Preserving system integrity using file manifests

A computing device for preserving integrity and performing a backup of a plurality of endpoint devices centrally managed by a central server over a network, comprising:

• at least one processor;
• and
• memory including instructions that, when executed by the at least one processor, cause the computing device to perform the steps of:
• receiving at the central server, from each of the plurality of endpoint devices, a manifest for performing the backup and preserving integrity of the endpoint device that identifies files located in the file system of the endpoint device, the manifest containing unique file signatures of the files in the file system of the endpoint device, wherein the manifest is produced on the endpoint device by an agent operating on the endpoint device that calculates the unique file signatures of the files in the file system of the endpoint device;
• wherein the received manifest is secured by performing one or more of:
• storing the received manifest on the endpoint device in a location protected by a filter driver, wherein the filter driver protects the location from external access and tampering;
• encrypting and encoding the received manifest in a binary format that only the central server can read;
• and
• uploading the received manifest to the central server using a secure sockets layer (SSL) channel;
• for each of the plurality of endpoint devices,
• comparing the manifest received from the endpoint device with a reference manifest to identify differences between the received manifest and the reference manifest, wherein the reference manifest is produced by performing a full scan of the file system of the endpoint device when the endpoint device is in a clean state and calculating unique file signatures of files in the file system;
• determining, based on a policy file that defines what differences from the reference manifest constitute a compromise to the integrity of the endpoint device, whether differences between the received manifest and the reference manifest constitute a compromise to the integrity of the computing device;
• in response to determining that the differences between the received manifest and the reference manifest do not constitute a compromise to the integrity of the computing device based on the policy file, using the received manifest to back up the endpoint device by determining content changed on the endpoint device since a previous backup by comparing the received manifest with a previous manifest received from the endpoint device to determine what changes have taken place on the endpoint device since the capturing of the previous manifest, and uploading the changed content to the central server;
• and
• in response to determining that the identified differences constitute a compromise to the integrity of the endpoint device, triggering a remedial action.

A non-transitory computer readable storage medium for preserving integrity and performing a backup of a plurality of endpoint devices centrally managed by a central server over a network comprising one or more sequences of instructions, the instructions when executed by one or more processors causing the one or more processors to execute the operations of:

• receiving at the central server, from each of the plurality of endpoint devices, a manifest for performing the backup and preserving integrity of the endpoint device that identifies files located in the file system of the endpoint device, the manifest containing unique file signatures of the files in the file system of the endpoint device, wherein the manifest is produced on the endpoint device by an agent operating on the endpoint device that calculates the unique file signatures of the files in the file system of the endpoint device;
• wherein the received manifest is secured by performing one or more of:
• storing the received manifest on the endpoint device in a location protected by a filter driver, wherein the filter driver protects the location from external access and tampering;
• encrypting and encoding the received manifest in a binary format that only the central server can read;
• and
• uploading the received manifest to the central server using a secure sockets layer (SSL) channel;
• for each of the plurality of endpoint devices,
• comparing the manifest received from the endpoint device with a reference manifest to identify differences between the received manifest and the reference manifest, wherein the reference manifest is produced by performing a full scan of the file system of the endpoint device when the endpoint device is in a clean state and calculating unique file signatures of files in the file system;
• determining, based on a policy file that defines what differences from the reference manifest constitute a compromise to the integrity of the endpoint device, whether differences between the received manifest and the reference manifest constitute a compromise to the integrity of the computing device;
• in response to determining that the differences between the received manifest and the reference manifest do not constitute a compromise to the integrity of the computing device based on the policy file, using the received manifest to back up the endpoint device by determining content changed on the endpoint device since a previous backup by comparing the received manifest with a previous manifest received from the endpoint device to determine what changes have taken place on the endpoint device since the capturing of the previous manifest, and uploading the changed content to the central server;
• and
• in response to determining that the identified differences constitute a compromise to the integrity of the endpoint device, triggering a remedial action.