US 2018/0124089 A1 · SECURE DIGITAL TRAFFIC ANALYSIS

Abstract

A network monitoring “sensor” is built on initial startup by checking the integrity of the bootstrap system and, if it passes, downloading information from which it builds the full system including an encrypted and an unencrypted portion. Later, the sensor sends hashes of files, configurations, and other local information to a data center, which compares the hashes to hashes of known-good versions. If they match, the data center returns information (e.g., a key) that the sensor can use to access the encrypted storage. If they don't, the data center returns information to help remediate the problem, a command to restore some or all of the sensor's programming and data, or a command to wipe the encrypted storage. The encrypted storage stores algorithms and other data for processing information captured from a network, plus the captured/processed data itself.

Claims20

Dependent claims

A network monitoring system comprising a processor, a network interface, and a memory having an encrypted portion and an unencrypted portion, the unencrypted portion being encoded with programming instructions executable by the processor to:

create one or more hashes of at least some of the information stored in the unencrypted portion of the memory;
send the one or more hashes to a remote computer;
receive a response from the remote computer;
and
if the response is of a first type, then
use information in the response to decrypt the encrypted portion of the memory;
and
use information from the encrypted portion of the memory to capture and process data using the network interface.

5 more elements

Dependencies are inferred from the claim text.

Secure digital traffic analysis

Life of this patent

Secure digital traffic analysis

Life of this patent

Abstract

Claims20