Verifying captured objects before presentation

• US 8,271,794 B2
• Filed: 07/01/2010
• Issued: 09/18/2012
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Lowe, Rick, Coleman, Shaun, de la Iglesia, Erik, King, Samuel, Khasgiwala, Ashish
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): GUIRGUIS, MICHAEL M
• Application Number:
  US12/829,220
• Publication Number:
  US 20100268959A1
• Time in Patent Office: 810 Days
• Field of Search: 713/176, 726/23
• US Class Current: 713/176
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Objects can be extracted from data flows captured by a capture device. Each captured object can then be classified according to content. Meta-data about captured objects can be stored in a tag. In one embodiment, the present invention includes receiving a request to present a previously captured object to a user, accessing a tag associated with the requested object, the tag containing metadata related to the object, the metadata including an object signature, and verifying that the object has not been altered since capture using the object signature before presenting the object to the user.

Claims

1. A method, comprising:

receiving a request to present a previously captured object to a user, wherein the captured object was intercepted by a capture system configured to intercept packets from data streams, and store network transmitted objects from the data streams according to a capture rule that defines which objects are to be captured by the capture system;

accessing a tag associated with the object being requested, the tag containing metadata related to the object, wherein the metadata includes an object signature;

verifying the tag has not been altered using a tag signature, wherein the tag signature is generated using at least a portion of the metadata, wherein the portion of the metadata used to generate the tag signature contains the object signature;

verifying that the object has not been altered since capture using the object signature in the tag associated with the object; and

presenting the object if the object and the tag are verified, and wherein if either the object or the tag is not verified, then an alert is generated to indicate whether the object or the tag has been compromised.

2. The method of claim 1, wherein the tag includes the tag signature, and wherein the tag is verified using a hash, which is decrypted with a public key of the capture system.

3. The method of claim 2, wherein the tag signature comprises a cryptographically secure signature.

4. The method of claim 3, wherein the tag signature is signed using a private key of the capture system, the private key being part of a public key cryptosystem.

5. The method of claim 1, wherein presenting the object to the user includes an option for the user to download the object.

6. The method of claim 1, wherein the capture system is configured to store a document captured by the capture system according to the capture rule, which identifies a particular internet protocol (IP) address from which the document was sent.

7. The method of claim 1, wherein verifying that the object has not been altered since capture comprises calculating a new object signature for the object, and comparing the new object signature with the object signature in the tag associated with the object.

8. A capture system, comprising:

a memory element and a processor, the capture system being configured for;

receiving a request to present a previously captured object to a user, wherein the captured object was intercepted by the capture system configured to intercept packets from data streams, and store network transmitted objects from the data streams according to a capture rule that defines which objects are to be captured by the capture system;

accessing a tag associated with the object being requested, the tag containing metadata related to the object, wherein the metadata includes an object signature;

verifying the tag has not been altered using a tag signature, wherein the tag signature is generated using at least a portion of the metadata, wherein the portion of the metadata used to generate the tag signature contains the object signature;

verifying that the object has not been altered since capture using the object signature in the tag associated with the object; and

presenting the object if the object and the tag are verified, and wherein if either the object or the tag is not verified, then an alert is generated to indicate whether the object or the tag has been compromised.

9. The logic of claim 8, wherein the tag includes the tag signature, and wherein the tag is verified using a hash, which is decrypted with a public key of the capture system.

10. The logic of claim 9, wherein the tag signature comprises a cryptographically secure signature.

11. The logic of claim 10, wherein the tag signature is signed using a private key of the capture system, the private key being part of a public key cryptosystem.

12. The logic of claim 8, wherein presenting the object to the user includes an option for the user to download the object.

13. The logic of claim 8, wherein verifying that the object has not been altered since capture comprises calculating a new object signature for the object, and comparing the new object signature with the object signature in the tag associated with the object.

14. Logic encoded in one or more non-transitory tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

receiving a request to present a previously captured object to a user, wherein the captured object was intercepted by a capture system configured to intercept packets from data streams, and store network transmitted objects from the data streams according to a capture rule that defines which objects are to be captured by the capture system;

accessing a tag associated with the object being requested, the tag containing metadata related to the object, wherein the metadata includes an object signature;

verifying the tag has not been altered using a tag signature, wherein the tag signature is generated using at least a portion of the metadata, wherein the portion of the metadata used to generate the tag signature contains the object signature;

verifying that the object has not been altered since capture using the object signature in the tag associated with the object; and

presenting the object if the object and the tag are verified, and wherein if either the object or the tag is not verified, then an alert is generated to indicate whether the object or the tag has been compromised.

15. The logic of claim 14, wherein the tag includes the tag signature, and wherein the tag is verified using a hash, which is decrypted with a public key of the capture system.

16. The logic of claim 15, wherein the tag signature comprises a cryptographically secure signature, and wherein the tag signature is signed using a private key of the capture system, the private key being part of a public key cryptosystem.

17. The logic of claim 14, wherein presenting the object to the user includes an option for the user to download the object.