Ingest proxy and query rewriter for secure data
A system for providing an ingest proxy and query rewriter for secure data is described. In an example implementation, the system may include a proxy configured to obfuscate data, generate maps of the obfuscated data to the original data, and send the obfuscated data to an analysis server. The analysis server may be configured to generate analysis data relevant to the obfuscated data and the original data by analyzing the obfuscated data. The analysis server may send the analysis data and an identification of the obfuscated data to a user device in response to a request from the user device. The user device may be configured to detect the identification of the obfuscated data in the signal received from the analysis server and retrieve the analysis data from a client device via the proxy.
1. A computer-implemented method comprising:
receiving, by an analysis server, obfuscated data from a remote proxy, the obfuscated data being an obfuscated version of original data, the remote proxy being located at a remote network location from the analysis server, the original data including events and the obfuscated data including timestamps associated with the events;
generating, by the analysis server, analysis data relevant to the obfuscated data and to the original data by analyzing the obfuscated data, analyzing the obfuscated data including searching for patterns in the obfuscated data using the timestamps;
receiving, by the analysis server, a request from a remote user device for the analysis server to send the original data and the analysis data to the remote user device;
retrieving, by the analysis server, the obfuscated data and the analysis data from a database based on the request; and
transmitting, by the analysis server, the analysis data and a signal to the remote user device identifying the obfuscated data, the signal directing the remote user device to retrieve the original data from the remote proxy and replace the identification of the obfuscated data in the analysis data with the original data.
2. The computer-implemented method of claim 1 , wherein the original data includes log files, the log files including records of events that occur on a remote client device, the remote client device being communicatively coupled with the remote proxy.
3. The computer-implemented method of claim 2 , wherein the analysis server is separated from the remote client device and the remote proxy by a firewall.
4. The computer-implemented method of claim 1 , wherein:
the obfuscated data includes a hash value of the original data;
the remote user device is configured to detect the hash value received from the analysis server and to automatically send the hash value to the remote proxy; and
the remote user device is connected to the remote proxy via a virtual private network when the remote user device is sending the signal to the remote proxy and receiving the original data from the remote proxy.
5. A system comprising:
a remote proxy configured to transmit obfuscated data to an analysis server, the remote proxy being located at a remote network location from the analysis server, the obfuscated data being an obfuscated version of original data, the original data including events and the obfuscated data including timestamps associated with the events;
the analysis server configured to
receive the obfuscated data from the remote proxy;
generate analysis data relevant to the obfuscated data and to the original data by analyzing the obfuscated data, analyzing the obfuscated data including searching for patterns in the obfuscated data using the timestamps;
retrieve the obfuscated data and the analysis data from a database based on a request received from a remote user device;
transmit the analysis data to the remote user device; and
transmit a signal to the remote user device identifying the obfuscated data in the analysis data; and
the remote user device configured to
transmit the request to the analysis server to send the original data and the analysis data to the remote user device; and
retrieve the original data from the remote proxy and replace an identification of the obfuscated data in the analysis data with the original data in response to receiving the signal.
6. The system of claim 5 , wherein the original data includes log files, the log files including records of events that occur on a remote client device, the remote client device being communicatively coupled with the remote proxy.
7. The system of claim 5 , wherein:
the obfuscated data includes a hash value of the original data; and
the remote user device is further configured to detect the hash value received from the analysis server and to automatically send the hash value to the remote proxy.
8. The system of claim 5 , wherein the remote user device is connected to the remote proxy via a virtual private network when the remote user device receives the original data from the remote proxy.
9. The system of claim 5 , wherein:
the remote proxy is further configured to
receive, from a client device, original data;
obfuscate the original data to generate the obfuscated data; and
generate a map of the obfuscated data to the original data.
10. The system of claim 9 , wherein:
the remote proxy is further configured to
determine the original data corresponding to the obfuscated data using the map and the request received from the remote user device; and
transmit the original data to the remote user device.
11. The system of claim 9 , wherein obfuscating the original data to generate the obfuscated data includes applying a secure hash algorithm to the original data.