Enterprise computer investigation system

• US 20050097366A1
• Filed: 09/08/2004
• Published: 05/05/2005
• Est. Priority Date: 06/20/2002
• Status: Active Grant

• Current Assignee: Dominik Weber, Matthew Garrett, Shawn McCreight
• Original Assignee: Guidance Software Incorporated (Open Text Corporation)
• Inventors: McCreight, Shawn, Garrett, Matthew, Weber, Dominik
• Granted Patent: US 7,900,044 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A method, apparatus and system for secure forensic investigation of a target machine by a client machine over a communications network. In one aspect the method comprises establishing secure communication with a server over a communications network, establishing secure communication with the target machine over the communications network, wherein establishing secure communication with the target machine includes establishing secure communication between the server and the target machine, installing a servelet on the target machine, transmitting a secure command to the servelet over the communications network, executing the secure command in the servelet, transmitting data, by the target machine, in response to a servelet instruction, and receiving the data from the target machine over the communication network. It is emphasized that this abstract is provided to comply with the rules requiring an abstract which will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or the meaning of the claims.

Claims

1. A method of examining a storage device coupled to a target machine in a communications network the method comprising:

installing a servelet on the target machine;

commanding the servelet over the communications network to retrieve data from the storage device;

using the servelet to retrieve data from the storage device;

receiving data from the servelet over the communications network; and

storing the retrieved data on a client machine.

2. A method for secure forensic investigation over a communications network the method comprising:

receiving an authentication key from a vendor;

authenticating the received authentication key;

receiving a second authentication key from the vendor; and

transmitting the second authentication key to a target machine.

3. The method of claim 2, wherein the authentication key is generated by a keymaster, and wherein authenticating the received authentication key comprises:

generating a third authentication key;

generating a first authentication package, the first authentication package including the third authentication key;

transmitting the first authentication package to the vendor;

receiving a second authentication package from the vendor, the second authentication package including the first authentication package and the authentication key;

accessing the third authentication key from the second encryption package; and

verifying the accessed third authentication key.

4. The method of claim 2, wherein the target machine verifies the second authentication key.

5. The method of claim 3, further comprising:

encrypting the third authentication key with an encryption key;

storing the encrypted third authentication key; and

archiving the third authentication key on a storage device.

6. The method of claim 3, wherein the third authentication key is a machine specific, symmetric encryption key.

7. The method of claim 2, wherein verifying the accessed third authentication key comprising:

regenerating the third authentication key; and

comparing the regenerated third authentication key to the accessed third authentication key.

8. A system for secure forensic investigation over a communications network comprising:

a keymaster;

a vendor coupled to the keymaster over the communications network, wherein the vendor receives a first authentication key from the keymaster; and

a server coupled to the vendor over the communications network, wherein the server receives the first authentication key from the vendor, wherein the server authenticates the first authentication key.

9. The system of claim 8, further comprising a target machine coupled to the server of the communications network;

and

wherein the server transmits a second authentication key to the vendor, wherein the vendor signs the second authentication key, wherein the vendor transmits the signed second authentication key to the server, and wherein the server transmits the signed second authentication key to the target machine, and wherein the target machine verifies the signed second authentication key.

10. The system of claim 8, wherein the server is configured to generate a second authentication key, wherein the second authentication key is a machine specific, symmetric encryption key, and wherein the server is further configured to transmit the second authentication key to the vendor, receive the second authentication key from the vendor, and verify the received second authentication key.

11. The system of claim 10, wherein the server is further configured to regenerate the second authentication key and compare the regenerated second authentication key to the received second authentication key.

12. An apparatus for secure forensic investigation over a communications network the apparatus comprising:

a network coupling configured to communicate using the communications network;

a processor coupled to the network coupling, the processor configured to receive an authentication key from a vendor, authenticate the received authentication key, receive a second authentication key from the vendor; and

transmit the second authentication key to a target machine.

13. The apparatus of claim 12, wherein the authentication key is generated by a keymaster, and wherein to authenticate the received authentication key the processor is further configured to:

generate a third authentication key;

generate a first authentication package, the first authentication package including the third authentication key;

transmit the first authentication package to the vendor;

receive a second authentication package from the vendor, the second authentication package including the first authentication token and the authentication key;

access the third authentication key from the second encryption package; and

verify the accessed third authentication key.

14. The apparatus of claim 12, wherein the second authentication key is configured for authentication by the target machine.

15. The apparatus of claim 13, wherein the processor is further configured to:

encrypt the third authentication key with an encryption key;

store the encrypted third authentication key; and

archiving the third authentication key on a storage device.

16. The apparatus of claim 13, wherein the third authentication key is a machine specific, symmetric encryption key.

17. The apparatus of claim 12, wherein to verify the accessed third authentication key, the processor is further configure to:

regenerate the third authentication key; and

compare the regenerated third authentication key to the accessed third authentication key.

18. The apparatus of claim 13, wherein the third authentication key is generated, at least in part, using a hardware configuration.