Methods, systems, and computer readable media for monitoring encrypted packet flows within a virtual network environment
View Patent ↗Methods, systems, and computer readable media for packet monitoring in a virtual environment are disclosed. According to one method executed at a virtual tap element residing in between a first virtual machine and a second virtual machine in a virtual network environment, the method includes obtaining cryptographic key information from either the first virtual machine or the second virtual machine and detecting an encrypted packet flow being communicated in the virtual network environment between the first virtual machine and the second virtual machine via the virtual tap element. The method further includes decrypting the encrypted packet flow using the cryptographic key information, generating a decrypted packet flow set comprising at least a portion of the decrypted packet flow, and sending the decrypted packet flow set to a packet analyzer.
1. A method for monitoring encrypted packet flows within a virtual network environment, the method comprising:
at a virtual tap element residing in between a first virtual machine and a second virtual machine in a virtual network environment, wherein the virtual network environment comprises a single computing platform that includes each of the first virtual machine, the second virtual machine, and the virtual tap element, wherein communication between two or more of the first virtual machine, the second virtual machine, and the virtual tap element is conducted via a backplane bus of the single computing platform;
obtaining cryptographic key information from either the first virtual machine or the second virtual machine;
detecting an encrypted packet flow being communicated in the virtual network environment between the first virtual machine and the second virtual machine via the virtual tap element, wherein the virtual tap element includes a virtual key store that stores the cryptographic key information that is mapped to the encrypted packets flow communicated between the first virtual machine and the second virtual machine;
decrypting the encrypted packet flow using the cryptographic key information, wherein the virtual tap element is configured to operate via a dynamic SSL (DSSL) protocol and access the key store to obtain a new previously provisioned cryptographic key information based on a predefined periodic basis, such that the cryptographic key information used to decrypt the encrypted packet flow is dynamically changed in accordance to the predefined periodic basis;
generating a decrypted packet flow set comprising at least a portion of the decrypted packet flow; and
sending the decrypted packet flow set to a packet analyzer.
2. The method of claim 1 wherein generating a decrypted packet flow set comprising at least a portion of the decrypted packet flow includes filtering the decrypted packet flow set to generate a subset of the decrypted packet flow.
3. The method of claim 1 wherein each of the first virtual machine and the second virtual machine comprises a virtual workload, a virtual function, or a virtual container.
4. The method of claim 1 wherein the first virtual machine and the second virtual machine are respectively supported by a first hardware device and a second hardware device that communicate via the backplane bus of the single computing platform.
5. The method of claim 1 wherein the encrypted packet flow is communicated via a TLS session or an SSL session.
6. The method of claim 1 comprising obtaining new cryptographic key information from the virtual key store within the virtual tap element if the encrypted packet flow is communicated via the DSSL protocol.
7. The method of claim 1 wherein the virtual tap element is configured to establish a secure session with each of the first virtual machine and the second virtual machine to communicate the encrypted packet flow.
8. A system for monitoring encrypted packet flows within a virtual network environment, the system comprising:
at least one processor;
memory; and
a virtual tap element implemented using the at least one processor, wherein the virtual tap element is configured to obtain cryptographic key information from either a first virtual machine or a second virtual machine, to detect an encrypted packet flow being communicated in the virtual network environment between the first virtual machine and the second virtual machine via the virtual tap element, wherein the virtual tap element includes a virtual key store that stores the cryptographic key information that is mapped to the encrypted packets flow communicated between the first virtual machine and the second virtual machine, to decrypt the encrypted packet flow using the cryptographic key information, wherein the virtual tap element is configured to operate via a dynamic SSL (DSSL) protocol and access the key store to obtain a new previously provisioned cryptographic key information based on a predefined periodic basis, such that the cryptographic key information used to decrypt the encrypted packet flow is dynamically changed in accordance to the predefined periodic basis, to generate a decrypted packet flow set comprising at least a portion of the decrypted packet flow, and to send the decrypted packet flow set to a packet analyzer, wherein the virtual network environment comprises a single computing platform that includes each of the first virtual machine, the second virtual machine, and the virtual tap element, wherein communication between two or more of the first virtual machine, the second virtual machine, and the virtual tap element is conducted via a backplane bus of the single computing platform.
9. The system of claim 8 wherein the virtual tap element is further configured to filter the decrypted packet flow set to generate a subset of the decrypted packet flow.
10. The system of claim 8 wherein each of the first virtual machine and the second virtual machine comprises a virtual workload, a virtual function, or a virtual container.
11. The system of claim 8 wherein the first virtual machine and the second virtual machine are respectively supported by a first hardware device and a second hardware device that communicate via the backplane bus of the single computing platform.
12. The system of claim 8 wherein the encrypted packet flow is communicated via a TLS session or an SSL session.
13. The system of claim 8 wherein the virtual tap element is further configured to obtain new cryptographic key information from the virtual key store within the virtual tap element if the encrypted packet flow is communicated via the DSSL protocol.
14. The system of claim 8 wherein the virtual tap element is configured to establish a secure session with each of the first virtual machine and the second virtual machine to communicate the encrypted packet flow.
15. A non-transitory computer readable medium having stored thereon executable instructions embodied in the computer readable medium that when executed by at least one processor of a computer cause the computer to perform steps comprising:
obtaining, by a virtual tap element, cryptographic key information from either a first virtual machine or a second virtual machine in a virtual network environment, wherein the virtual network environment comprises a single computing platform that includes each of the first virtual machine, the second virtual machine, and the virtual tap element, wherein communication between two or more of the first virtual machine, the second virtual machine, and the virtual tap element is conducted via a backplane bus of the single computing platform;
detecting an encrypted packet flow being communicated in the virtual network environment between the first virtual machine and the second virtual machine via the virtual tap element, wherein the virtual tap element includes a virtual key store that stores the cryptographic key information that is mapped to the encrypted packets flow communicated between the first virtual machine and the second virtual machine;
decrypting the encrypted packet flow using the cryptographic key information, wherein the virtual tap element is configured to operate via a dynamic SSL (DSSL) protocol and access the key store to obtain a new previously provisioned cryptographic key information based on a predefined periodic basis, such that the cryptographic key information used to decrypt the encrypted packet flow is dynamically changed in accordance to the predefined periodic basis;
generating a decrypted packet flow set comprising at least a portion of the decrypted packet flow; and
sending the decrypted packet flow set to a packet analyzer.
16. The non-transitory computer readable medium of claim 15 wherein generating a decrypted packet flow set comprising at least a portion of the decrypted packet flow includes filtering the decrypted packet flow set to generate a subset of the decrypted packet flow.
17. The non-transitory computer readable medium of claim 15 wherein each of the first virtual machine and the second virtual machine comprises a virtual workload, a virtual function, or a virtual container.
18. The non-transitory computer readable medium of claim 15 wherein the first virtual machine and the second virtual machine are respectively supported by a first hardware device and a second hardware device that communicate via a backplane bus of the single computing platform.
19. The non-transitory computer readable medium of claim 15 wherein the encrypted packet flow is communicated via a TLS session or an SSL session.
20. The non-transitory computer readable medium of claim 15 comprising obtaining new cryptographic key information from the virtual key store within the virtual tap element if the encrypted packet flow is communicated via the DSSL protocol.