VPN Traffic Mirroring Key Correlation for Secure Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Encrypted network traffic obstructs monitoring and analysis in cloud-based infrastructure, hindering effective traffic mirroring and decryption for organizations relying on secure VPNs.
Innovation Solution
An orchestrator configures security appliances to mirror network traffic and copy cryptographic keys to a cloud-based repository, correlating packets and tunnel keys using a virtual machine (VM) to decrypt and re-encrypt data with a random key, ensuring secure conveyance to the organization for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec encryption is used to protect network traffic, then security is improved, but monitoring and analysis capability deteriorates
Solution Approach 1:
The patent introduces a cloud service provider as an intermediary that mirrors encrypted traffic to a security appliance. The security appliance then correlates this mirrored traffic with decryption keys obtained through key enumeration, enabling monitoring and analysis without breaking the original encryption security. This intermediary approach allows both security maintenance and monitoring capability restoration.
Solution Approach 2:
The patent creates a copy of the encrypted network traffic through cloud-based traffic mirroring to a security appliance. This copy can be analyzed and correlated with decryption keys without affecting the original encrypted traffic flow, thus maintaining security while enabling monitoring capabilities on the copied data.
2Difficulty of detecting and measuring
If traffic mirroring is implemented to enable monitoring, then monitoring capability is improved, but security control deteriorates
Solution Approach 1:
The cloud service provider acts as a trusted intermediary that performs the traffic mirroring function. Rather than implementing mirroring directly within the organization's security boundary (which would compromise security control), the intermediary approach allows monitoring capability enhancement while the cloud provider's security measures maintain overall security control.
Solution Approach 2:
The patent creates a copy of encrypted traffic through cloud-based mirroring infrastructure. This copying mechanism enables monitoring capability improvement while the original encrypted traffic continues to flow securely through the VPN tunnel, maintaining security control over the primary data path.
3Productivity
If decryption keys are stored centrally for correlation, then correlation efficiency is improved, but security risk increases
Solution Approach 1:
The security appliance acts as an intermediary that securely stores and manages decryption keys. Rather than storing keys directly in the cloud or within the organization's infrastructure (both of which introduce security risks), the intermediary security appliance provides secure key storage and controlled access, improving correlation efficiency while mitigating security risks through dedicated security measures.
Data Source
AI summary
An orchestrator that manages security appliances for an organization determines a sink configured for traffic mirroring and correspondingly configures components for the correlation and secure conveyance. The orchestrator also configures the security appliances. The orchestrator configures the security appliances to copy cryptographic keys (hereinafter “tunnel keys”) and identifiers associated with the keys of secure VPN tunnels established by the security appliances to a repository of the cloud-service provider. The orchestrator configures a virtual machine associated with the mirroring sink with correlation logic. The virtual machine correlates sets of packets aggregated across different mirroring streams and tunnel keys with the associated identifiers. Correlating the sets of packets and the tunnel keys allows an organization to efficiently access the content of the encrypted packets or facilitates secure conveyance.