also store a re encryption module 124 which includes executable instructions to implement the operations 220 222 of fig2 and similar operations discussed below the security appliance 208 also includes standard components such as a central processing unit 130 and input output devices 134 connected via a bus 134 a network interface circuit 136 is also connected to the bus 134 a memory 140 is also connected to the bus 134 the memory 140 stores encrypted data 142 the memory 140 also stores a data analysis module 144 which includes executable instructions to perform data analysis of the type described herein in one embodiment the visibility appliance 202 may send the security appliance 208 a re encrypted version of the decrypted data using a new session key session key 3 this ensures that the data is encrypted in transit as well as at rest in the event that the security appliance 208 is saving the data to persistent storage for the purpose of subsequent on demand decryption of the data session key 3 can be conveyed to the security appliance 208 in a variety of ways a via a dedicated and secure management path employing some level of application or transport security b as encoded encrypted metadata embedded within the flow between the visibility appliance 202 and the security appliance 208 referred to herein as u201c crypto flow u201d c maintained in a secure hardware security module hsm or database within the visibility appliance 202 itself providing a binding between the crypto flow and its.