Secure digital traffic analysis
A network monitoring “sensor” is built on initial startup by checking the integrity of the bootstrap system and, if it passes, downloading information from which it builds the full system including an encrypted and an unencrypted portion. Later, the sensor sends hashes of files, configurations, and other local information to a data center, which compares the hashes to hashes of known-good versions. If they match, the data center returns information (e.g., a key) that the sensor can use to access the encrypted storage. If they don't, the data center returns information to help remediate the problem, a command to restore some or all of the sensor's programming and data, or a command to wipe the encrypted storage. The encrypted storage stores algorithms and other data for processing information captured from a network, plus the captured/processed data itself.
1. A network sensor comprising:
a network tap configured to receive a set of data traveling on a network;
an encrypted storage configured to store a set of threat analysis instructions;
a processor and memory configured to analyze the set of data and identify threats using the set of threat analysis instructions; and
a sandbox configured to store the set of data during analysis;
wherein the processor is configured to, during a boot process:
place the encrypted storage into an unmounted state;
receive a set of verification data from a remote server;
determine whether the encrypted storage is valid as a function of the set of verification data; and
if the encrypted storage is valid, mount the encrypted storage and complete the boot process.
2. The network sensor of claim 1 , wherein the processor is further configured to, if the encrypted storage is not valid, execute error-handling code.
3. The network sensor of claim 2 , wherein the error-handling code is configured to cause the processor to wipe the contents of the encrypted storage.
4. The network sensor of claim 2 , wherein the error-handling code is configured to cause the processor to restore the contents of the encrypted storage to a previous state.
5. The network sensor of claim 1 , wherein the verification data comprises a decryption key.
6. The network sensor of claim 1 , wherein the verification data comprises a first portion of a split key.
7. The network sensor of claim 6 , wherein a second portion of the split key is stored locally on the network sensor.
8. The network sensor of claim 7 , wherein the processor is configured to determine the validity of the encrypted storage as a function of both the first portion and the second portion of the split key.
9. A method for monitoring network traffic using a network sensor that comprises a network tap configured to receive a set of data traveling on a network, encrypted storage configured to store a set of threat analysis instructions, a processor and memory configured to analyze the set of data and identify threats using the set of threat analysis instructions, and a sandbox configured to store the set of data during analysis, the method comprising the steps: placing the encrypted storage into an unmounted state during a boot process; receiving a set of verification data from a remote server; as a function of the set of verification data, determining whether the encrypted storage is valid; and if the encrypted storage is valid, mounting the encrypted storage and completing the boot process.
10. The method of claim 9 , further comprising the step of, where the encrypted storage is not valid, executing error-handling code.
11. The network sensor of claim 10 , wherein the error-handling code is configured to cause the processor to wipe the contents of the encrypted storage.
12. The network sensor of claim 10 , wherein the error-handling code is configured to cause the processor to restore the contents of the encrypted storage to a previous state.
13. The method of claim 10 , wherein the verification data comprises a first portion of a split key.
14. The method of claim 13 , wherein a second portion of the split key is stored locally on the network sensor.
15. The method of claim 14 , wherein the processor is configured to determine the validity of the encrypted storage as a function of both the first portion and the second portion of the split key.