Secure digital traffic analysis
A network monitoring “sensor” is built on initial startup by checking the integrity of the bootstrap system and, if it passes, downloading information from which it builds the full system including an encrypted and an unencrypted portion. Later, the sensor sends hashes of files, configurations, and other local information to a data center, which compares the hashes to hashes of known-good versions. If they match, the data center returns information (e.g., a key) that the sensor can use to access the encrypted storage. If they don't, the data center returns information to help remediate the problem, a command to restore some or all of the sensor's programming and data, or a command to wipe the encrypted storage. The encrypted storage stores algorithms and other data for processing information captured from a network, plus the captured/processed data itself.
1. A data center for use in a secure network monitor system, the data center comprising a processor, a network interface, and a memory encoded with verification data and programming instructions executable by the processor to:
accept request data from a remote computer via the network interface, where the request data contains characterization information that characterizes data stored at the remote computer;
as a function of a comparison of the characterization information with the verification data, choose between
sending a response to the remote computer that contains cryptographic key material and
sending response data to the remote computer, where the response data contains a restore instruction.
2. The data center of claim 1 , wherein:
the characterization information comprises hashes of a set of data elements stored at the remote computer; and
the verification data comprises hashes of known-good versions of the set of data elements.
3. The data center of claim 1 , wherein the response that contains the restore instruction further comprises data usable by the remote computer to put itself into a secure state.
4. The data center of claim 1 , wherein the cryptographic key material enables access to an encrypted memory associated with the remote computer.
5. The data center of claim 1 , wherein:
the verification data comprises information corresponding to each of a plurality of remote computers;
the request includes identity information for the particular remote computer in the plurality of remote computers that sent the request; and
the comparison operates on the verification data that corresponds to the particular remote computer.