Client-side encryption and processing of telemetry data
Techniques are provided for client-side encryption and/or processing of telemetry data. An illustrative method comprises providing, by a telemetry server, a query request to a telemetry client, wherein the provided query request comprises a query and an encrypted payload over which the query operates; obtaining a query result from the telemetry client, wherein the telemetry client (a) decrypts the encrypted payload using at least one decryption key, (b) processes the query request using the decrypted payload, and (c) provides the query result to the telemetry server; and aggregating the query results obtained from one or more of the telemetry clients. The telemetry client can (i) validate the decrypted payload using a signature within the decrypted payload, and/or (ii) evaluate a query type of the query to determine whether the telemetry client opted in to the query type being executed.
1. A method, comprising:
providing, by a telemetry server, a query request to one or more telemetry clients that collect telemetry data, wherein the provided query request comprises a query and one or more encrypted payloads of the query over which the query operates;
obtaining a query result from one or more of the telemetry clients, wherein at least one of the telemetry clients processes the query request by performing the following steps: (a) decrypting the one or more encrypted payloads using at least one decryption key, (b) applying the query to the one or more decrypted payloads to generate the query result, and (c) providing the query result to the telemetry server; and
aggregating the query results obtained from the one or more telemetry clients;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the aggregated query results are stored in a query store that is encrypted by the telemetry server.
3. The method of claim 1 , further comprising providing the aggregated query results to one or more vendors.
4. The method of claim 1 , wherein the at least one decryption key is obtained using a key identifier stored with the one or more encrypted payloads.
5. The method of claim 1 , wherein the at least one telemetry client one or more of (i) validates the one or more decrypted payloads using one or more signatures within the one or more decrypted payloads, and (ii) evaluates a query type of the query to determine whether the at least one telemetry client opted in to the query type being executed.
6. The method of claim 1 , wherein the at least one telemetry client anonymizes the query results to remove predefined sensitive information.
7. The method of claim 1 , wherein the telemetry server anonymizes the query results to remove predefined source-specific information.
8. The method of claim 1 , wherein the query is processed using client-side resources or server-side resources based on a data type of at least a portion of the one or more encrypted payloads.
9. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
providing, by a telemetry server, a query request to one or more telemetry clients that collect telemetry data, wherein the provided query request comprises a query and one or more encrypted payloads of the query over which the query operates;
obtaining a query result from one or more of the telemetry clients, wherein at least one of the telemetry clients processes the query request by performing the following steps: (a) decrypting the one or more encrypted payloads using at least one decryption key, (b) applying the query to the one or more decrypted payloads to generate the query result, and (c) providing the query result to the telemetry server; and
aggregating the query results obtained from the one or more telemetry clients.
10. The non-transitory processor-readable storage medium of claim 9 , wherein the aggregated query results are stored in a query store that is encrypted by the telemetry server.
11. The non-transitory processor-readable storage medium of claim 9 , further comprising providing the aggregated query results to one or more vendors.
12. The non-transitory processor-readable storage medium of claim 9 , wherein the at least one decryption key is obtained using a key identifier stored with the one or more encrypted payloads.
13. The non-transitory processor-readable storage medium of claim 9 , wherein the at least one telemetry client one or more of (i) validates the one or more decrypted payloads using one or more signatures within the one or more decrypted payloads, and (ii) evaluates a query type of the query to determine whether the at least one telemetry client opted in to the query type being executed.
14. The non-transitory processor-readable storage medium of claim 9 , wherein one or more of (i) the at least one telemetry client anonymizes the query results to remove predefined sensitive information, and (ii) the telemetry server anonymizes the query results to remove predefined source-specific information.
15. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
providing, by a telemetry server, a query request to one or more telemetry clients that collect telemetry data, wherein the provided query request comprises a query and one or more encrypted payloads of the query over which the query operates;
obtaining a query result from one or more of the telemetry clients, wherein at least one of the telemetry clients processes the query request by performing the following steps: (a) decrypting the one or more encrypted payloads using at least one decryption key, (b) applying the query to the one or more decrypted payloads to generate the query result, and (c) providing the query result to the telemetry server; and
aggregating the query results obtained from the one or more telemetry clients.
16. The apparatus of claim 15 , wherein the aggregated query results are stored in a query store that is encrypted by the telemetry server.
17. The apparatus of claim 15 , further comprising providing the aggregated query results to one or more vendors.
18. The apparatus of claim 15 , wherein the at least one decryption key is obtained using a key identifier stored with the one or more encrypted payloads.
19. The apparatus of claim 15 , wherein the at least one telemetry client one or more of (i) validates the one or more decrypted payloads using one or more signatures within the one or more decrypted payloads, and (ii) evaluates a query type of the query to determine whether the at least one telemetry client opted in to the query type being executed.
20. The apparatus of claim 15 , wherein one or more of (i) the at least one telemetry client anonymizes the query results to remove predefined sensitive information, and (ii) the telemetry server anonymizes the query results to remove predefined source-specific information.