Linear Communication Orbit for Secure Forensic Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network administrators face challenges in establishing trusted connections between remote servers and machines within isolated networks for forensic investigations, as direct communication is often restricted due to security concerns.
Innovation Solution
A method is implemented where a machine in a network forms a linear communication orbit, allowing a set of rules to be propagated through upstream machines to identify files satisfying specific criteria, and subsequently establishes a direct duplex connection with a remote server for secure and encrypted data transfer, enabling efficient search and forensic analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If direct communication channels are established between remote servers and network machines for forensic investigations, then search efficiency and investigation speed are improved, but network security and trust reliability deteriorate
Solution Approach 1:
The patent introduces a linear communication orbit as an intermediary trusted path between remote servers and network machines. This orbit consists of a sequence of trusted machines that relay communications, allowing forensic investigations to proceed efficiently while maintaining security through the trusted intermediary chain rather than direct connections.
Solution Approach 2:
The communication path is segmented into discrete trusted machines forming a linear orbit. Rather than establishing a single direct connection, the communication is divided and routed through multiple segmented nodes, each verifying trust relationships, thereby improving security while maintaining investigation efficiency.
2Reliability
If direct duplex connections are established for secure data transfer, then communication reliability is improved, but network complexity and connection management difficulty increase
Solution Approach 1:
The patent merges multiple individual direct connections into a single linear communication orbit structure. Instead of managing separate duplex connections between the server and each machine, all communications are combined and routed through the unified orbit pathway, reducing connection management complexity while maintaining reliable direct communication channels when needed.
3Reliability
If firewall restrictions are maintained to protect network security, then security reliability is improved, but communication capability and investigation accessibility deteriorate
Solution Approach 1:
The linear communication orbit acts as a trusted intermediary that operates within firewall restrictions. The orbit machines serve as authorized relays that can communicate through the firewall, maintaining security reliability while enabling communication capability that would otherwise be blocked by firewall policies.
Data Source
AI summary
A machine in a linear communication orbit receives a query, including a set of one or more rules, through the linear communication orbit. The machine, for each respective rule: identifies files that contain content that satisfies the respective rule, generates a first report identifying a count of files at the machine that contain content satisfying the rule, and sends the first report through the linear communication orbit to a server. The machine receives an instruction packet from an external machine that includes an instruction for establishing a direct duplex connection between the respective machine and the external machine. then sends a request to the external machine to establish the direct duplex connection. The machine sends to the external machine, via the direct duplex connection, a second report including information identifying files at the machine that contain file content satisfying each rule in the set of one or more rules.