Efficient Key Derivation for End-To-End Network Security with Traffic Visibility

A system comprising:

• a cryptographic engine to derive a cryptographic key for each of a plurality of clients using a derivation formula as follows:
• client_key=AES128(base_key, client_ID);
• and
• a MAC processing unit coupled to the cryptographic engine.

A method, comprising:

• providing network security between clients and a server using a domain controller to derive one or more cryptographic session keys for each client using a derivation formula as follows:
• client_key—MSB=AES128(base_key—1, client_ID), (1)
• client_key—LSB=AES128(base_key—2, client_ID+pad), and (2)
• client_key=client_key_MSB∥client_key_LSB, wherein (1) and (2) are executed in parallel;
• and
• enabling the domain controller to distribute the client session keys to a client, while delivering a derivation key to at least one of an information technology monitoring device and the server.

A machine-readable medium containing instructions which, when executed by a processing system, cause the processing system to perform instructions for:

• providing network security between clients and a server using a domain controller to derive one or more cryptographic session keys for each client using a derivation formula as follows:
• client_key—MSB=AES128(base_key—1, client_ID), (1)
• client_key—LSB=AES128(base_key—2, client_ID+pad), and (2)
• client_key=client_key_MSB∥client_key_LSB, wherein (1) and (2) are executed in parallel;
• and
• enabling the domain controller to distribute the client session keys to a client, while delivering a derivation key to at least one of an information technology monitoring device and the server.