Technique for establishing provable chain of evidence

• US 6,948,066 B2
• Filed: 01/17/2001
• Issued: 09/20/2005
• Est. Priority Date: 01/17/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hind, John R., Peters, Marcia L.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/761,899
• Publication Number:
  US 20020095601A1
• Time in Patent Office: 1,707 Days
• Field of Search: 713168-170, 713/181, 713/189, 713/192, 713200-201, 380/200, 380/212, 380/217, 380/258, 380/262, 380/270, 380/282, 380/285
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method, system, computer program product, and method of doing business by providing a provable chain of evidence for data stream(s) created by one or more components (such as input/output devices and application processing components). Components that create the evidence collection are authenticated. A unique identifier of each such component is included within cryptographically-protected information that is added to the evidence collection. A digital signature is preferably used for the cryptographic protection, thereby digitally notarizing the evidence collection. The authenticity and integrity of the evidence collection can be verified. In preferred embodiments, the authenticated identities of components providing the evidence can also be determined from the cryptographically-protected information. One or more data streams may be included within the evidence collection to establish information such as the date and time the evidence collection was captured, the geographic location where the capture was performed, an identification of a person performing the evidence capture, and so forth. When present in a provable chain of evidence, these types of additional evidence are provided by authenticated components which are identified within the cryptographically-protected information.

Claims

1. A system for providing a provable chain of evidence for an evidence collection, comprising:

a security core which provides security functions;

one or more components;

means for operating the security core;

means for connecting the components to the security core, such that the security core can vouch for authenticity of each connected component;

means for recording one or more data streams which comprise the evidence collection, each of the data streams being created by selected ones of the connected components; and

means for securely providing, for the evidence collection by the security core, an identification of each of the selected ones which create the recorded data streams, wherein the means for securely providing further comprises means for digitally notarizing, by the security core, the recorded data streams which comprise the evidence collection and wherein the means for digitally notarizing further comprises;

means for computing, by the security core, a hash value over each of the recorded data streams;

means for combining each hash value with a unique identifier of the selected one which created the recorded data stream for which the hash value was computed, thereby creating a combination data block;

means for hashing the combination data block;

means for digitally signing the hashed combination data block with a private cryptographic key of the security core, wherein the private cryptographic key has a public cryptographic key cryptographically associated therewith; and

means for providing the digitally signed hashed combination data block, along with the combination data block, as the digital notarization for the recorded data streams which comprise the evidence collection, wherein the digital notarization cryptographically seals contents of the evidence collection and identities of the selected ones.

2. The system according to claim 1, wherein selected ones of the connections are made using one or more buses of the security core.

3. The system according to claim 1, wherein selected ones of the operable connections are made using a wireless connection between respective ones of the components and the security core.

4. The system according to claim 3, wherein the wireless connections use Secure Sockets Layer (SSL) data encryption or an equivalent which provides mutual authentication of both endpoints, negotiation of a time-limited key agreement with secure passage of a selected encryption key, and periodic renegotiation of the time-limited key agreement with a new encryption key.

5. The system according to claim 1, wherein selected ones of the secure operable connections are provided when the security core is manufactured.

6. The system according to claim 1, wherein the components comprise one or more of (1) input/output components and (2) application processing components.

7. The system according to claim 1, wherein the means for connecting further comprises means for authenticating the connected component to the security core.

8. The system according to claim 7, wherein the means for authenticating, further comprises:

means for providing a unique identifier of the connected component to the security core, along with a digital signature of the unique identifier that is created using a private key of the connected component; and

means for using, by the security core, a public key that is cryptographically associated with the private key to determine authenticity of the connected component.

9. The system according to claim 1, wherein the means for connecting is activated by a hardware reset of the component, and wherein the hardware reset is activated by operably connecting of the component.

10. The system according to claim 7, wherein the means for authenticating are securely stored on the connected component.

11. The system according to claim 7, further comprising means for authenticating the security core to the connected component.

12. The system according to claim 1, further comprising means for authenticating a user involved in operating the security core and the connected components.

13. The system according to claim 1, further comprising:

means for detecting whether the selected ones remain connected to the security core during operation of the means for recording; and

means for aborting the recording if one or more of the selected ones fails to remain connected to the security core during operation of the means for recording.

14. The system according to claim 1, further comprising:

means for detecting whether the components remain connected to the security core during operation of the means for recording; and

means for marking the evidence collection as not authenticated if one or more of the components fails to remain connected to the security core during operation of the means for recording.

15. The system according to claim 7, further comprising:

means for determining whether the selected ones have been authenticated to the security core; and

means for aborting the evidence collection if one or more of the selected ones has not been authenticated to the security core.

16. The system according to claim 7, further comprising:

means for determining whether the selected ones have been authenticated to the security core; and

means for marking the evidence collection as not authenticated if one or more of the selected ones has not been authenticated to the security core.

17. The system according to claim 7, further comprising:

means for determining whether the selected ones have been authenticated to the security core; and

means for suppressing from the evidence collection any data streams created by those ones of the selected ones that have not been authenticated to the security core.

18. The system according to claim 1, wherein the means for securely providing further comprises means for adding another data stream to the evidence collection, wherein the added data stream comprises a digital notarization, created by the security core, of the recorded data streams which comprise the evidence collection.

19. The system according to claim 18, further comprising:

means for authenticating a user involved in creating the recorded data streams; and

means for including an identification of the authenticated user in the digital notarization.

20. The system according to claim 1, wherein:

the means for computing a hash operates periodically, upon expiration of an elapsed time value, to compute a hash value over each of a plurality of segments of each recorded data stream;

the means for combining, the means for hashing, and the means for digitally signing all operate on the periodically-computed hash values for each recorded data stream; and

the means for providing provides the digitally signed periodically-computed hash values, along with the periodically-computed hash values, as the digital notarization; and

further comprising means for inserting an identification of a time corresponding to each of the periodically-computed hash values at appropriate locations within each of the recorded data streams.

21. The system according to claim 20, wherein the means for inserting uses MPEG-4 synchronization timestamping.

22. The system according to claim 20, wherein authenticity and integrity of each of the segments is independently verifiable.

23. The system according to claim 20, further comprising:

means for extracting selected ones of the segments of the recorded data streams; and

means for verifying integrity of the extracted selected ones using the public cryptographic key of the security core.

24. The system according to claim 1, further comprising:

means for extracting selected ones of the recorded data streams; and

means for verifying authenticity of the extracted selected ones using the public cryptographic key of the security core.

25. The system according to claim 1, further comprising means for verifying authenticity of the evidence collection by a receiver of the recorded data streams and the digital notarization, using a public cryptographic key of the security core, wherein the public cryptographic key is cryptographically associated with a private cryptographic key that was used by the security core to create the digital notarization, and for concluding that the evidence collection is authentic if the verification succeeds.

26. The system according to claim 25, wherein the means for verifying authenticity further comprises concluding that the evidence collection has not been tampered with if the verification succeeds.

27. The system according to claim 1, wherein the one or more recorded data streams of the evidence collection comprise an audio transcript.

28. The system according to claim 27, wherein the evidence collection further comprises an identification of participants who are speaking in the audio transcript, wherein identification of the participants is provided by one of the selected ones.

29. The system according to claim 1, wherein at least one of the one or more recorded data streams of the evidence collection comprises video data.

30. The system according to claim 1, wherein the one or more recorded data streams of the evidence collection comprise a photograph and identifying information pertaining to taking the photograph.

31. The system according to claim 30, wherein the identifying information further comprises at least one of:

(1) a time of day when the photograph was taken;

(2) a date when the photograph was taken;

(3) a location where the photograph was taken, (4) a direction of the camera when the photograph was taken; and

(5) settings of the camera when the photograph was taken;

wherein the time, date, and location are provided by one or more of the selected ones.

32. The system according to claim 31, wherein the location is provided by one of the selected ones which is a global positioning satellite receiver.

33. The system according to claim 1, further comprising:

means for recording an audio transcript by a first selected one of the connected components;

means for converting the audio transcript to a digital data stream by a second selected one of the connected components;

means for digitally notarizing the digital data stream, by the security core;

means for using the digital data stream as the recorded data stream of the evidence collection; and

means for using the digital notarization as the securely provided identification.

34. The system according to claim 33, wherein the means for digitally notarizing further comprise:

means for computing a hash of the digital data stream;

means for combining the hash and a unique identifier of each of the first selected one and the second selected one, thereby creating a data block;

means for hashing the data block; and

means for digitally signing the hash of the data block using a private cryptographic key of the security core.

36. The method according to claim 25, wherein selected ones of the operable connections are made using one or more buses of the security core.

37. The method according to claim 25, wherein selected ones of the operable connections are made using a wireless connection between respective ones of the components and the security core.

38. The method according to claim 37, wherein the wireless connections use Secure Sockets Layer (SSL) data encryption or an equivalent which provides mutual authentication of both endpoints, negotiation of a time-limited key agreement with secure passage of a selected encryption key, and periodic renegotiation of the time-limited key agreement with a new encryption key.

39. The method according to claims 25, wherein selected ones of the secure operable connections are provided when the security core is manufactured.

35. A method of creating a provable chain of evidence for an evidence collection, comprising:

providing a security core which provides security functions;

connecting one or more components to the security core, such that the security core can vouch for authenticity of each connected component;

recording one or more data streams which comprise the evidence collection, each of the data streams being created by selected ones of the connected components; and

securely providing, for the evidence collection by the security core, an identification of each of the selected ones which create the recorded data streams, wherein securely providing further comprises digitally notarizing, by the security core, the recorded data streams which comprise the evidence collection and wherein digitally notarizing further comprises;

computing, by the security core, a hash value over each of the recorded data streams;

combining each hash value with a unique identifier of the selected one which created the recorded data stream for which the hash value was computed, thereby creating a combination data block;

hashing the combination data block;

digitally signing the hashed combination data block with a private cryptographic key of the security core, wherein the private cryptographic key has a public cryptographic key cryptographically associated therewith; and

providing the digitally signed hashed combination data block, along with the combination data block, as the digital notarization for the recorded data streams which comprise the evidence collection, wherein the digital notarization cryptographically seals contents of the evidence collection and identities of the selected ones.

40. The method according to claim 35, wherein the components comprise one or more of (1) input/output components and (2) application processing components.

41. The system according to claim 35, wherein connecting further comprises authenticating the connected component to the security core.

42. The method according to claim 41, wherein authenticating further comprises:

providing a unique identifier of the connected component to the security core, along with a digital signature of the unique identifier that is created using a private key of the connected component; and

using, by the security core, a public key that is cryptographically associated with the private key to determine authenticity of the connected component.

43. The method according to claim 41, wherein instructions for authenticating are securely stored on the connected component.

44. The method according to claim 41, further comprising authenticating the security core to the connected component.

45. The method according to claim 41, further comprising:

determining whether the selected ones have been authenticated to the security core; and

aborting the evidence collection if one or more of the selected ones has not been authenticated to the security core.

46. The method according to claim 41, further comprising:

determining whether the selected ones have been authenticated to the security core; and

marking the evidence collection as not authenticated if one or more of the selected ones has not been authenticated to the security core.

47. The method according to claim 41, further comprising:

determining whether the selected ones have been authenticated to the security core; and

suppressing from the evidence collection any data streams created by those ones of the selected ones that have not been authenticated to the security core.

48. The method according to claim 35, wherein connecting is activated by a hardware reset of the component, and wherein the hardware reset is activated by operably connecting of the component.

49. The method according to claim 35, further comprising authenticating a user involved in operating the security core and the connected components.

50. The method according to claim 35, further comprising:

detecting whether the components remain connected to the security core during recording; and

aborting the recording if one or more of the components fails to remain connected to the security core during recording.

51. The method according to claim 35, further comprising:

detecting whether the selected ones remain connected to the security core during recording; and

marking the evidence collection as not authenticated if one or more of the selected ones fails to remain connected to the security core during recording.

52. The method according to claim 35, wherein securely providing further comprises adding another data stream to the evidence collection, wherein the added data stream comprises a digital notarization, created by the security core, of the recorded data streams which comprise the evidence collection.

53. The method according to claim 52, further comprising:

authenticating a user involved in creating the recorded data streams; and

including an identification of the authenticated user in the digital notarization.

54. The method according to claim 35, wherein:

computing a hash operates periodically, upon expiration of an elapsed time value, to compute a hash value over each of a plurality of segments of each recorded data stream;

combining, hashing, and digitally signing all operate on the periodically-computed hash values for each recorded data stream; and

providing provides the digitally signed periodically-computed hash values, along with the periodically-computed hash values, as the digital notarization; and

further comprising inserting an identification of a time corresponding to each of the periodically-computed hash values at appropriate locations within each of the recorded data streams.

55. The method according to claim 35, wherein inserting uses MPEG-4 synchronization timestamping.

56. The method according to claim 35, wherein authenticity and integrity of each of the segments is independently verifiable.

57. The method according to claim 35, further comprising:

extracting selected ones of the segments of the recorded data streams; and

verifying integrity of the extracted selected ones using the public cryptographic key of the security core.

58. The method according to claim 35, further comprising:

extracting selected ones of the recorded data streams; and

verifying authenticity of the extracted selected ones using the public cryptographic key of the security core.

59. The method according to claim 35, further comprising verifying authenticity of the evidence collection by a receiver of the recorded data streams and the digital notarization, using a public cryptographic key of the security core, wherein the public cryptographic key is cryptographically associated with a private cryptographic key that was used by the security core to create the digital notarization, and concluding that the evidence collection is authentic if the verification succeeds.

60. The method according to claim 59, wherein verifying authenticity further comprises concluding that the evidence collection has not been tampered with if the verification succeeds.

61. The method according to claim 35, wherein the one or more recorded data streams of the evidence collection comprise an audio transcript.

62. The method according to claim 61, wherein the evidence collection further comprises an identification of participants who are speaking in the audio transcript, wherein identification of the participants is provided by one of the selected ones.

63. The method according to claim 35, wherein at least one of the one or more recorded data streams of the evidence collection comprises video data.

64. The method according to claim 35, wherein the one or more recorded data streams of the evidence collection comprise a photograph and identifying information pertaining to taking the photograph.

65. The method according to claim 64, wherein the identifying information further comprises at least one of:

(1) a time of day when the photograph was taken;

(2) a date when the photograph was taken;

(3) a location where the photograph was taken;

(4) a direction of the camera when the photograph was taken; and

(5) settings of the camera when the photograph was taken;

wherein the time, date, and location are provided by one or more of the selected ones.

66. The method according to claim 65, wherein the location is provided by one of the selected ones which is a global positioning satellite receiver.

67. The method according to claim 35, further comprising:

recording an audio transcript by a first selected one of the connected components;

converting the audio transcript to a digital data stream by a second selected one of the connected components;

digitally notarizing the digital data stream, by the security core;

using the digital data stream as the recorded data stream of the evidence collection; and

using the digital notarization as the securely provided identification.

68. The method according to claim 67, wherein digitally notarizing further comprises:

computing a hash of the digital data stream;

combining the hash and a unique identifier of each of the first selected one and the second selected one, thereby creating a data block;

hashing the data block; and

digitally signing the hash of the data block using a private cryptographic key of the security core.

69. A computer program product for providing a provable chain of evidence for an evidence collection, the computer program product embodied on one or more computer-readable media and comprising:

computer-readable program code configured to operate a security core which provides security functions;

computer-readable program code configured to connect one or more components to the security core, such that the security core can vouch for authenticity of each connected component;

computer-readable program code configured to record one or more data streams which comprise the evidence collection, each of the data streams being created by selected ones of the connected components; and

computer-readable program code configured to securely provide, for the evidence collection by the security core, an identification of each of the selected ones which create the recorded data streams, wherein the computer-readable program code configured to securely provide further comprises computer-readable program code configured to digitally notarize, by the security core, the recorded data streams which comprise the evidence collection and wherein the computer-readable program code configured to digitally notarize further comprises;

computer-readable program code configured to compute, by the security core, a hash value over each of the recorded data streams;

computer-readable program code configured to combine each hash value with a unique identifier of the selected one which created the recorded data stream for which the hash value was computed, thereby creating a combination data block;

computer-readable program code configured to hash the combination data block;

computer-readable program code configured to digitally sign the hashed combination data block with a private cryptographic key of the security core, wherein the private cryptographic key has a public cryptographic key cryptographically associated therewith; and

computer-readable program code configured to provide the digitally signed hashed combination data block, along with the combination data block, as the digital notarization for the recorded data streams which comprise the evidence collection, wherein the digital notarization cryptographically seals contents of the evidence collection and identities of the selected ones.

70. The computer program product according to claim 69, wherein selected ones of the operable connections are made using one or more buses of the security core.

71. The computer program product according to claim 69, wherein selected ones of the operable connections are made using a wireless connection between respective ones of the components and the security core.

72. The computer program product according to claim 71, wherein the wireless connections use Secure Sockets Layer (SSL) data encryption or an equivalent which provides mutual authentication of both endpoints, negotiation of a time-limited key agreement with secure passage of a selected encryption key, and periodic renegotiation of the time-limited key agreement with a new encryption key.

73. The computer program product according to claim 69, wherein selected ones of the secure operable connections are provided when the security core is manufactured.

74. The computer program product according to claim 69, wherein the components comprise one or more of (1) input/output components and (2) application processing components.

75. The computer program product according to claim 69, wherein the computer-readable program code configured to connect further comprises computer-readable program code configured to authenticate the connected component to the security core.

76. The computer program product according to claim 75, wherein the computer-readable program code configured to authenticate further comprises:

computer-readable program code configured to provide a unique identifier of the connected component to the security core, along with a digital signature of the unique identifier that is created using a private key of the connected component; and

computer-readable program code configured to use, by the security core, a public key that is cryptographically associated with the private key to determine authenticity of the connected component.

77. The computer program product according to claim 75, wherein the computer-readable program code configured to authenticate are securely stored on the connected component.

78. The computer program product according to claim 75, further comprising computer-readable program configured to authenticate the security core to the connected component.

79. The computer program product according to claim 75, further comprising:

computer-readable program code configured to determine whether the selected ones have been authenticated to the security core; and

computer-readable program code configured to abort the evidence collection if one or more of the selected ones has not been authenticated to the security core.

80. The computer program product according to claim 75, further comprising:

computer-readable program code configured to determine whether the selected ones have been authenticated to the security core; and

computer-readable program code configured to mark the evidence collection as not authenticated if one or more of the selected ones has not been authenticated to the security core.

81. The computer program product according to claim 75, further comprising:

computer-readable program code configured to determine whether the selected ones have been authenticated to the security core; and

computer-readable program code configured to suppress from the evidence collection any data streams created by those ones of the selected ones that have not been authenticated to the security core.

82. The computer program product according to claim 69, wherein the computer-readable program code configured to connect is activated by a hardware reset of the component, and wherein the hardware reset is activated by operably connecting of the component.

83. The computer program product according to claim 69, further comprising computer-readable program code configured to authenticate a user involved in operating the security core and the connected component.

84. The computer program product according to claim 69, further comprising:

computer-readable program code configured to detect whether the selected ones remain connected to the security core during operation of the computer-readable program code configured to record; and

computer-readable program code configured to abort the recording if one or more of the selected ones fails to remain connected to the security core during computer-readable program code configured to record.

85. The computer program product according to claim 69, further comprising:

computer-readable program code configured to detect whether the components remain connected to the security core during operation of the computer-readable program code configured to record; and

computer-readable program code configured to mark the evidence collection as not authenticated if one or more of the components fails to remain connected to the security core during operation of the computer-readable program code configured to record.

86. The computer program product according to claim 69, wherein the computer-readable program code configured to securely provide further comprises computer-readable program code configured to add another data stream to the evidence collection, wherein the added data stream comprises a digital notarization, created by the security core, of the recorded data streams which comprise the evidence collection.

87. The computer program product according to claim 86, further comprising:

computer-readable program code configured to authenticate a user involved in creating the recorded data streams; and

computer-readable program code configured to include an identification of the authenticated user in the digital notarization.

88. The computer program product according to claim 69, wherein:

the computer-readable program code configured to compute a hash operates periodically, upon expiration of an elapsed time value, to compute a hash value over each of a plurality of segments of each recorded data stream;

the computer-readable program code configured to combine, the computer-readable program code configured to hash, and the computer-readable program code configured to digitally sign all operate on the periodically-computed hash values for each recorded data stream; and

the computer-readable program code configured to provide provides the digitally signed periodically-computed hash values, along with the periodically-computed hash values, as the digital notarization; and

further comprising computer-readable program code configured to insert an identification of a time corresponding to each of the periodically-computed hash values at appropriate locations within each of the recorded data streams.

89. The computer program product according to claim 88, wherein the computer-readable program code configured to insert uses MPEG-4 synchronization timestamping.

90. The computer program product according to claim 88, wherein authenticity and integrity of each of the segments is independently verifiable.

91. The computer program product according to claim 88, further comprising:

computer-readable program code configured to extract selected ones of the segments of the recorded data streams; and

computer-readable program code configured to verify integrity of the extracted selected ones using the public cryptographic key of the security core.

92. The computer program product according to claim 88, further comprising:

computer-readable program code configured to extract selected ones of the recorded data streams; and

computer-readable program code configured to, verify authenticity of the extracted selected ones using the public cryptographic key of the security core.

93. The computer program product according to claim 69, further comprising computer-readable program code configured to verify authenticity of the evidence collection by a receiver of the recorded data streams and the digital notarization, using a public cryptographic key of the security core, wherein the public cryptographic key is cryptographically associated with a private cryptographic key that was used by the security core to create the digital notarization, and for concluding that the evidence collection is authentic if the verification succeeds.

94. The computer program product according to claim 93, wherein the computer-readable program code configured to verify authenticity further comprises concluding that the evidence collection has not been tampered with if the verification succeeds.

95. The computer program product according to claim 69, wherein the one or more recorded data streams of the evidence collection comprise an audio transcript.

96. The computer program product according to claim 95, wherein the evidence collection further comprises an identification of participants who are speaking in the audio transcript, wherein identification of the participants is provided by one of the selected ones.

97. The computer program product according to claim 69, wherein at least one of the one or more recorded data streams of the evidence collection comprises video data.

98. The computer program product according to claim 69, wherein the one or more recorded data streams of the evidence collection comprise a photograph and identifying information pertaining to taking the photograph.

99. The computer program product according to claim 98, wherein the identifying information further comprises at least one of:

(1) a time of day when the photograph was taken;

(2) a date when the photograph was taken;

(3) a location where the photograph was taken;

(4) a direction of the camera when the photograph was taken; and

(5) settings of the camera when the photograph was taken;

wherein the time, date, and location are provided by one or more of the selected ones.

100. The computer program product according to claim 99, wherein the location is provided by one of the selected ones which is a global positioning satellite receiver.

101. The computer program product according to claim 69, further comprising:

computer-readable program code configured to record an audio transcript by a first selected one of the connected components;

computer-readable program code configured to convert the audio transcript to a digital data stream by a second selected one of the connected components;

computer-readable program code configured to digitally notarize the digital data stream, by the security core;

computer-readable program code configured to use the digital data stream as the recorded data stream of the evidence collection; and

computer-readable program code configured to use the digital notarization as the securely provided identification.

102. The computer program product according to claim 101, wherein the computer-readable program code configured to digitally notarize further comprise:

computer-readable program code configured to hash a hash of the digital data stream;

computer-readable program code configured to combine the hash and a unique identifier of each of the first selected one and the second selected one, thereby creating a data block;

computer-readable program code configured to hash the data block; and

computer-readable program code configured to digitally sign the hash of the data block using a private cryptographic key of the security core.

103. A method of doing business by creating a provable chain of evidence for an evidence collection, comprising:

operating a security core which provides security functions;

connecting one or more components to the security core, such that the security core can vouch for authenticity of each connected component;

authenticating selected ones of the components to the security core, thereby connecting the selected ones, using a unique identifier of each selected one along with a digital signature of the unique identifier that is created using a private key of the selected one and using, by the security core, a public key that is cryptographically associated with the private key to determine authenticity of the connected component;

recording one or more data streams which comprise the evidence collection, the data streams being created by at least one of the selected ones; and

digitally notarizing, by the security core, the recorded data streams which comprise the evidence collection, wherein the digitally notarizing further comprises;

computing, by the security core, a hash value over each of the recorded data streams;

combining each hash value with a unique identifier of the selected one which created the recorded data stream for which the hash value was computed, thereby creating a combination data block;

hashing the combination data block;

digitally signing the hashed combination data block with a private cryptographic key of the security core, wherein the private cryptographic key has a public cryptographic key cryptographically associated therewith; and

providing the digitally signed hashed combination data block, along with the combination data block, as the digital notarization for the recorded data streams which comprise the evidence collection, wherein the digital notarization cryptographically seals contents of the evidence collection and identities of the selected ones which created the recorded data streams of the evidence collection.