Nubeva TLS Decrypt

Industry Challenge

With the introduction of the new encryption standard, TLS 1.3, Elliptic-curve Diffie–Hellman (ECDH), Perfect Forward Secrecy (PFS) and pinned certificates; combined with modern, distributed nature our cloud application architectures, traditional decryption methods are failing. With the introduction of ephemeral keys, out-of-band monitoring no longer works. Decryption with man-in-the-middle intercepts is not practical to place everywhere. In today’s TLS 1.3 world, organizations are being forced to choose between embracing aggressive encryption for increased security or reduce encryption practices to enable monitoring, which is increasingly difficult with third party services. Until now...

Nubeva’s TLS Decrypt introduced a new way to decrypt new modern encryption protocols called Symmetric Key Intercept. Our architecture runs in parallel as an overlay solution to your network monitoring practices. Here is how Nubeva TLS Decrypt works:

Discover and extracts the final symmetric keys from certificate after the handshake to rederive the symmetric key.
Final, Private keys are securely stored in your, customer-owned database to await the call for decryption
Decryption occurs on tools of choice for full time monitoring, on-demand monitoring or point decryption on key servers pending.

Nubeva Sensor - Key Discovery

Simply deploy our TLS discovery probe on critical workloads in your public or private cloud including containers and kubernetes
Agent discover the symmetric TLS keys out of memory using AI-based signatures without application modification, without man in the middle.
Agent works with any cipher because it works after the handshake.
Solution works for any session type - front side - backside - client-side - server-side, to and within containers etc.
Discovers the specific session keys, encrypts them and send to symmetric key database.

Learn More

Secure Key Depot

Launch your owned key database simply using provided Cloud Formation Template
Apply your assigned identity and access management rules and required security measures.
Discovered TLS symmetric keys are delivered to the key database over encrypted links and are stores in fully encrypted form
The encrypted key database retains the keys to await API call for decryption

Learn More

Decryption Agent

To complete the solution, deploy the Nubeva universal decryption containerized agent on any tool.
Decryptor receives traffic from any packet source whether Azure VTAPs, Amazon VPC Traffic Mirrors our pulls from storage.
Matches the packet-level traffic with corresponding keys called from the secure database
Outputs the encrypted packet capture and the decrypted traffic on tools of choice

Get a Demo