Detecting potential legal decryption of historical data

• US 9,742,813 B2
• Filed: 11/24/2015
• Issued: 08/22/2017
• Est. Priority Date: 11/24/2015
• Status: Active Grant

• Current Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Antipa, Damien, Sanso, Antonio
• Primary Examiner(s): Paliwal, Yogesh
• Application Number:
  US14/950,694
• Publication Number:
  US 20170149841A1
• Time in Patent Office: 637 Days
• Field of Search: 713164
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content

Abstract

Systems and methods provide for detecting the potential legal decryption of transmitted data. When a device connects to a server over a network, such as the Internet, the device determines whether a cipher without forward secrecy is used. If so, information regarding the connection is stored in a log. When the device subsequently connects to the server and receives a response code indicating that a resource is not available for legal reasons, the device checks the log to determine if the device has previously communicated with the server using a cipher without forward secrecy. Based on the check, the previous connection with the server is identified from the log. A message is presented indicating that data from the previous connection could be subject to legal decryption.

Claims

1. A computer-implemented method for detecting potential legal decryption of previously transmitted data, the method comprising:

receiving, at a client device, a response code from a server indicating that a resource is unavailable for legal reasons during a current connection with the server;

responsive to receiving the response code from the server, checking a log to determine if the client device has previously communicated with the server;

identifying, from the log, a previous connection with the server using a cipher without forward secrecy; and

presenting a message indicating that data from the previous connection could be subject to legal decryption.

2. The method of claim 1, wherein the response code comprises a 451 response code.

3. The method of claim 1, wherein the message includes information from the log regarding the previous connection with the server.

4. The method of claim 3, wherein the information regarding the previous connection comprises at least one selected from the following:

a date of the previous connection;

a time of the previous connection;

an identification of the server; and

an indication of the cipher used by the previous connection.

5. The method of claim 1, wherein the method further comprises:

during the previous connection, determining that the connection is using the cipher without forward secrecy;

responsive to determining the connection is using the cipher without forward secrecy, storing information in the log regarding the previous connection with the server.

6. The method of claim 1, wherein checking the log to determine if the client device has previously communicated with the server comprises:

identifying a server identifier for the server from the current connection; and

determining if any entry in the log includes the server identifier.

7. The method of claim 6, wherein identifying, from the log, the previous connection with the server using the cipher without forward secrecy comprises:

identifying an entry in the log that includes the server identifier.

8. The method of claim 6, wherein the server identifier comprises a domain name.

9. One or more computer storage media storing computer-useable instructions that, when executed by a computing device, causes the computing device to perform operations, the operations comprising:

determining a first connection with a server uses a cipher without forward secrecy;

responsive to determining the first connection uses the cipher without forward secrecy, logging information regarding the first connection with the server;

during a subsequent connection with the server, receiving a response code from the server indicating that a resource is unavailable for legal reasons;

responsive to receiving the response code from the server, retrieving at least a portion of the information regarding the first connection with the server; and

presenting a message providing the at least a portion of the information regarding the first connection.

10. The one or more computer storage media of claim 9, wherein the message indicates that data transmitted during the first connection could be subject to legal decryption.

11. The one or more computer storage media of claim 9, wherein the response code comprises a 451 response code.

12. The one or more computer storage media of claim 10, wherein the information regarding the first connection with the server comprises at least one selected from the following:

a date of the first connection;

a time of the first connection;

an identification of the server; and

an indication of the cipher used by the first connection.

13. The one or more computer storage media of claim 10, wherein retrieving at least the portion of the information regarding the first connection with the server comprises:

identifying a server identifier for the server from the subsequent connection; and

identifying an entry in a log that includes the server identifier and the information regarding the first connection with the server.

14. The one or more computer storage media of claim 13, wherein the server identifier comprises a domain name.

15. A computer system comprising:

one or more processors; and

one or more computer storage media storing computer useable instructions to cause the one or more processors to;

determine a first connection with a server uses a cipher without forward secrecy;

responsive to determining the first connection uses the cipher without forward secrecy, log information regarding the first connection with the server;

during a subsequent connection with the server, receive a response code from the server indicating that a resource is unavailable for legal reasons;

responsive to receiving the response code from the server, check a log to determine if the client device has previously communicated with the server;

identify, from the log, information regarding the first connection with the server; and

present a message indicating that data from the first connection could be subject to legal decryption.

16. The system of claim 15, wherein the response code comprises a 451 response code.

17. The system of claim 15, wherein the information regarding the first connection with the server comprises at least one selected from the following:

a date of the first connection;

a time of the first connection;

an identification of the server; and

an indication of the cipher used by the first connection.

18. The system of claim 15, wherein the log is checked to determine if the client device has previously communicated with the server by:

identifying a server identifier for the server from the subsequent connection; and

querying the log with the server identifier to identify any entry in the log that includes the server identifier.

19. The system of claim 18, wherein information regarding the first connection with the server is identified from the log by identifying an entry in the log that includes the server identifier.

20. The system of claim 19, wherein the server identifier comprises a domain name.