System, method and computer program product for guaranteeing electronic transactions

• US 6,874,089 B2
• Filed: 08/09/2002
• Issued: 03/29/2005
• Est. Priority Date: 02/25/2002
• Status: Expired due to Term

• Current Assignee: Chemtron Research LLC (Intellectual Ventures LLC)
• Original Assignee: Network Resonance Incorporated
• Inventors: Dick, Kevin Stewart, Rescorla, Eric Kenneth
• Primary Examiner(s): Morse, Gregory A.
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US10/215,768
• Publication Number:
  US 20030163704A1
• Time in Patent Office: 963 Days
• Field of Search: 713/178, 713/155, 713200-202, 380/229, 380/278, 380/286, 380/37, 707/10
• US Class Current: 726/14
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A system, method and computer program product for guaranteeing a data transaction over a network are disclosed. When a data transaction between at least a server and a client is detected on a network, data transmitted via the network between the server and client during the data transaction is captured. At least one identifier is associated with the captured data. A timestamp is also generated for the captured data. The timestamp includes information therein identifying at least a portion of the identifier(s). The captured data, the identifier(s) and the timestamp are stored in one or more data stores. The identifier(s) associated with the stored captured data is also mapped to an entry in an index to permit retrieval of the stored data from the data store via the index.

Claims

1. A method, comprising:

detecting on a network an initiation of a data transaction between at least a server and a client, the data transaction comprising a plurality of data packets transmitted between the server and the client;

capturing a copy of the data transaction by copying the data packets as the data packets are transmitted through the network between the server and the client;

associating at least one identifier with the data transaction;

generating timestamps for the copied data packets, wherein each timestamp includes information therein identifying at least a portion of the at least one identifiers;

storing the captured copy of the data transaction, the at least one identifier and the timestamps in one or more data stores;

mapping the at least one identifier associated with the stored captured copy of the data transaction to an entry in an index to permit retrieval of the stored copy of the data transaction and the timestamps from the data store via the index;

wherein the data transaction is encrypted by utilizing a session secret negotiated between the server and the client; and

retrieving the captured copy of the data transaction from the data store utilizing the entry in the index;

submitting a portion of the captured copy of the data transaction to the server or client to obtain at least the session secret from the server or client; and

decrypting the captured copy of the data transaction utilizing the obtained session secret.

2. The method of claim 1, further comprising comparing the data received by the server or the client during the data transaction with data contained in the decrypted captured copy of the data transaction to determine if data received by the server or the client matches the data contained in the decrypted captured copy of the data transaction.

3. The method of claim 1, wherein the portion of the transaction containing at least the negotiation of the session secret is presented for revelation to at least one of the server and the client.

4. The method of claim 3, wherein the revelation of the session secret is added to a secure audit trail before revelation.

5. The method of claim 4, wherein the session secret is re-encrypted for a trusted mediator which securely logs revelation before revealing the session secret to a replaying entity.

6. The method of claim 5, wherein the trusted mediator authenticates a challenge provided by the server or the client and in which this server or the client verifies that authenticator before revealing the session secret.

7. The method of claim 6, wherein the trusted mediator reduces the session secret into traffic keys before revealing these traffic keys to the replaying entity.

8. The method of claim 1, wherein the captured copy of the data transaction and the at least one identifier are stored in a first data store and the timestamps are stored in a second data store.

9. The method of claim 1, wherein the network includes a wireless network.

10. The method of claim 1, wherein the data transmitted during the data transaction is encrypted by the server and client utilizing at least one of a secure sockets layer protocol and a transport layer security protocol.

11. The method of claim 1, wherein the timestamps are generated utilizing a remote time source coupled to the network.

12. The method of claim 1, wherein a first device coupled to the network captures the copy of the data transaction and associates the at least one identifier to the captured copy of the data transaction, wherein a second device coupled to the network generates the timestamps for the captured copy of the data transaction;

and wherein the second device transmits the timestamps to the first device via the network.

13. The method of claim 1, wherein each timestamp includes a digital signature.

14. The method of claim 1, wherein the copied data packets are hashed, and wherein the hashes of the copied data packets are stored instead of the captured copy of the data transaction.

15. The method of claim 14, wherein the hashes are compared to hashes of versions of the data packets for the same data transaction captured at another location between the server and client to verify at least one of:

the authenticity of the captured copy of the data transaction and the integrity of the captured copy of the data transaction.

16. A system, comprising:

logic for detecting on a network an initiation of a data transaction between at least a server and a client, the data transaction comprising a plurality of data packets transmitted between the server and the client;

logic for capturing a copy of the data transaction by copying the data packets as the data packets are transmitted through the network between the server and the client;

logic for associating at least one identifier with the data transaction;

logic for generating timestamps for the copied data packets, wherein each timestamp includes information therein identifying at least a portion of the at least one identifiers;

logic for storing the captured copy of the data transaction, the at least one identifier and the timestamps in one or more data stores;

logic for mapping the at least one identifier associated with the stored captured copy of the data transaction to an entry in an index to permit retrieval of the stored copy of the data transaction and the timestamps from the data store via the index;

wherein the data transaction is encrypted utilizing a session secret negotiated between the server and the client; and

logic for retrieving the captured copy of the data transaction from the data store utilizing the entry in the index;

logic for submitting a portion of the captured copy of the data transaction to the server or the client to obtain at least the session secret from the server or the client; and

logic for decrypting the captured copy of the data transaction utilizing the obtained session secret.

17. The system of claim 16, further comprising logic for comparing the data received by the server or client during the data transaction with the data contained in the decrypted captured copy of the data transaction to determine if data received by the server or client matches the data contained in the decrypted captured copy of the data transaction.

18. The system of claim 16, wherein the portion of the transaction containing at least the negotiation of the session secret is presented for revelation to at least one of the server and the client.

19. The system of claim 18, wherein the revelation of the session secret is added to a secure audit trail before revelation.

20. The system of claim 19, wherein the session secret is re-encrypted for a trusted mediator which securely logs revelation before revealing the encrypted keying material to a replaying entity.

21. The system of claim 20, wherein the trusted mediator authenticates a challenge provided by the replaying server or client and in which this replaying server or client verifies that authenticator before revealing the session secret.

22. The system of claim 21, wherein the trusted mediator reduces the session secret into traffic keys before revealing these traffic keys to the replaying entity.

23. The system of claim 16, wherein the captured copy of the data transaction and the at least one identifier are stored in a first data store and the timestamps are stored in a second data store.

24. The system of claim 16, wherein the data transmitted during the data transaction is encrypted by the server and client utilizing at least one of a secure sockets layer protocol and a transport layer security protocol.

25. The system of claim 16, wherein the logic for capturing the copy of the data transaction and associating the at least one identifier to the captured copy of the data transaction are located in a first device coupled to the network, wherein the logic for generating the timestamps for the captured copy of the data transaction is located in a second device coupled to the network;

and wherein the second device transmits the timestamps to the first device via the network.

26. The system of claim 16, wherein each timestamp includes a digital signature.

27. The method of claim 16, wherein the copied data packets are hashed, and wherein the hashes of the copied data packets are stored instead of the captured copy of the data transaction.

28. The method of claim 27, wherein the hashes are compared to a hashes of versions of the data packets for the same data transaction captured at another location between the server and client to verify at least one of:

the authenticity of the captured copy of the data transaction and the integrity of the captured copy of the data transaction.

29. A computer program product, comprising:

computer code for detecting on a network an initiation of a data transaction between at least a server and a client, the data transaction comprising a plurality of data packets transmitted between the server and the client;

computer code for capturing a copy of the data transaction by copying the data packets as the data packets are transmitted through the network between the server and client;

computer code for associating at least one identifier with the data transaction;

computer code for generating timestamps for the copied data packets, wherein each timestamp includes information therein identifying at least a portion of the at least one identifiers;

computer code for storing the captured copy of the data transaction, the at least one identifier and the timestamps in one or more data store;

computer code for mapping the at least one identifier associated with the stored captured copy of the data transaction to an entry in an index to permit retrieval of the stored copy of the data transaction and the timestamps from the data store via the index; and

wherein the data transaction is encrypted by utilizing a session secret negotiated between the server and client;

wherein the captured copy of the data transaction is retrieved from the data store utilizing the entry in the index;

wherein a portion of the captured copy of the data transaction is submitted to the server or client to obtain at least the session secret from the server or client;

wherein the captured copy of the data transaction is decrypted utilizing the obtained session secret; and

wherein the data received by the server or client during the data transaction is compared with the decrypted captured copy of the data transaction to determine if data received by the server or client matches the decrypted captured copy of the data transaction.

30. A method, comprising:

a) detecting on a network an initiation of a data transaction between at least a server and a client, the data transaction comprising a plurality of data packets transmitted between the server and the client, wherein the data transaction is encrypted by utilizing a session secret negotiated between the server and the client, wherein the data transmitted during the data transaction is encrypted by the server and client utilizing at least one of a secure sockets layer protocol and a transport layer security protocol;

b) capturing a copy of the data transaction by copying the data packets as the data packets are transmitted through the network between the server and the client;

c) associating at least one identifier with the data transaction;

d) generating timestamps for the copied data packets, wherein each timestamp includes information therein identifying at least a portion of the at least one identifiers, wherein the timestamps are generated utilizing a remote time source coupled to the network, wherein the timestamp includes a digital signature;

e) storing the captured copy of the data transaction, the at least one identifier and the timestamps in one or more data stores;

f) mapping the at least one identifier associated with the stored captured copy of the data transaction to an entry in an index to permit retrieval of the stored copy of the data transaction and the timestamps from the data store via the index;

g) retrieving the captured copy of the data transaction from the data store utilizing the entry in the index;

submitting a portion of the captured copy of the data transaction to the server or client to obtain at least the session secret from the server or client; and

decrypting the captured copy of the data transaction utilizing the obtained session secret, wherein the portion of the transaction containing at least the negotiation of the session secret is presented for revelation to at least one of the server and the client, wherein the revelation of the session secret is added to a secure audit trail before revelation, wherein the session secret is re-encrypted for a trusted mediator which securely logs revelation before revealing the session secret to a replaying entity, wherein the trusted mediator authenticates a challenge provided by the server or the client and in which this server or the client verifies that authenticator before revealing the session secret, wherein the trusted mediator reduces the session secret into traffic keys before revealing these traffic keys to the replaying entity; and

h) comparing the data received by the server or the client during the data transaction with data contained in the decrypted captured copy of the data transaction to determine if data received by the server or the client matches the data contained in the decrypted captured copy of the data transaction.