Sharing cryptographic session keys among a cluster of network security platforms monitoring network traffic flows
AssigneeMcAfee, Inc.
InventorsManikandan A. Kenyan, Anil Abraham
Life of this patent
Estimating the term…
Abstract
An example apparatus disclosed herein is to select a first network security platform based on a first value associated with a first message associated a client and a second value associated with a second message associated with a server, the first message and the second message associated with establishment of an encrypted network traffic flow between the client and the server. The disclosed example apparatus is also to cause a cryptographic session key associated with the encrypted network traffic flow to be sent to the first network security platform.
Claims15
A server comprising:
- interface circuitry;
- computer readable instructions;
- and
- at least one programmable circuit to be programmed by the computer readable instructions to:
- access a first message received from a client via a network and access a second message to be transmitted from the server to the client via the network, the first message and the second message associated with establishment of an encrypted network traffic flow between the client and the server;
- hash a first value associated with the first message and a second value associated with the second message to determine a hash value;
- process the hash value with a modulo operation to determine a third value, the modulo operation based on a number of network security platforms;
- identify a first network security platform of a plurality of the network security platforms based on the third value;
- and
- cause a cryptographic session key that is able to decrypt the encrypted network traffic flow to be sent via the network to the first network security platform.
At least one non-transitory computer readable medium comprising computer readable instructions to cause at least one programmable circuit to at least:
- access a first message from a client via a network and access a second message to be sent to the client via the network, the first message and the second message associated with establishment of an encrypted network traffic flow with the client;
- hash a first parameter value in the first message and a second parameter value in the second message to determine a hash value;
- process the hash value with a modulo operation based on a number of network security platforms included in a cluster of network security platforms to determine a platform selection value;
- identify a first one of the cluster of network security platforms based on the platform selection value;
- and
- cause transmission of a cryptographic session key that is able to decrypt the encrypted network traffic flow to the first one of the cluster of network security platforms via the network.
A method comprising:
- accessing first information received from a client via a network and accessing second information to be sent from a server to the client via the network, the first information and the second information associated with establishment of an encrypted network traffic flow between the client and the server;
- hashing, by at least one programmable circuit of the server that is programmed by at least one instruction, the first information and the second information to determine a hash value;
- processing, by one or more of the at least one programmable circuit, the hash value with a modulo operation to determine a selection value, the modulo operation based on a number of network security platforms;
- identifying, by one or more of the at least one programmable circuit, a first network security platform of a plurality of the network security platforms based on the selection value;
- and
- transmitting a cryptographic session key that is able to decrypt the encrypted network traffic flow from the server to the first network security platform.
Dependencies are inferred from the claim text.