Monitoring encrypted network traffic flows in a virtual environment using dynamic session key acquisition techniques

1. A method comprising:

by a dynamic session key acquisition (DSKA) engine residing in a virtual environment:

receiving session decryption information extraction instructions that configure the DSKA engine to obtain session decryption information for at least one communication session involving a virtual machine;

obtaining the session decryption information from the virtual machine in accordance with the session decryption information extraction instructions, wherein the session decryption information includes cryptographic keys utilized by an application server instance in the virtual machine to establish the at least one communication session, wherein the session decryption information is obtained by the DSKA engine from communications between a monitored application server instance and a secure sockets layer (SSL) server instance that are hosted by the virtual machine;

storing the session decryption information obtained from the virtual machine;

and

providing the session decryption information to a network traffic monitoring (NTM) agent, wherein the NTM agent utilizes the session decryption information to decrypt copies of encrypted network traffic flows belonging to the at least one communication session involving the virtual machine.

2. The method of claim 1 wherein the session decryption information extraction instructions are received by the DSKA engine from a virtual tap instance or the NTM agent.

3. The method of claim 1 wherein obtaining the session decryption information from the virtual machine includes acquiring the session decryption information via a direct access to a secure sockets layer (SSL) server instance hosted by the virtual machine.

4. The method of claim 1 wherein obtaining the session decryption information from the virtual machine includes detecting and storing the session decryption information contained in network traffic flows communicated between an application server instance and a secure sockets layer (SSL) server instance hosted by the virtual machine.

5. The method of claim 1 wherein the NTM agent is a virtual instance hosted by a second virtual machine in the virtual environment.

6. The method of claim 1 wherein the NTM agent is configured to use the session decryption information to decrypt copies of encrypted network traffic flow records to produce decrypted network traffic flow records.

7. The method of claim 1 wherein the DSKA engine is configured to forward the session decryption information to the NTM agent via at least one virtual tap instance and a virtual network interface card.

8. A system comprising:

at least one virtual tap instance residing in a virtual environment configured to capture encrypted network traffic flows belonging to at least one communication session involving an application server instance hosted by a virtual machine, wherein the at least one virtual tap instance is a virtual instance of a software-based monitoring agent application that executed by a hardware processor of a computing platform supporting the virtual environment; and

a dynamic session key acquisition (DSKA) engine residing in the virtual environment configured to receive session decryption information extraction instructions that configure the DSKA engine to obtain session decryption information for at least one communication session involving a virtual machine, to obtain the session decryption information from the virtual machine in accordance with the session decryption information extraction instructions, wherein the session decryption information includes cryptographic keys utilized by the application server instance to establish the at least one communication session, wherein the session decryption information is obtained by the DSKA engine from communications between a monitored application server instance and a secure sockets layer (SSL) server instance that are hosted by the virtual machine, to store the session decryption information obtained from the virtual machine, and to provide the session decryption information to a network traffic monitoring (NTM) agent, wherein the NTM agent utilizes the session decryption information to decrypt copies of encrypted network traffic flows belonging to the at least one communication session involving the virtual machine.

9. The system of claim 8 wherein the session decryption information extraction instructions are received by the DSKA engine from either a virtual tap instance or the NTM agent.

10. The system of claim 8 wherein the DSKA engine is configured to acquire the session decryption information via a direct access to a secure sockets layer (SSL) server instance hosted by the virtual machine.

11. The system of claim 8 wherein the DSKA engine is configured to detect and store the session decryption information contained in network traffic flows communicated between an application server instance and a secure sockets layer (SSL) server instance hosted by the virtual machine.

12. The system of claim 8 wherein the NTM agent is a virtual instance hosted by a second virtual machine in the virtual environment.

13. The system of claim 8 wherein the NTM agent is configured to use the session decryption information to decrypt copies of encrypted network traffic flow records to produce decrypted network traffic flow records.

14. The system of claim 8 wherein the DSKA engine is configured to forward the session decryption information to the NTM agent via at least one virtual tap instance and a virtual network interface card.

15. A non-transitory computer readable medium having stored thereon executable instructions embodied in the computer readable medium that when executed by at least one processor of a computer cause the computer to perform steps comprising:

by a dynamic session key acquisition (DSKA) engine residing in a virtual environment:

receiving session decryption information extraction instructions that configure the DSKA engine to obtain session decryption information for at least one communication session involving a virtual machine;

obtaining the session decryption information from the virtual machine in accordance with the session decryption information extraction instructions, wherein the session decryption information includes cryptographic keys utilized by an application server instance in the virtual machine to establish the at least one communication session, wherein the session decryption information is obtained by the DSKA engine from communications between a monitored application server instance and a secure sockets layer (SSL) server instance that are hosted by the virtual machine;

storing the session decryption information obtained from the virtual machine;

and

providing the session decryption information to a network traffic monitoring (NTM) agent, wherein the NTM agent utilizes the session decryption information to decrypt copies of encrypted network traffic flows belonging to the at least one communication session involving the virtual machine.

16. The non-transitory computer readable medium of claim 15 wherein the session decryption information extraction instructions are received by the DSKA engine from either a virtual tap instance or the NTM agent.

17. The non-transitory computer readable medium of claim 15 wherein obtaining the session decryption information from the virtual machine includes acquiring the session decryption information via a direct access to a secure sockets layer (SSL) server instance hosted by the virtual machine.

18. The non-transitory computer readable medium of claim 15 wherein obtaining the session decryption information from the virtual machine includes detecting and storing the session decryption information contained in network traffic flows communicated between an application server instance and a secure sockets layer (SSL) server instance hosted by the virtual machine.

19. The non-transitory computer readable medium of claim 15 wherein the NTM agent is configured to use the session decryption information to decrypt copies of encrypted network traffic flow records to produce decrypted network traffic flow records.

20. The non-transitory computer readable medium of claim 15 wherein the DSKA engine is configured to forward the session decryption information to the NTM agent via at least one virtual tap instance and a virtual network interface card.