Platform Security Overview
Resilio Active Everywhere uses cryptographic security that is built on industry standards to achieve maximum security for the product. The implementation is based on open-source OpenSSL cryptographic libraries that are used in addition to the operating system provided cryptographic APIs.
Security Model Overview Key Features
- Mutual authentication and authorization of clients and Management Console
- Industry-standard cryptography using open-source OpenSSL
- Generation of one-time session encryption keys between clients
- Data integrity is based on the SHA2 and ED25519 signature algorithms
- Data in transit encryption
- Admin configurable choice of standard cipher sets: AES-256 or AES-128
- Standard encryption protocols: TLS 1.2, AES-256, SHA2
- Perfect forward secrecy
- System-wide event logging for security audit
- Works inside your private infrastructure
Session Encryption & Data Integrity Validation
Agent to Agent Communication
All the communications are end-to-end encrypted. The Management Console generates a pair of 256-bit keys for each transfer job. The pair includes a read-only and read-write private key that defines different access permission for the Agent. The Management Console provisions each agent with the right key depending on the job configuration. When an agent requires a data transfer it starts a transfer session. Each transfer session between two agents has a unique TLS 1.2 connection with a unique session key. Sessions are encrypted using TLS cipher suites DHE-PSK-AES 128-GCM-SHA256 or DHE-PSK-AES256-GCM-SHA384 and provide data forward secrecy that protects past sessions against future compromises of session keys.
Agent to Management Console Communication
Communication between the Agent and the Management Console is done over TLS 1.2.
Authentication
Resilio Active Everywhere requires mutual authentication of all parties in the system. The Management Console and Agent mutual authentication relies on an agent’s private token and the server's X.509 certificate. The Management Console verifies that an agent provides a valid private token before starting any communication with the agent.
Data Encryption
Data in transit is encrypted using TLS 1.2 and 128-bit or 256-bit AES encryption. TLS session keys are generated using the Diffie-Hellman key exchange protocol and a pre-shared job’s private key. All the data within the session is encrypted with AES in GaloisCounter mode (GCM). The GCM mode is designed to be efficient in high-speed communication while providing authenticity (integrity) and confidentiality. The administrator has the ability to choose a 128-bit or 256-bit cipher length for data encryption.
Resilio Agents split each file into blocks (32KB or more) and calculates the SHA2 hash of each block. The list of hashes is signed with the relevant job’s 256-bit read-write key using the ED25519 algorithm.
Data Integrity
The list of hashes and the signature (file metadata) are transferred before the actual data transfer. The receiver validates the signature of the metadata and the integrity of each received block by validating its hash against meta information. Damaged or corrupted blocks are discarded and scheduled for retransmission. Once a file is assembled the receiver validates the hash of the complete file.
Agent Security & Firewall Considerations
Agent Binary
The Resilio Agent is a single binary that has no external dependencies on libraries and frameworks. The Resilio Agent uses a limited number of well-defined ports and protocols for all communications with other machines and the Management Console. The Resilio Agent doesn’t require any administrative privileges to run. It can be run in a sandboxed environment or by a user with limited permissions.
Private Infrastructure
Development Practices & Compliance Certifications
Resilio Active Everywhere runs completely within the Customer’s private infrastructure. It doesn’t require any external web services or connections to external resources. Resilio, Inc, the developer of Resilio Active Everywhere, has achieved SOC 2 Type 2 compliance for the description of its system and on the suitability of the design of its controls relevant to security. Resilio maintains a quality assurance process for code testing. Each version of Resilio Active Everywhere undergoes penetration tests using Dynamic Application Security Testing (DAST) tools before release. Additionally, the company’s cryptographic technology used in its products has been reviewed by an expert independent third-party security auditing company and found to be sound in design.
Firewall Considerations
Resilio Active Everywhere is designed for deployment inside the enterprise. It has a well-defined list of ports and protocols required for the operation.
| Purpose | Protocol | Default Port |
|---|---|---|
| Tracker Service (Agent Discovery) | TCP and UDP | 3000 |
| LAN Discovery (optional) | TCP and UDP | 3838 |
| Data Transfer | TCP and UDP | 3839 |
| Management Console Web Interface | TCP and UDP | 8443 |
| Agents Control and Status | TCP and UDP | 8444 |
| Agents Log Upload | TCP and UDP | 8445 |
How to Get Started
Get your organization active everywhere—see how with a personalized demo.
- Live demonstration with your actual file types and sizes
- Custom deployment recommendations
- Custom architecture design for your infrastructure
- ROI calculation for your organization
- ROI analysis based on your current pain points
- Implementation roadmap
- Implementation timeline and success metrics
- Proof-of-concept trial access