Catch the threats hiding in encrypted traffic, without going inline
Inline decryption
Terminate, decrypt, re-encrypt
- Dedicated hardware. Proprietary appliances to size, license, and maintain.
- Uptime or inspection, pick one. Bypass modules keep traffic flowing when the appliance fails, but everything crossing during bypass goes uninspected.
- Costlier under PQC. Heavier handshakes mean scaling up hardware to keep pace.
Aviz decryption
Tap, receive the key, decrypt aside
- Commodity x86. A software appliance, with optional DPU acceleration.
- Out of the path. No bypass logic to engineer. Traffic never depended on the ASN in the first place.
- PQC-neutral. Endpoints do the key exchange, so handshake cost never hits the pipeline.
Traffic and keys travel separately, meet at the ASN
How It Works. The encrypted stream and the session key take different paths and rendezvous at the ASN for line-rate, out-of-band decryption.
Aggregate
Physical taps feed encrypted traffic to the Aviz Packet Broker, which aggregates and forwards it to the ASN untouched.
Export keys
A lightweight agent on the app server sends ephemeral session keys to the ASN over an encrypted channel. Private keys never leave the server.
Decrypt & fan out
The ASN matches each session to its key, decrypts in memory at line rate, and forwards cleartext to your tools.
Aviz SSL Decryption Reference Architecture
Encrypted traffic flows through the packet broker to the ASN; keys arrive separately over a private channel. Cleartext leaves the ASN only toward the tools that should see it.
Static key exchange
Client encrypts a pre-master secret with the server's public key. One long-term private key decrypts every session. Export it once, and the ASN can derive session keys locally. Removed in TLS 1.3.
Perfect Forward Secrecy
Client and server exchange ephemeral public key shares and each derive the same session secret. The secret itself never crosses the wire. The ASN can't derive it from captured traffic, so the key-export agent hands it over from the endpoint that computed it.
Post-Quantum Cryptography
Hybrid quantum-resistant handshakes add compute cost on both endpoints, but the ASN still receives the negotiated session key the same way. The added cost stays with the endpoints, so the decryption pipeline doesn't change.
Single pane of glass for the whole fleet.
- Onboard nodes and push decryption policy centrally
- Enroll key-export agents and set tool-routing rules
- Monitor throughput, decryption success, and node health
- Manages both APB and ASN as one system
Open-source SONiC on any ONIE switch: NVIDIA, Edgecore, Cisco Silicon One, Broadcom, 1GbE to 800GbE.
- Aggregates and filters encrypted tap traffic
- Forwards to the ASN untouched
- No keys, no decryption, no state
- Replaces proprietary broker hardware
Installs on standard x86 servers, with optional DPU acceleration for line rate.
- Decrypts using exported ephemeral keys
- In-memory only, with no decrypted payload on disk
- Discards keys after analysis
- Routes cleartext to security and monitoring tools
Encrypted in
Inspection stops at the envelope
- Signature engines can't match on payload they can't see.
- Behavioral tools reason about flow metadata only: sizes, timing, hostnames from SNI.
- PCAP recorders still capture, but investigators open encrypted ciphertext.
- Alerts get fuzzier the more traffic is encrypted.
Decrypted in
Inspection sees the real payload
- IDS/IPS see the actual HTTP request, SQL query, or executable in transit.
- NDR and behavioral analytics correlate on real content, not just flow shape.
- NPM/APM tools see the response body and timing that matter to users.
- The ASN forwards decrypted copies to security tools. The original encrypted stream is still available for long-term capture.
NDR
Network Detection & Response: behavioral analytics on decrypted flows.
IDS
Signature-based intrusion detection on the real payload.
NPM / APM
Performance monitoring with visibility into actual application traffic.
PCAP Recorder
Long-term encrypted capture with keys deliberately withheld.