Key Broker for Network Packet Broker Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network packet brokers face limitations in decrypting network traffic for analysis due to the growing diversity of decryption keys, leading to inefficiencies in managing and distributing these keys across network monitoring devices.
Innovation Solution
A system that includes a key broker to manage the distribution of decryption keys by intercepting packets, retrieving corresponding keys from a secure keystore based on metadata, and providing them to network monitoring devices, along with mechanisms for tracking, leasing, and prioritizing keys to ensure optimal decryption performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a network packet broker stores all decryption keys locally to decrypt network traffic, then decryption capability is improved, but device complexity and storage requirements increase significantly
Solution Approach 1:
The patent extracts the decryption key storage function from the network packet broker and places it in a separate secure keystore. The NPB only stores metadata (hashes) of decryption keys, while the actual keys are stored externally in the secure keystore. This reduces the complexity and storage requirements of the NPB while maintaining decryption capability.
Solution Approach 2:
The patent introduces a secure keystore as an intermediary component between the network packet broker and the decryption keys. The secure keystore acts as a mediator that stores the actual decryption keys and provides them to the NPB when needed, based on metadata lookups using hashed identifiers.
2Measurement precision
If a network packet broker decrypts all network traffic to enable analysis, then analysis accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent implements partial decryption by using hashed metadata to identify and retrieve only the specific decryption keys needed for particular encrypted traffic flows. Instead of decrypting all traffic or pre-loading all keys, the system performs selective decryption based on traffic identification, reducing processing overhead while maintaining analysis accuracy for relevant traffic.
3Reliability
If decryption keys are stored securely in a separate keystore, then security is improved, but key retrieval complexity increases
Solution Approach 1:
The patent performs preliminary actions by hashing the decryption key identifiers and storing the hashes in the NPB's metadata before the actual key retrieval occurs. This pre-processing of key identification information enables faster and simpler retrieval operations, as the system only needs to match traffic against pre-computed hashes rather than managing complex key identification logic during retrieval.
Data Source
AI summary
A key broker monitors network traffic metadata and determines which decryption keys are required at one or more packet brokers in order to decrypt relevant traffic required by various network monitoring devices. The key broker retrieves the required keys from a secure keystore distributes them, as needed, to the network packet brokers, and dynamically updates the decryption keys stored in the network packet brokers in response to changes in network traffic.