Management, diagnostics, and security for network communications
A system and method securely and selectively provide visibility along a communication path in end-to-end communications, while ensuring security of the transmission, and while further ensuring that unauthorized persons cannot view network packets. A separate parallel channel is used to provide visibility into data in transit to authorized parties, without revealing such data to unauthorized parties. In at least one embodiment, the separate parallel channel is implemented using a secure group messaging platform. In addition, all needed equipment is integrated in the end-to-end connection across layers and protocols into the secure messaging group. Secure, scalable messaging groups can be based on a ratchet tree protocol so as to guarantee forward as well as post-compromise security.
1. A computer-implemented method for securely providing visibility along an electronic communication path between two endpoints, comprising:
establishing a secure separate channel in parallel to the electronic communication path;
collecting information about at least one communication taking place between the two endpoints;
encrypting the collected information;
making the collected information available via the secure separate channel;
obtaining a first portion of an authentication key;
storing the first portion of the authentication key in a first secure storage device; and
authenticating at least one party in order to provide the at least one party with access to the secure separate channel;
wherein authenticating the at least one party comprises:
retrieving the stored first portion of the authentication key;
obtaining a second portion of the authentication key associated with a session;
obtaining a key package from a second secure storage device;
generating a hash result from a subset of data obtained from the communication taking place between the two endpoints;
combining the first portion of the authentication key with the obtained key package and the generated hash result, to reconstruct the authentication key; and
using the reconstructed authentication key to authenticate the at least one party and to decrypt the encrypted collected information.
2. The method of claim 1 , wherein establishing a secure separate channel comprises establishing a group via a secure group messaging platform.
3. The method of claim 2 , wherein the group comprises a WhatsApp group.
4. The method of claim 1 , wherein retrieving the stored first portion of the authentication key, obtaining the second portion of the authentication key, obtaining the key package, and combining the first portion of the authentication key with the obtained key package and the generated hash result to reconstruct the authentication key are performed by a secret agent component.
5. The method of claim 1 , wherein authenticating the at least one party using the authentication key comprises authenticating the at least one party using at least one selected from the group consisting of:
an X-509 certificate; and
thumb printing based on characteristics of at least one device used by the at least one party.
6. The method of claim 1 , wherein providing the at least one party with access to the secure separate channel comprises:
receiving a request for information from the at least one party;
encrypting the requested information;
transmitting the encrypted information; and
decrypting the encrypted information.
7. The method of claim 6 , wherein encrypting and decrypting the information are performed using a ratchet tree protocol.
8. The method of claim 1 , wherein the first secure storage device comprises a hardware security module.
9. A non-transitory computer-readable medium for securely providing visibility along an electronic communication path between two endpoints, comprising instructions stored thereon, that when performed by a processor, perform the steps of:
establishing a secure separate channel in parallel to the electronic communication path;
collecting information about at least one communication taking place between the two endpoints;
encrypting the collected information;
making the collected information available via the secure separate channel;
obtaining a first portion of an authentication key;
causing the first portion of the authentication key to be stored in a first secure storage device; and
authenticating at least one party in order to provide the at least one party with access to the secure separate channel;
wherein authenticating the at least one party comprises:
retrieving the stored first portion of the authentication key;
obtaining a second portion of the authentication key associated with a session;
obtaining a key package from a second secure storage device;
generating a hash result from a subset of data obtained from the communication taking place between the two endpoints;
combining the first portion of the authentication key with the obtained key package and the generated hash result, to reconstruct the authentication key; and
using the reconstructed authentication key to authenticate the at least one party and to decrypt the encrypted collected information.
10. The non-transitory computer-readable medium of claim 9 , wherein establishing a secure separate channel comprises establishing a group via a secure group messaging platform.
11. The non-transitory computer-readable medium of claim 10 , wherein the group comprises a WhatsApp group.
12. The non-transitory computer-readable medium of claim 9 , wherein retrieving the stored first portion of the authentication key, obtaining the second portion of the authentication key, obtaining the key package, and combining the first portion of the authentication key with the obtained key package and the generated hash result to reconstruct the authentication key are performed by a secret agent component.
13. The non-transitory computer-readable medium of claim 9 , wherein authenticating the at least one party using the authentication key comprises authenticating the at least one party using at least one selected from the group consisting of:
an X-509 certificate; and
thumb printing based on characteristics of at least one device used by the at least one party.
14. The non-transitory computer-readable medium of claim 9 , wherein providing the at least one party with access to the secure separate channel comprises:
receiving a request for information from the at least one party;
encrypting the requested information;
transmitting the encrypted information; and
decrypting the encrypted information.
15. The non-transitory computer-readable medium of claim 14 , wherein encrypting and decrypting the information are performed using a ratchet tree protocol.
16. The non-transitory computer-readable medium of claim 9 , wherein the first secure storage device comprises a hardware security module.
17. A system for securely providing visibility along an electronic communication path between two endpoints, comprising:
a plurality of communication nodes, configured to establish a secure separate channel in parallel to the electronic communication path;
a capture device, configured to collect, encrypt, and store information about at least one communication taking place between the two endpoints and further configured to make the collected information available via the secure separate channel; and
a first secure storage device;
an authentication module, communicatively coupled to the first secure storage device and to the capture device, configured to:
obtain a first portion of an authentication key;
cause the first portion of the first portion of the authentication key to be stored in the first secure storage device; and
authenticate at least one party in order to provide the at least one party with access to the secure separate channel;
wherein authenticating the at least one party comprises:
retrieving the stored first portion of the authentication key;
obtaining a second portion of the authentication key associated with a session;
obtaining a key package from a second secure storage device;
generating a hash result from a subset of data obtained from the communication taking place between the two endpoints;
combining the first portion of the authentication key with the obtained key package and the generated hash result, to reconstruct the authentication key; and
using the reconstructed authentication key to authenticate the at least one party and to decrypt the encrypted collected information.
18. The system of claim 17 , wherein establishing a secure separate channel comprises establishing a group via a secure group messaging platform.
19. The system of claim 18 , wherein the group comprises a WhatsApp group.
20. The system of claim 17 , further comprising:
a secret agent component;
wherein retrieving the stored first portion of the authentication key, obtaining the second portion of the authentication key, obtaining the key package, and combining the first portion of the authentication key with the obtained key package and the generated hash result to reconstruct the authentication key are performed by the secret agent component.
21. The system of claim 17 , wherein authenticating the at least one party using the authentication key comprises authenticating the at least one authorized party using at least one selected from the group consisting of:
an X-509 certificate; and
thumb printing based on characteristics of at least one device used by the at least one party.
22. The system of claim 17 , wherein providing the at least one party with access to the secure separate channel comprises:
receiving a request for information from the at least one party;
encrypting the requested information;
transmitting the encrypted information; and
decrypting the encrypted information.
23. The system of claim 22 , wherein encrypting and decrypting the information are performed using a ratchet tree protocol.
24. The system of claim 17 , wherein the first secure storage device comprises a hardware security module.