System, method and computer program product for guaranteeing electronic transactions

• US 20030163704A1
• Filed: 08/09/2002
• Published: 08/28/2003
• Est. Priority Date: 02/25/2002
• Status: Active Grant

• Current Assignee: Chemtron Research LLC (Intellectual Ventures LLC)
• Original Assignee: Network Resonance Incorporated
• Inventors: Rescorla, Eric Kenneth, Dick, Kevin Stewart
• Granted Patent: US 6,874,089 B2
• Time in Patent Office: Days
• US Class Current: 713/178
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A system, method and computer program product for guaranteeing a data transaction over a network are disclosed. When a data transaction between at least a server and a client is detected on a network, data transmitted via the network between the server and client during the data transaction is captured. At least one identifier is associated with the captured data. A timestamp is also generated for the captured data. The timestamp includes information therein identifying at least a portion of the identifier(s). The captured data, the identifier(s) and the timestamp are stored in one or more data stores. The identifier(s) associated with the stored captured data is also mapped to an entry in an index to permit retrieval of the stored data from the data store via the index.

Claims

1. A method, comprising:

a) detecting on a network a data transaction between at least a server and a client;

b) capturing data being transmitted via the network between the server and the client during the data transaction;

c) associating at least one identifier with the captured data;

d) generating a timestamp for the captured data, wherein the timestamp includes information therein identifying at least a portion of the at least one identifiers;

e) storing the captured data, the at least one identifier and the timestamp in one or more data stores; and

f) mapping the at least one identifier associated with the stored captured data to an entry in an index to permit retrieval of the stored data from the data store via the index.

2. The method of claim 1, wherein the data transmitted during the data transaction is encrypted by utilizing a session secret negotiated between the server and the client.

3. The method of claim 2, further comprising retrieving the captured data from the data store utilizing the entry in the index;

submitting a portion of the captured data to the server or client to obtain at least the session secret from the server or client; and

decrypting the captured data utilizing the obtained session secret.

4. The method of claim 3, further comprising comparing the data received by the server or the client during the data transaction with the decrypted captured data to determine if data received by the server or the client matches the decrypted captured data.

5. The method of claim 3, wherein the portion of the transaction containing at least the negotiation of the session secret is presented for revelation to at least one of the server and the client.

6. The method of claim 5, wherein the revelation of the session secret is added to a secure audit trail before revelation.

7. The method of claim 6, wherein the session secret is re-encrypted for a trusted mediator which securely logs revelation before revealing the session secret to a replaying entity.

8. The method of claim 7, wherein the trusted mediator authenticates a challenge provided by the server or the client and in which this server or the client verifies that authenticator before revealing the session secret.

9. The method of claim 8, wherein the trusted mediator reduces the session secret into traffic keys before revealing these traffic keys to the replaying entity.

10. The method of claim 1, wherein the captured data and the at least one identifier are stored in a first data store and the timestamp is stored in a second data store.

11. The method of claim 1, wherein the network includes a wireless network.

12. The method of claim 1, wherein the data transmitted during the data transaction is encrypted by the server and client utilizing at least one of a secure sockets layer protocol and a transport layer security protocol.

13. The method of claim 1, wherein the timestamp is generated utilizing a remote time source coupled to the network.

14. The method of claim 1, wherein a first device coupled to the network captures the data and associates the at least one identifier to the captured data, wherein a second device coupled to the network generates the timestamp for the captured data;

and wherein the second device transmits the timestamp to the first device via the network.

15. The method of claim 1, wherein the timestamp includes a digital signature.

16. The method of claim 1, wherein the captured data is hashed, and wherein the hash is stored instead of the captured data.

17. The method of claim 16, wherein the hash is compared to a hash of a version of the data for the same data transaction captured at another location between the server and client to verify at least one of:

the authenticity of the captured data and the integrity of the captured data.

18. A system, comprising:

a) logic for detecting on a network a data transaction between at least a server and a client;

b) logic for capturing data being transmitted via the network between the server and the client during the data transaction;

c) logic for associating at least one identifier with the captured data;

d) logic for generating a timestamp for the captured data, wherein the timestamp includes information therein identifying at least a portion of the at least one identifiers;

e) logic for storing the captured data, the at least one identifier and the timestamp in one or more data stores; and

f) logic for mapping the at least one identifier associated with the stored captured data to an entry in an index to permit retrieval of the stored data from the data store via the index.

19. The system of claim 18, wherein the data transmitted during the data transaction is encrypted utilizing a session secret negotiated between the server and the client.

20. The system of claim 19, further comprising logic for retrieving the captured data from the data store utilizing the entry in the index;

logic for submitting a portion of the captured data to the server or the client to obtain at least the session secret from the server or the client; and

logic for decrypting the captured data utilizing the obtained session secret.

21. The system of claim 20, further comprising logic for comparing the data received by the server or client during the data transaction with the decrypted captured data to determine if data received by the server or client matches the decrypted captured data.

22. The system of claim 20, wherein the portion of the transaction containing at least the negotiation of the session secret is presented for revelation to at least one of the server and the client.

23. The system of claim 22, wherein the revelation of the session secret is added to a secure audit trail before revelation.

24. The system of claim 23, wherein the session secret is re-encrypted for a trusted mediator which securely logs revelation before revealing the encrypted keying material to a replaying entity.

25. The system of claim 24, wherein the trusted mediator authenticates a challenge provided by the replaying server or client and in which this replaying server or client verifies that authenticator before revealing the session secret.

26. The system of claim 25, wherein the trusted mediator reduces the session secret into traffic keys before revealing these traffic keys to the replaying entity.

27. The system of claim 18, wherein the captured data and the at least one identifier are stored in a first data store and the timestamp is stored in a second data store.

28. The system of claim 18, wherein the data transmitted during the data transaction is encrypted by the server and client utilizing at least one of a secure sockets layer protocol and a transport layer security protocol.

29. The system of claim 18, wherein the logic for capturing the data and associating the at least one identifier to the captured data are located in a first device coupled to the network, wherein the logic for generating the timestamp for the captured data is located in a second device coupled to the network;

and wherein the second device transmits the timestamp to the first device via the network.

30. The system of claim 18, wherein the timestamp includes a digital signature.

31. The method of claim 18, wherein the captured data is hashed, and wherein the hash is stored instead of the captured data.

32. The method of claim 31, wherein the hash is compared to a hash of a version of the data for the same data transaction captured at another location between the server and client to verify at least one of:

the authenticity of the captured data and the integrity of the captured data.

33. A computer program product, comprising:

a) computer code for detecting on a network a data transaction between at least a server and a client;

b) computer code for capturing data being transmitted via the network between the server and client to the destination during the data transaction;

c) computer code for associating at least one identifier with the captured data;

d) computer code for generating a timestamp for the captured data, wherein the timestamp includes information therein identifying at least a portion of the at least one identifiers;

e) computer code for storing the captured data, the at least one identifier and the timestamp in one or more data stores; and

f) computer code for mapping the at least one identifier associated with the stored captured data to an entry in an index to permit retrieval of the stored data from the data store via the index.

34. The computer program product of claim 33, wherein the data transmitted during the data transaction is encrypted by utilizing a session secret negotiated between the server and client;

wherein the captured data is retrieved from the data store utilizing the entry in the index;

wherein a portion of the captured data is submitted to the server or client to obtain at least the session secret from the server or client;

wherein the captured data is decrypted utilizing the obtained session secret; and

wherein the data received by the server or client during the data transaction is compared with the decrypted captured data to determine if data received by the server or client matches the decrypted captured data.