Verifying captured objects before presentation

• US 20050177725A1
• Filed: 11/22/2004
• Published: 08/11/2005
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: King, Samuel, Khasgiwala, Ashish, Lowe, Rick, Coleman, Shaun, Iglesia, Erik de la
• Granted Patent: US 7,774,604 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Objects can be extracted from data flows captured by a capture device. Each captured object can then be classified according to content. Meta-data about captured objects can be stored in a tag. In one embodiment, the present invention includes receiving a request to present a previously captured object to a user, accessing a tag associated with the requested object, the tag containing metadata related to the object, the metadata including an object signature, and verifying that the object has not been altered since capture using the object signature before presenting the object to the user.

Claims

1. A method comprising:

receiving a request to present a previously captured object to a user;

accessing a tag associated with the requested object, the tag containing metadata related to the object, the metadata including an object signature;

verifying that the object has not been altered since capture using the object signature in the tag associated with the object; and

presenting the object to the user.

2. The method of claim 1, wherein the tag includes a tag signature.

3. The method of claim 2, wherein the tag signature comprises a cryptographically secure signature.

4. The method of claim 3, wherein the tag signature is signed using a private key of a capture device that captured the object associated with the tag, the private key being part of a public key cryptosystem.

5. The method of claim 2, further comprising verifying that the tag has not been altered since creation prior to presenting the object to the user.

6. The method of claim 5, wherein verifying that the tag has not been altered comprises alerting the user that the tag has been altered in the event that the verification fails.

7. The method of claim 1, wherein verifying that the object has not been altered comprises alerting the user that the object has been altered in the event that the verification fails.

8. The method of claim 1, wherein verifying that the object has not been altered since capture comprises calculating a new object signature for the requested object, and comparing the new object signature with the object signature in the tag associated with the object.

9. An apparatus comprising:

an interface to receive a request to present a previously captured object to a user;

a storage medium having the object and a tag associated with the object stored thereon, the tag containing metadata related to the object, the metadata including an object signature; and

a processor to verify the authenticity of the object using the object signature in the tag associated with the object.

10. The apparatus of claim 9, further comprising a display to present the object to the user.

11. The apparatus of claim 9, wherein the tag includes a tag signature, the tag signature being a cryptographically secure signature signed by a device that captured the object.

12. The apparatus of claim 11, wherein the tag signature is signed using a private key of a public key cryptosystem.

13. The apparatus of claim 11, wherein the processor is further to verify that the tag has not been altered since creation prior to presenting the object to the user.

14. The apparatus of claim 13, wherein the processor is further to alert the user that the tag has been altered in the event that the verification fails.

15. The apparatus of claim 9, wherein the processor is further to alert the user that the object has been altered in the event that the verification fails.

16. A method comprising:

accessing a content store containing an object captured during transmission over a network;

accessing a tag database containing a tag associated with the object, the tag including an object signature over the object and a tag signature over meta-data included in the tag, the meta-data including the object signature, the tag signature being cryptographically signed by a capture device; and

verifying the authenticity of the tag and the object using the tag signature and the object signature.

17. The method of claim 16, further comprising presenting the object to a user.

18. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a request to present a previously captured object to a user;

accessing a tag associated with the requested object, the tag containing metadata related to the object, the metadata including an object signature;

verifying that the object has not been altered since capture using the object signature in the tag associated with the object; and

presenting the object to the user.

19. The machine-readable medium of claim 18, wherein the tag includes a tag signature.

20. The machine-readable medium of claim 19, wherein the tag signature comprises a cryptographically secure signature.

21. The machine-readable medium of claim 20, wherein the tag signature is signed using a private key of a capture device that captured the object associated with the tag, the private key being part of a public key cryptosystem.

22. The machine-readable medium of claim 19, wherein the instructions further cause the processor to verify that the tag has not been altered since creation prior to presenting the object to the user.

23. The machine-readable medium of claim 22, wherein verifying that the tag has not been altered comprises alerting the user that the tag has been altered in the event that the verification fails.

24. The machine-readable medium of claim 18, wherein verifying that the object has not been altered comprises alerting the user that the object has been altered in the event that the verification fails.

25. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

accessing a content store containing an object captured during transmission over a network;

accessing a tag database containing a tag associated with the object, the tag including an object signature over the object and a tag signature over meta-data included in the tag, the meta-data including the object signature, the tag signature being cryptographically signed by a capture device; and

verifying the authenticity of the tag and the object using the tag signature and the object signature.

26. The machine-readable medium of claim 25, wherein the instructions further cause the processor to present the object to a user.