TLS Decryption for NDR and IDS
Nubeva SKI for Passive Security Inspection Systems
PROBLEM: The broad adoption of PFS (perfect-forward-secrecy) in TLS 1.3 and 1.2, paired with the increasing use of third-party applications and services, renders traditional passive-intercept-based decryption obsolete. End users have two options: implement costly, disruptive, and performance-limiting inline decryption or skip full packet inspection altogether and lose essential visibility into network traffic.
BUSINESS IMPLICATIONS: These technical realities lead to business implications for providers of out-of-band security systems with DPI features. Options include: one, stop offering deep network inspection features or two, depend on the customer to execute secondary and dependent projects (and budgets) to enable your DPI capability. In either case, modern TLS impacts product value and market potential and increases sales friction and support requirements.
Fact: Modern TLS Obsoletes Out-of-Band Decryption, negatively impacting the Passive Security Industry.
Nubeva SKI for Passive Inspection Systems
Nubeva SKI delivers a breakthrough solution to modern TLS decryption for the network security industry. SKI passively decrypts PFS-based traffic and traffic to external servers and services, which re-establishes the out-of-band option for the industry. SKI delivers high-speed, low-cost decryption of all TLS encrypted traffic from any standard passive traffic source (taps, mirrors, SPANs, PCAP files) in any environment (physical, virtual, on-prem, clouds). SKI is a complete suite of modular software components that can easily integrate into any system. Add SKI to solve the decryption challenge for customers and sales teams and to (re)enable high-value full packet monitoring for more effective solutions.
(re)Enable Out-of-Band Decryption
Technical Advantage
Decrypt PFS Traffic
Without inline devices, decrypt TLS 1.3, 1.2 with PFS along with any legacy TLS.
Decrypt 3rd Party Traffic
Traffic to the internet and 3rd party servers and services, including cloud platforms - capability never before possible.
Decrypt Pinned and Client Cert Traffic
See into pinned traffic such as MS365, G-Suite, Dropbox, and most Mobile, and other pinned traffic as well as MTLS/client-side cert-based sessions.
High-Speed, Low Cost
Achieve simple, symmetric bulk decryption for breakthrough price-performance with very low resource requirements.
Easier Operations and Security
Reduce operational headache with no server keypair management or PKI interaction SKI offers a lower-risk architecture with an independent and ephemeral key plane.
Deliver More Value to Your Customers
Business Advantages
More Value to Customer
With expanded DPI capabilities, provide an expanded solution option to customers and remove the need for inline decryption projects and budgets.
Reduce Sales Friction
Increase market opportunity allows sales teams to sell more value, leading to more products, close bigger deals and lasting customer success.
Lower Support Complexities
Empower your sales engineers and support teams, simplifying pre-sales engineering and post-sales implementation and reducing ticket count and complexity.
Add Nubeva SKI into Your Product Suite
Adding Nubeva SKI into your products can be fast and easy, allowing you to get to market quickly with low entry hurdles.
The core concept of Nubeva SKI is to capture session keys from TLS servers or clients and forward them securely to authorized decryption engines. With session keys available, low-cost bulk decryption of any traffic is simple and high speed. Decryption is trivial, simply match traffic with keys using a TLS session’s client-random value, and decrypt.
Nubeva provides software to get keys and to decrypt using keys. Our comprehensive suite of software components, available in source or binary forms, enables fast and flexible SKI decryption implementation into most product sets. While there are many implementation models and options for inline inspection systems, here are the basics.
Get Session Keys
Nubeva has perfected the learning and exporting keys from application and TLS process memory as they are created during the TLS handshake. Simply deploy our session key learning software on any VM, node, or endpoint.
Key learning software is delivered as a C library or turnkey agents and containers in binary or source code form. Key extraction is 100% reliable. This read-only micro-process is ultra-secure, transparent, and non-disruptive to application code, does not impact applications, and operates with minute memory and CPU requirements. Get Keys for:
-
Any TLS 1.3, 1.2, and legacy.
-
Any session N-S-E-W including pinned and client certificate sessions.
-
Traffic to internet, cloud, and other 3rd party servers and services
-
For metal, VM's, container hosts in datacenter or cloud and/or client endpoints.
-
From OS and commercial applications as well as malware communications
Get Started:
Have an agent? - Add the ability to get session keys simply and easily using the SKI Sensor C Library
No agent? - Add to your portfolio with Nubeva's off-the-shelf SKI Sensor Agents and Containers
Don't want to have an agent? - Resell Nubeva labeled sensors. Or, simply add the ability to receive and decrypt using session keys to your system and let your customers provide the keys from a growing list of systems with Nubeva SKI Sensor Technology or any other key source.
Decrypt with Session Keys
Nubeva complements session key discovery with a suite of decryption support options enabling IDS, NDR, and other passive vendors to add the ability to receive session keys and decrypt. We offer a multitude of implementation options to meet virtually any architectural model and go-to-market packaging scenario. Inspection systems need only minor modifications to receive keys and to decrypt using them. Decrypt using keys:
-
Enhance existing datapath or add net new
-
Any traffic and any session
-
Leverage crypto instruction set acceleration in standard CPUs
-
Achieve ultra high throughputs over 25Gb/s per core
-
Miniscule CPU and memory resource requirements
Get Started:
Already have Decryption? – Add the ability to receive keys and decrypt by modifying your existing engine or utilizing Nubeva’s SKI Decrypt TLS C library and reference code.
Don't have Decryption? Nubeva’s Decryptor Containers and Keyserver Container provide a fast and easy implementation to receive keys and decrypt traffic onboard
There are a myriad of implementation options spanning key acquisition, key transport, and handling, as well as decryption.
Nubeva works with our customers to develop the ideal architecture and craft highly customized licensing programs and support services to enable customer success.
Let's discuss how SKI can work with your systems.
