Trusted Intermediate Node Decrypting Encrypted Data Streams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network services cannot inspect or modify encrypted application-level messages, which hinders monitoring and optimization of SSL/TLS and IPsec communications, as intermediate nodes lack access to decryption keys and HMAC values, disrupting end-to-end authentication and authenticity.
Innovation Solution
A trusted intermediate node establishes a secure connection with a key server to obtain session identification data and decryption keys, allowing it to decrypt and compress encrypted messages without modifying them, maintaining authenticity and enabling WAN optimization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic protocols (SSL/TLS, IPsec) are used to provide secure connections, then security and confidentiality are improved, but network services cannot inspect or modify the encrypted traffic
Solution Approach 1:
The patent introduces a key server as an intermediary component that distributes decryption keys to authorized network services. This mediator enables services to decrypt and inspect traffic without compromising the overall security architecture, as the key server controls key distribution and authentication.
Solution Approach 2:
The system segments the security functions by separating key management (handled by the key server) from traffic encryption/decryption (handled by endpoints and network services). This segmentation allows different components to perform specialized functions while maintaining overall system security.
2Reliability
If encrypted traffic is used, then data confidentiality is improved, but network services cannot perform monitoring or optimization functions
Solution Approach 1:
The key server acts as a mediator that enables network services to obtain decryption keys authorized by policy, allowing these services to perform monitoring and optimization functions on previously inaccessible encrypted traffic while maintaining confidentiality through controlled key distribution.
Solution Approach 2:
The system dynamically controls key distribution based on policy requirements. Network services can obtain decryption keys when needed for monitoring or optimization tasks, and the key server manages the dynamic allocation and revocation of these keys based on operational requirements.
3Ease of operation
If decryption keys are distributed to network services, then traffic monitoring capability is improved, but end-to-end authentication and authenticity may be disrupted
Solution Approach 1:
The key server serves as a trusted intermediary that manages key distribution while preserving end-to-end authentication. It authenticates both the endpoints and the network services requesting keys, ensuring that key distribution does not disrupt the original authentication relationships between communicating parties.
Solution Approach 2:
The system implements feedback mechanisms where the key server receives authentication information from endpoints and verifies the legitimacy of key requests. This feedback loop ensures that only authorized services receive decryption keys and that end-to-end authentication integrity is maintained throughout the process.
Data Source
AI summary
Techniques for securely providing cryptographic keys to trusted intermediate nodes or monitoring devices are described so that SSL, TLS, or IPSec communications can be monitored, compressed over a WAN, or otherwise used. In an embodiment, a trusted intermediate node establishes a secure connection to a key server; receiving session identification data for an encrypted session between a client and a content server during negotiation of the encrypted session, and storing a copy of the session identification data; requesting from the key server, over the secure connection, a decryption key associated with the encrypted session; receiving an encrypted message communicated between the client and the content server; forwarding the encrypted message without modification to a destination address in the encrypted message; and decrypting the encrypted message using the decryption key to result in decrypted data and using or storing the decrypted data in a storage unit.