption keys to authorized security modules, the system maintains the integrity of end-to-end encryption while allowing authorized inspection of encrypted traffic for security purposes.
Data Source
Figure 1~7
Figure 2
Figure 3~4
AI summary
Technologies are provided in example embodiments for analyzing an encrypted network flow. The technologies include monitoring the encrypted network flow between a first node and a second node, the network flow initiated from the first node; duplicating the encrypted network flow to form a copy of the encrypted network flow; decrypting the copy of the encrypted network flow using a shared secret, the shared secret associated with the first node and the second node; and scanning the network flow copy for targeted data.