Sharing cryptographic session keys among a cluster of network security platforms monitoring network traffic flows
AssigneeMcAfee, Inc.
InventorsManikandan A. Kenyan, Anil Abraham
Life of this patent
Estimating the term…
Abstract
A first example network security platform disclosed herein is to store a cryptographic session key from a server, the cryptographic session key associated with an encrypted network traffic flow between the server and a client different from the first network security platform. This disclosed first example network security platform is also to access a query from a second network security platform requesting the cryptographic session key, and generate a response including the cryptographic session key to send to the second network security platform.
Claims14
At least one non-transitory computer readable medium comprising computer readable instructions which, when executed, cause at least one processor of a first network security platform to at least:
- buffer a query from a second network security platform for a cryptographic session key until at least receipt of the cryptographic session key from a server, the cryptographic session key associated with an encrypted network traffic flow between the server and a client, the server and the client to be different from the first network security platform and the second network security platform, the first network security platform to be identifiable as a recipient of the cryptographic session key from the server based on a platform selection value, the platform selection value based on a first parameter value associated with a first message from the client and a second parameter value associated with a second message from the server;
- store the cryptographic session key from the server;
- and
- after the receipt of the cryptographic session key from the server, generate a response including the cryptographic session key to send to the second network security platform.
A first network security platform comprising:
- a key database to store a cryptographic session key from a server, the cryptographic session key associated with an encrypted network traffic flow between the server and a client, the server and the client to be different from the first network security platform;
- instructions in the first network security platform;
- and
- processor circuitry to execute the instructions to at least:
- buffer a query from a second network security platform requesting the cryptographic session key until at least receipt of the cryptographic session key from the server, the first network security platform to be identifiable as a recipient of the cryptographic session key from the server based on a platform selection value, the platform selection value based on a first parameter value associated with a first message from the client and a second parameter value associated with a second message from the server;
- and
- after the receipt of the cryptographic session key from the server, generate a response including the cryptographic session key to send to the second network security platform.
A method comprising:
- buffering, at a first network security platform, a query from a second network security platform for a cryptographic session key until at least receipt of the cryptographic session key from a server, the cryptographic session key associated with an encrypted network traffic flow between the server and a client different from the first network security platform, the first network security platform to be identifiable as a recipient of the cryptographic session key from the server based on a platform selection value, the platform selection value based on a first parameter value associated with a first message from the client and a second parameter value associated with a second message from the server;
- storing, by executing an instruction with at least one processor, the cryptographic session key from the server;
- and
- after receiving the cryptographic session key from the server, generating, by executing an instruction with at least one processor, a response including the cryptographic session key to send to the second network security platform.
Dependencies are inferred from the claim text.