Selective TLS Key Sharing for Network Security Platform Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for sharing cryptographic session keys among a cluster of network security platforms are not scalable, leading to excessive bandwidth and computational resources, and are inefficient due to the need to distribute keys to all platforms, even when only one is required for monitoring.
Innovation Solution
A novel platform selection procedure that uses parameter values from unencrypted messages during TLS flow establishment to identify the specific network security platform within the cluster that needs the cryptographic session key, enabling efficient key sharing only with the assigned platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic session keys are distributed to all network security platforms in the cluster, then any platform can monitor encrypted traffic, but bandwidth and computational resources increase excessively
Solution Approach 1:
The patent implements local quality by assigning specific monitoring responsibilities to specific platforms based on flow assignment. Each platform receives cryptographic session keys only for the encrypted flows it is assigned to monitor, rather than distributing keys to all platforms. This is achieved through a key distribution mechanism that matches platforms to flows, ensuring that each platform has the necessary keys locally without unnecessary key distribution across the entire cluster.
2Loss of energy
If cryptographic session keys are shared with only one designated platform, then bandwidth and computational resources are reduced, but the system becomes less flexible in handling traffic flow assignments
Solution Approach 1:
The patent implements dynamics by making the key distribution adaptive to flow assignments. The system dynamically determines which platform receives keys based on which platform is assigned to monitor which encrypted flow. This dynamic matching allows the system to maintain flexibility in flow assignment while ensuring that keys are distributed only to the specific platform needed for each flow, avoiding unnecessary key distribution.
3Adaptability or versatility
If cryptographic session keys are distributed to all platforms, then platform versatility is improved, but device complexity increases
Solution Approach 1:
The patent reduces device complexity by implementing local quality in key management. Each platform maintains key information only for the flows it is assigned to monitor, rather than managing keys for all flows in the system. This localized key management approach reduces the complexity of key storage, retrieval, and management operations at each platform while maintaining the ability to monitor assigned flows effectively.
Data Source
AI summary
An example apparatus disclosed herein is to select a first network security platform based on a first value associated with a first message associated a client and a second value associated with a second message associated with a server, the first message and the second message associated with establishment of an encrypted network traffic flow between the client and the server. The disclosed example apparatus is also to cause a cryptographic session key associated with the encrypted network traffic flow to be sent to the first network security platform.