Efficient key derivation for end-to-end network security with traffic visibility

摘要

Both end-to-end security and traffic visibility may be achieved by a system using a controller that derives a cryptographic key that is different for each client based on a derivation key and a client identifier that is conveyed in each data packet. The controller distributes the derivation key to information technology monitoring devices and a server to provide traffic visibility. For large key sizes, the key may be derived using a derivation formula as follows: c �¢ l �¢ i �¢ e �¢ n �¢ t _ k �¢ e �¢ y _ M �¢ S �¢ B = A �¢ E �¢ S �¢ 128 b �¢ a �¢ s �¢ e _ k �¢ e �¢ y _ 1 , c �¢ l �¢ i �¢ e �¢ n �¢ t _ ID , c �¢ l �¢ i �¢ e �¢ n �¢ t _ k �¢ e �¢ y _ L �¢ S �¢ B = A �¢ E �¢ S �¢ 128 �¢ b �¢ a �¢ s �¢ e _ k �¢ e �¢ y _ 2 , c �¢ l �¢ i �¢ e �¢ n �¢ t _ I �¢ D + p �¢ ad , a �¢ n �¢ d client_key = client_key_MSB ˆ¥ client_key_LSB, where (1) and (2) are executed in parallel. The client key and a client identifier may be used so that end-to-end security may be achieved.