PROBLEM: Visibility infrastructure provided by network packet brokers (NPB) and dedicated decryption platforms is vital for security and computing operations. The core functionality of these systems, whether installed inline or receiving traffic out-of-band via passive tap, is the ability to process and distribute decrypted network traffic to monitoring systems. As most network traffic is encrypted with TLS 1.3 and TLS 1.2 with PFS, decryption systems are experiencing growing product limitations, regardless of the technique employed. Some limitations include :
BUSINESS IMPLICATIONS: Whether currently offering legacy decryption or not, the reality for product manufacturers is that TLS is limiting decryption capabilities across the industry. End-users are searching for ways to close growing product gaps or redirect resources to solve the problem elsewhere. NBP’s and other decryption platforms can answer the call with an evolved universal solution and, as a result, capture a significant market opportunity and reduce sales friction.
The Nubeva SKI solution is breakthrough TLS decryption technology. SKI provides a simple, modular suite of software components that can easily be integrated into any system or service, delivering high-speed, low-cost decryption of any TLS encrypted traffic source: taps, mirrors, SPANs, or PCAP files. The solution works in any environment - physical or virtual, on-prem or cloud. Use SKI to reenable lost decryption capabilities on your systems or as net new decryption capability, and ultimately, increase value and addressable markets, accelerate sales, and decrease support and project interdependencies.
(re)Enable Out-of-Band Decryption
Nubeva’s advanced technology provides state-of-the-art advanced capabilities to both passive and inline applications:
TLS 1.3, 1.2 with PFS along with legacy TLS, traffic authenticated with pinned certificates, as well as MTLS/client cert authentication.
Traffic to the internet and 3rd party servers and services, including cloud platforms, something never before possible.
Decrypt all pinned traffic, including traffic from MS365, G-Suite, Dropbox, Mobile, and MTLS/client-cert authenticated sessions.
Achieve throughput > 80% of wire speed. SKI enables simple, secure, symmetric bulk decryption with very low resources for breakthrough price performance.
Reduce operational headache with no server keypairs to load, maintain, or secure. SKI is a lower-risk architecture with an independent and secure, fast ephemeral key management plane.
Deliver More Value to Your Customers
With expanded decryption capabilities, provide a complete DPI solution to customers.
Increased market opportunity allows sales teams to sell more products, close bigger deals, and create lasting customer success.
Empower your sales engineers and product teams by reducing product gaps and increasing evaluation success while lowering post-sales complexities.
Integrating Nubeva SKI into your products is fast and easy, allowing you to get to market quickly with low barriers to entry. The core concept of SKI is to capture session keys from TLS servers and clients and forward them to authorized decryption engines for use. With session keys available, simple, high speed, and low-cost bulk decryption is available for any traffic. Simply match traffic with discovered keys based on sessions’ client-random values and decrypt.
The following diagrams represent two scenarios depending on the operation mode.
Nubeva restores the passive decryption option. Nubeva learns and extracts session keys and delivers them to systems to decrypt. Because Nubeva SKI operates without any PKI requirement, a passive inspection of traffic going to third-party servers and cloud platform services is possible for the first time.
Nubeva solution enables systems operating in inline mode. When keys are available from Nubeva’s system, the decryption system can work with greater simplicity, higher throughput, and lower latency than legacy decryption. If keys are not available because sensors are not deployed, the system simply falls back to “business as usual” with the existing MITM or reverse proxy engine.
Our comprehensive suite of software components, available in source or binary forms, enables fast and flexible SKI decryption implementation into most product sets. While there are many implementation models, here are the basics.
Nubeva has perfected the learning and exporting keys from application and TLS process memory as they are created during the TLS handshake. Simply deploy our session key learning software on any VM, node, or endpoint.
Key learning software is delivered as a C library or turnkey agents and containers in binary or source code form. Key extraction is 100% reliable. This read-only micro-process is ultra-secure, transparent, and non-disruptive to application code, does not impact applications, and operates with minute memory and CPU requirements.
Universal for inline and passive, SKI decrypts:
Any TLS 1.3, 1.2, and legacy.
Any session N-S-E-W including pinned and client certificate sessions.
Traffic to internet, cloud, and other 3rd party servers and services
For metal, VM's, container hosts in datacenter or cloud and/or client endpoints.
From OS and commercial applications as well as malware communications
Get Started:Have an agent? - Add the ability to get session keys simply and easily using SKI Sensor C Library.
No agent today? - Add agents to your portfolio with Nubeva's off-the-shelf SKI Sensor Agents and Containers.
Don't want to have an agent? - Resell Nubeva labeled sensors. Or, simply add the ability to receive and decrypt using session keys to your system and let your customers provide the keys from a growing list of systems with Nubeva SKI Sensor Technology or any other key source.
Nubeva complements session key discovery with a suite of decryption support options enabling NPB and other decryption vendors to add the ability to receive session keys and decrypt. We offer a multitude of implementation options to meet virtually any architectural model and go-to-market packaging scenario. Inspection systems need only minor modifications to receive keys and to decrypt using them.
Enhance existing datapath or add net new
Any traffic and any session
Leverage crypto instruction set acceleration in standard CPUs
Achieve ultra high throughputs over 25Gb/s per core
Efficient use of CPU and Memory resource
Already have Decryption? – Add the ability to receive keys and decrypt by modifying your existing engine or utilizing Nubeva’s SKI Decrypt TLS C library and reference code.
Don't have Decryption? Nubeva’s Decryptor Containers and Keyserver Container provide a fast and easy implementation to receive keys and decrypt traffic.
There are a myriad of implementation options spanning key acquisition, key transport, and handling, as well as decryption.