TLS Decryption for 5G Monitoring
Nubeva SKI for Full Packet Inspection of TLS 1.3 and 1.2 Packet Core Traffic
Network and service performance monitoring must perform deep packet inspection in 5G packet cores networks in order to analyze application behaviors, time API calls, and transaction responses, detect service delays and trace them to root causes which could be relayed to network, compute, or storage performance. This requires full visibility of traffic from the network to the application layer. It is highly likely that inspection for cybersecurity reasons will soon become a driver.
PROBLEM: At the same time, the global mandate for TLS 1.3 for 5G introduces a litany of decryption challenges. Man-in-the-middle-based solutions are not an option due to latency and cost. The passive intercept method does not work on PFS-based traffic of TLS 1.3 and in 1.2.
This has led the industry to the only other option, mirroring clear text traffic from the backend of the sidecar/service mesh proxy, either via the proxy itself or via 3rd party Taps on the internal bridge. But while functional a first blush, Side-car/service-mesh proxy tapping is fraught with significant issues:
- Duplication of traffic and potential blocking of production flows
- Loss of original network telemetry and visibility only at the end “hop”
- Management and traffic engineering complexities
- Need to re-encrypt traffic to safely transport to tools
- Substantial CPU and memory load on every pod and node.
BUSINESS IMPLICATIONS: For the operators, this approach means significantly more cost and complexity for very limited visibility. For providers of inspection and monitoring solutions, this means that they must forgo sales of DPI features unless the customer implements an expensive, less-than-ideal mirroring solution. This will diminish the value they represent to customers as well as the revenues and differentiation it represents to sales and the business.
Fact: Service mesh proxy and sidecar traffic mirroring are insufficient for 5G decrypted visibility.
Nubeva SKI for 5G Monitoring:
The Nubeva SKI solution represents a breakthrough solution to modern TLS Decryption for the application monitoring and assurance industry. SKI can passively decrypt PFS-based traffic as well as traffic to external servers and services and thus re-establishes the out-of-band decryption option for the industry. SKI delivers high-speed, low-cost decryption of all TLS encrypted traffic from any standard passive traffic source (taps, mirrors, SPANs, PCAP files) in any environment (physical, virtual, on-prem, or cloud). SKI is delivered as a modular and comprehensive suite of software components that can be quickly and easily integrated into any system. Add SKI to solve the decryption challenge for customers and sales teams, and to (re)enable high-value deep packet inspection features and functionality for more effective security solutions.
Enable Decryption in 5G Enviorments
Technical Advantage
Decrypt PFS Traffic
Without inline devices, decrypt TLS 1.3, 1.2 with PFS along with any legacy TLS.
High-Speed, Low Cost
Achieve simple, symmetric bulk decryption for breakthrough price performance with very low resource requirements.
Decrypt 3rd Party Traffic
Traffic to the internet and 3rd party servers and services, including cloud platforms - capability never before possible.
Decrypt Pinned and Client Cert Traffic
See into pinned traffic such as MS365, G-Suite, Dropbox, and most Mobile, and other pinned traffic as well as MTLS/client-side cert-based sessions.
Easier Operations and Security
Reduce operational headache with no server keypair management or PKI interaction SKI offers a lower-risk architecture with an independent and ephemeral key plane.
Deliver More Value to Your Customers
Business Advantages
More Value to Customer
With expanded DPI capabilities, provide an expanded solution option to customers and remove the need for inline decryption projects and budgets.
Reduce Sales Friction
Increase market opportunity allows sales teams to sell more value, leading to more products, close bigger deals and lasting customer success.
Lower Support Complexities
Empower your sales engineers and support teams, simplifying pre-sales engineering and post-sales implementation and reducing ticket count and complexity.
Integrate Nubeva SKI into Your Product Suite
Adding Nubeva SKI into your products can be fast and easy, allowing you to get to market quickly with low entry hurdles.
The core concept of Nubeva SKI is to capture session keys from TLS servers or clients and forward them securely to authorized decryption engines. With session keys available, low-cost bulk decryption of any traffic is simple and high speed. Decryption is trivial, simply match traffic with keys using a TLS session’s client-random value, and decrypt.
Nubeva provides software to get keys and to decrypt using keys. Our comprehensive suite of software components, available in source or binary forms, enables fast and flexible SKI decryption implementation into most product sets. While there are many implementation models and options for inline inspection systems, here are the basics.
Get Session Keys
Nubeva has perfected the learning and exporting keys from application and TLS process memory as they are created during the TLS handshake. Simply deploy our session key learning software on any VM, node, or endpoint.
Key learning software is delivered as a C library or turnkey agents and containers in binary or source code form. Key extraction is 100% reliable. This read-only micro-process is ultra-secure, transparent, and non-disruptive to application code, does not impact applications, and operates with minute memory and CPU requirements.
Get Keys for:
-
Any TLS 1.3, 1.2, and legacy.
-
Any session N-S-E-W including pinned and client certificate sessions.
-
Traffic to internet, cloud, and other 3rd party servers and services
-
For metal, VM's, container hosts in datacenter or cloud and/or client endpoints.
-
From OS and commercial applications as well as malware communications
Implementations:
-
Have an agent? - Add the ability to get session keys simply and easily using the SKI Sensor C Library
-
No agent? - Add to your portfolio with Nubeva's off-the-shelf SKI Sensor Agents and Containers
-
Don't want to have an agent? - Resell Nubeva labeled sensors. Or, simply add the ability to receive and decrypt using session keys to your system and let your customers provide the keys from a growing list of systems with Nubeva SKI Sensor Technology or any other key source.
Decrypt with Session Keys
Nubeva complements session key discovery with a suite of decryption support options enabling IDS, NDR, and other passive vendors to add the ability to receive session keys and decrypt. We offer a multitude of implementation options to meet virtually any architectural model and go-to-market packaging scenario. Inspection systems need only minor modifications to receive keys and to decrypt using them.
Decrypt Using Keys:
-
Enhance existing datapath or add net new
-
Any traffic and any session
-
Leverage crypto instruction set acceleration in standard CPUs
-
Achieve ultra high throughputs over 25Gb/s per core
-
Miniscule CPU and memory resource requirements
Implementation Options
-
Already have Decryption? – Add the ability to receive keys and decrypt by modifying your existing engine or utilizing Nubeva’s SKI Decrypt TLS C library and reference code.
-
Don't have Decryption? Nubeva’s Decryptor Containers and Keyserver Container provide a fast and easy implementation to receive keys and decrypt traffic onboard.
There are a myriad of implementation options spanning key acquisition, key transport, and handling, as well as decryption.
Nubeva works with our customers to develop the ideal architecture and craft highly customized licensing programs and support services to enable customer success.
Let's discuss how SKI can work with your systems.
