PROBLEM: The broad adoption of PFS (perfect-forward-secrecy) in TLS 1.3 and 1.2, paired with the increasing use of third-party applications and services, renders traditional passive-intercept-based decryption obsolete. End users have two options: implement costly, disruptive, and performance-limiting inline decryption or skip full packet inspection altogether and lose essential visibility into network traffic.
BUSINESS IMPLICATIONS: These technical realities lead to business implications for providers of out-of-band security systems with DPI features. Options include: one, stop offering deep network inspection features or two, depend on the customer to execute secondary and dependent projects (and budgets) to enable your DPI capability. In either case, modern TLS impacts product value and market potential and increases sales friction and support requirements.
Nubeva SKI delivers a breakthrough solution to modern TLS decryption for the network security industry. SKI passively decrypts PFS-based traffic and traffic to external servers and services, which re-establishes the out-of-band option for the industry. SKI delivers high-speed, low-cost decryption of all TLS encrypted traffic from any standard passive traffic source (taps, mirrors, SPANs, PCAP files) in any environment (physical, virtual, on-prem, clouds). SKI is a complete suite of modular software components that can easily integrate into any system. Add SKI to solve the decryption challenge for customers and sales teams and to (re)enable high-value full packet monitoring for more effective solutions.
(re)Enable Out-of-Band Decryption
Without inline devices, decrypt TLS 1.3, 1.2 with PFS along with any legacy TLS.
Traffic to the internet and 3rd party servers and services, including cloud platforms - capability never before possible.
See into pinned traffic such as MS365, G-Suite, Dropbox, and most Mobile, and other pinned traffic as well as MTLS/client-side cert-based sessions.
Achieve simple, symmetric bulk decryption for breakthrough price-performance with very low resource requirements.
Reduce operational headache with no server keypair management or PKI interaction SKI offers a lower-risk architecture with an independent and ephemeral key plane.
Deliver More Value to Your Customers
With expanded DPI capabilities, provide an expanded solution option to customers and remove the need for inline decryption projects and budgets.
Increase market opportunity allows sales teams to sell more value, leading to more products, close bigger deals and lasting customer success.
Empower your sales engineers and support teams, simplifying pre-sales engineering and post-sales implementation and reducing ticket count and complexity.
Adding Nubeva SKI into your products can be fast and easy, allowing you to get to market quickly with low entry hurdles.
The core concept of Nubeva SKI is to capture session keys from TLS servers or clients and forward them securely to authorized decryption engines. With session keys available, low-cost bulk decryption of any traffic is simple and high speed. Decryption is trivial, simply match traffic with keys using a TLS session’s client-random value, and decrypt.
Nubeva provides software to get keys and to decrypt using keys. Our comprehensive suite of software components, available in source or binary forms, enables fast and flexible SKI decryption implementation into most product sets. While there are many implementation models and options for inline inspection systems, here are the basics.
Nubeva has perfected the learning and exporting keys from application and TLS process memory as they are created during the TLS handshake. Simply deploy our session key learning software on any VM, node, or endpoint.
Key learning software is delivered as a C library or turnkey agents and containers in binary or source code form. Key extraction is 100% reliable. This read-only micro-process is ultra-secure, transparent, and non-disruptive to application code, does not impact applications, and operates with minute memory and CPU requirements. Get Keys for:
Any TLS 1.3, 1.2, and legacy.
Any session N-S-E-W including pinned and client certificate sessions.
Traffic to internet, cloud, and other 3rd party servers and services
For metal, VM's, container hosts in datacenter or cloud and/or client endpoints.
From OS and commercial applications as well as malware communications
Have an agent? - Add the ability to get session keys simply and easily using the SKI Sensor C Library
No agent? - Add to your portfolio with Nubeva's off-the-shelf SKI Sensor Agents and Containers
Don't want to have an agent? - Resell Nubeva labeled sensors. Or, simply add the ability to receive and decrypt using session keys to your system and let your customers provide the keys from a growing list of systems with Nubeva SKI Sensor Technology or any other key source.
Nubeva complements session key discovery with a suite of decryption support options enabling IDS, NDR, and other passive vendors to add the ability to receive session keys and decrypt. We offer a multitude of implementation options to meet virtually any architectural model and go-to-market packaging scenario. Inspection systems need only minor modifications to receive keys and to decrypt using them. Decrypt using keys:
Enhance existing datapath or add net new
Any traffic and any session
Leverage crypto instruction set acceleration in standard CPUs
Achieve ultra high throughputs over 25Gb/s per core
Miniscule CPU and memory resource requirements
Already have Decryption? – Add the ability to receive keys and decrypt by modifying your existing engine or utilizing Nubeva’s SKI Decrypt TLS C library and reference code.
Don't have Decryption? Nubeva’s Decryptor Containers and Keyserver Container provide a fast and easy implementation to receive keys and decrypt traffic onboard
There are a myriad of implementation options spanning key acquisition, key transport, and handling, as well as decryption.