Stateless session synchronization between secure communication interceptors
Embodiments provide a system and method for stateless session synchronization between inspectors for high availability deployments. Man in the Middle inspectors of a communication session between a client and server exchange a shared key that is used as a common seed value in a mapping function algorithm. Each inspector generates identical key-pairs using the common mapping function algorithm, and the inspectors generate the session keys from the key-pairs. Inspectors use the session keys to decrypt and either actively or passively inspect data transferred in a session between a client and server.
1. A computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for providing stateless synchronization, the method comprising:
receiving, by a first inspector device, a first set of key parameters while in a communication session;
generating, by the first inspector device, a first key-pair using the first set of key parameters and a shared key;
receiving, by the first inspector device, a second set of key parameters while in the communication session;
generating, by the first inspector device, a second key-pair using the second set of key parameters and the shared key;
exchanging the shared key between the first inspector device and a second inspector device;
receiving, by the second inspector device, the first set of key parameters;
generating, by the second inspector device, a third key-pair using the first set of key parameters and the shared key, wherein the first key-pair and the third key-pair are identical;
receiving, by the second inspector device, the second set of key parameters; and
generating, by the second inspector device, a fourth key-pair using the second set of key parameters and the shared key, wherein the second key-pair and the fourth key-pair are identical.
2. The method as recited in claim 1 , further comprising:
wherein the first inspector device generates a private key for the first key-pair using a first hash function of at least one received key parameter from the first set of key parameters and the shared key;
wherein the first inspector device generates a private key for the second key-pair using a second hash function of at least one received key parameter from the second set of key parameters and the shared key;
wherein the second inspector device generates a private key for the third key-pair using a third hash function of at least one received key parameter from the first set of key parameters and the shared key; and
wherein the second inspector device generates a private key for the fourth key-pair using a fourth hash function of at least one received key parameter from the second set of key parameters and the shared key.
3. The method as recited in claim 1 , further comprising:
wherein the first inspector device generates a public key for the first key-pair;
wherein the first inspector device generates a public key for the second key-pair;
wherein the second inspector device generates a public key for the third key-pair; and
wherein the second inspector device generates a public key for the fourth key-pair.
4. The method as recited in claim 1 , further comprising:
generating, by the first inspector device, a first pre-master-secret using at least one key from the first key-pair;
generating, by the first inspector device, a second pre-master-secret using at least one key from the second key-pair;
generating, by the second inspector device, a third pre-master-secret using at least one key from the third key-pair, wherein the first and third pre-master-secrets are identical; and
generating, by the second inspector device, a fourth pre-master-secret using at least one key from the fourth key-pair, wherein the second and fourth pre-master-secrets are identical.
5. The method as recited in claim 4 , further comprising:
generating, by the first inspector device, a first session key using the first pre-master-secret;
generating, by the first inspector device, a second session key using the second pre-master-secret;
generating, by the second inspector device, a third session key using the third pre-master-secret, wherein the first session key and the third session key are identical; and
generating, by the second inspector device, a fourth session key using the fourth pre-master-secret, wherein the second session key and the fourth session key are identical.
6. The method as recited in claim 1 , further comprising:
wherein the shared key is exchanged between the first inspector device and the second inspector device according to a predefined frequency.
7. The method as recited in claim 1 , further comprising:
wherein the communication session is a Transport Layer Security (TLS) session between a client and a server.
8. The method as recited in claim 1 , further comprising:
wherein the first, second, third, and fourth key-pairs are each valid only for the communication session.
9. A computer program product for providing stateless synchronization, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
receive, by a first inspector device, a first set of key parameters while in a communication session;
cause the first inspector device to generate a first key-pair using the first set of key parameters and a shared key;
receive, by the first inspector device, a second set of key parameters while in the communication session;
cause the first inspector device to generate a second key-pair using the second set of key parameters and the shared key;
exchange the shared key between the first inspector device and a second inspector device;
receive, by the second inspector device, the first set of key parameters;
cause the second inspector device to generate a third key-pair using the first set of key parameters and the shared key, wherein the first key-pair and the third key-pair are identical;
receive, by the second inspector device, the second set of key parameters; and
cause the second inspector device to generate a fourth key-pair using the second set of key parameters and the shared key, wherein the second key-pair and the fourth key-pair are identical.
10. The computer program product as recited in claim 9 , the processor further configured to:
cause the first inspector device to generate a private key for the first key-pair using a first hash function of at least one received key parameter from the first set of key parameters and the shared key;
cause the first inspector device to generate a private key for the second key-pair using a second hash function of at least one received key parameter from the second set of key parameters and the shared key;
cause the second inspector device to generate a private key for the third key-pair using a third hash function of at least one received key parameter from the first set of key parameters and the shared key; and
cause the second inspector device to generate a private key for the fourth key-pair using a fourth hash function of at least one received key parameter from the second set of key parameters and the shared key.
11. The method as recited in claim 9 , further comprising:
cause the first inspector device to generate a public key for the first key-pair;
cause the first inspector device to generate a public key for the second key-pair;
cause the second inspector device to generate a public key for the third key-pair; and
cause the second inspector device to generate a public key for the fourth key-pair.
12. The computer program product as recited in claim 9 , the processor further configured to:
cause the first inspector device to generate a first pre-master-secret using at least one key from the first key-pair;
cause the first inspector device to generate a second pre-master-secret using at least one key from the second key-pair;
cause the second inspector device to generate a third pre-master-secret using at least one key from the third key-pair, wherein the first and third pre-master-secrets are identical; and
cause the second inspector device to generate a fourth pre-master-secret using at least one key from the fourth key-pair, wherein the second and fourth pre-master-secrets are identical.
13. The computer program product as recited in claim 12 , the processor further configured to:
cause the first inspector device to generate a first session key using the first pre-master-secret;
cause the first inspector device to generate a second session key using the second pre-master-secret;
cause the second inspector device to generate a third session key using the third pre-master-secret, wherein the first session key and the third session key are identical; and
cause the second inspector device to generate a fourth session key using the fourth pre-master-secret, wherein the second session key and the fourth session key are identical.
14. The computer program product as recited in claim 9 , the processor further configured to:
wherein the shared key is exchanged between the first inspector device and the second inspector device according to a predefined frequency.
15. The computer program product as recited in claim 9 , the processor further configured to:
wherein the communication session is a Transport Layer Security (TLS) session between a client and a server.
16. A system for providing stateless synchronization, comprising:
a first inspector device including memory configured to:
receive a first set of key parameters while in a communication session,
generate a first key-pair using the first set of key parameters and a shared key,
receive a second set of key parameters while in the communication session,
generate a second key-pair using the second set of key parameters and the shared key, and
exchange the shared key with a second inspector device including memory; and
the second inspector device including memory configured to:
receive the first set of key parameters,
generate a third key-pair using the first set of key parameters and the shared key wherein the first key-pair and the third key-pair are identical,
receive the second set of key parameters, and
generate a fourth key-pair using the second set of key parameters and the shared key wherein the second key-pair and the fourth key-pair are identical.