Enterprise computer investigation system

• US 7,900,044 B2
• Filed: 09/08/2004
• Issued: 03/01/2011
• Est. Priority Date: 06/20/2002
• Status: Active Grant

• Current Assignee: Open Text Holdings, Inc. (Open Text Corporation)
• Original Assignee: Guidance Software Incorporated (Open Text Corporation)
• Inventors: Garrett, Matthew, Weber, Dominik, McCreight, Shawn
• Primary Examiner(s): Dada; Beemnet W
• Application Number:
  US10/936,466
• Publication Number:
  US 20050097366A1
• Time in Patent Office: 2,365 Days
• Field of Search: 709217-219, 726/22, 726/26, 726/27, 713/164, 713/165, 713/167, 713/168, 713/171, 380/278, 380/279, 380/281
• US Class Current: 713/168
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A method, apparatus and system for secure forensic investigation of a target machine by a client machine over a communications network. In one aspect the method comprises establishing secure communication with a server over a communications network, establishing secure communication with the target machine over the communications network, wherein establishing secure communication with the target machine includes establishing secure communication between the server and the target machine, installing a servelet on the target machine, transmitting a secure command to the servelet over the communications network, executing the secure command in the servelet, transmitting data, by the target machine, in response to a servelet instruction, and receiving the data from the target machine over the communication network. It is emphasized that this abstract is provided to comply with the rules requiring an abstract which will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or the meaning of the claims.

Claims

1. In a data communications network including a server, client device, and target device, a method for remotely conducting forensic investigations of the target device, the method comprising:

authenticating the client device;

transmitting a first cryptographic key to the client device;

authenticating the target device;

transmitting a second cryptographic key to the target device;

receiving from the client device over the data communications network, a request for conducting an investigation of the target device, the request including identification of the target device, the request being encrypted via the first cryptographic key;

generating an investigation session key in response to the investigation request;

transmitting the session key to the client device, the session key to the client device being encrypted via the first cryptographic key;

transmitting the session key to the target device, the session key to the target device being encrypted via the second cryptographic key;

receiving an investigation command from the client device, the investigation command being encrypted via the session key; and

forwarding the encrypted investigation command to the target device, wherein the target device transmits to the client device an output responsive to the investigation command, the output being encrypted via the session key.

2. The method of claim 1 further comprising:

securely transmitting to the client device, an address for the target device; and

securely transmitting to the target device, an address for the client device.

3. The method of claim 2,

wherein the address for the client device is encrypted via the first cryptographic key.

4. The method of claim 1, wherein the investigation command is a request to read a portion of a storage device coupled to the target device, and the output is data in the portion of the storage device.

5. The method of claim 1, wherein the authenticating of the client device includes:

transmitting authentication information of the client device; and

verifying identify of the client device by the server.

6. The method of claim 1 further comprising:

transmitting the encrypted investigation command to the server by the client device, wherein the server forwards the encrypted investigation command to the target device.

7. The method of claim 1 further comprising identifying by the client device a port for receiving communication from the target device.

8. The method of claim 1, wherein the session key is a symmetric encryption key.

9. The method of claim 1, wherein the transmitting of the output by the target device to the client device bypasses the server.