Kernel TLS Correlation of Decrypted Messages and Network Data

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network data decryption and correlation methods, particularly in virtualized or cloud-native infrastructures, face challenges such as implementation complexity, latency issues, and inefficiencies in supporting network analytics solutions, especially for volumetric analysis.

Innovation Solution

Utilizing a kernel application, like the extended Berkeley Packet Filter (eBPF), to capture and correlate decrypted TLS records and network packets within the kernel, enabling real-time network monitoring and analytics without re-encryption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If proxy solutions are used for real-time network data decryption and correlation, then decryption capability and real-time inspection are improved, but device complexity and implementation difficulty increase

Engineering Contradiction:

Improvedecryption capabilityVSAvoidimplementation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a kernel module as an intermediary component that bridges the network stack and user space applications. This kernel module handles TLS decryption and packet correlation internally, eliminating the need for complex external proxy solutions while maintaining decryption capability and real-time inspection functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If proxy solutions are deployed for network decryption, then security threat detection is improved, but network latency increases

Engineering Contradiction:

Improvesecurity threat detectionVSAvoidnetwork latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent replaces the mechanical proxy architecture with a kernel-level implementation that processes decryption and correlation operations within the operating system kernel. This substitution eliminates the additional network hop through external proxies, reducing latency while maintaining security threat detection capabilities through direct access to decrypted data.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If proxy solutions are used for network decryption, then real-time inspection capability is improved, but productivity and performance decrease

Engineering Contradiction:

Improvereal-time inspection capabilityVSAvoidnetwork performance

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent merges the decryption, correlation, and inspection functions into a unified kernel module that operates directly within the network data path. This consolidation eliminates the performance overhead of external proxy processing while maintaining real-time inspection capability, as all operations occur in a single integrated component rather than through multiple sequential processing stages.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentEP4614883A1Systems and methods for correlating decrypted TLS messages with network data in realtime

Publication Date: 2025.09.10 NETSCOUT SYSTEMS INC

Figure 1
Figure 2
Figure 3

AI summary

A method includes identifying, via a kernel application executing in a kernel of a server hosting an application, a handshake operation for a communication session between a client device and the server; retrieving, via the kernel application, a session identifier for the communication session from one or more handshaking messages of the handshake operation for the communication session; storing, via the kernel application, the session identifier in a cache within the kernel; retrieving, via the kernel application, one or more data transfer messages of the communication session after the communication session has been established; correlating, via the kernel application, the one or more data transfer messages of the communication session based on the one or more data transfer messages containing the session identifier; and generating, via the kernel application, a record comprising the one or more correlated data transfer messages.