Mirrored VPN Traffic Decryption via Re-Encryption Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Encrypted network traffic in cloud-based VPNs hinders effective monitoring and analysis by cloud service providers and organizations, as existing traffic mirroring technologies do not efficiently facilitate decryption and analysis of encrypted data.
Innovation Solution
An orchestrator configures security appliances to mirror and correlate VPN tunnel keys with packet identifiers, decrypt packets using on-the-fly random keys, and re-encrypt them with an organization's public key for secure conveyance to a designated repository, ensuring only authorized entities can access the decrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traffic mirroring is implemented to monitor encrypted VPN traffic, then network traffic visibility is improved, but security is compromised because decrypted data may be accessed by unauthorized personnel
Solution Approach 1:
A security gateway acts as an intermediary component that receives mirrored encrypted traffic, performs decryption using stored tunnel keys, and forwards the decrypted traffic to monitoring tools. This intermediary architecture ensures that decryption occurs in a controlled environment with restricted access, preventing cloud service provider personnel from accessing sensitive decrypted data while still enabling effective traffic monitoring.
Solution Approach 2:
The system segments the traffic monitoring function from the encrypted traffic flow by creating a separate decryption and monitoring pathway. The security gateway isolates the decryption process from the main VPN traffic flow, allowing monitoring without compromising the security of the primary encrypted communication channel.
2Difficulty of detecting and measuring
If decryption is performed to enable traffic analysis, then network traffic analyzability is improved, but security risks increase due to potential unauthorized access to decrypted data
Solution Approach 1:
The security gateway serves as a secure intermediary that performs decryption in an isolated environment. It receives encrypted traffic from the mirror port, decrypts it using stored tunnel keys, and forwards the decrypted traffic to monitoring tools. This intermediary architecture ensures that decryption occurs only where necessary and that decrypted data is not exposed to unauthorized personnel.
Solution Approach 2:
The system applies different security characteristics to different parts of the system. The security gateway maintains strict access controls and security policies specifically for the decryption function, while the rest of the network infrastructure operates with standard security measures. This localized security approach ensures that the most sensitive operation (decryption) receives the highest level of protection.
3Adaptability or versatility
If tunnel keys are stored for decryption purposes, then decryption capability is improved, but security vulnerabilities increase due to potential key exposure
Solution Approach 1:
The security gateway pre-stores the tunnel keys required for decryption before they are needed for traffic analysis. This preliminary action allows the system to have decryption capability ready without needing to perform key exchange operations in real-time, improving versatility while maintaining security through controlled key storage and access.
Solution Approach 2:
The security gateway acts as a secure intermediary that stores and manages tunnel keys in a protected environment. It controls key access and usage, ensuring that keys are only used for their intended purpose (decrypting mirrored traffic) and are not exposed to unauthorized personnel or systems.
Data Source
AI summary
An orchestrator that manages security appliances for an organization determines a sink configured for traffic mirroring and correspondingly configures components for secure conveyance of mirrored traffic to a sink. The orchestrator configures a VM associated with the mirroring sink to use correlated packets and tunnel keys to securely convey the packets to an organization. The virtual machine decrypts each set of packets with the correlated tunnel key in memory and then re-encrypts the packets with a cryptographic key (hereinafter “random key”) generated on-the-fly for use on the current set of decrypted packets in memory. The virtual machine then encrypts the random key with a public key of the organization that will monitor and/or analyze the traffic data and writes the encrypted packets and/or packet contents and encrypted random key to a specified repository of the organization.