Storage and authentication of data transactions

• US 8,200,760 B2
• Filed: 06/19/2003
• Issued: 06/12/2012
• Est. Priority Date: 07/02/2002
• Status: Active Grant

• Current Assignee: The Ascent Group, The Ascent Group, Ltd.
• Original Assignee: The Ascent Group, Ltd.
• Inventors: Jacobs, Michael
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US10/519,827
• Publication Number:
  US 20060143462A1
• Time in Patent Office: 3,281 Days
• Field of Search: 726/3
• US Class Current: 709/206
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

The various aspects of the present invention are based on four main principles: the provision, protection and validation of audit trails relating to data generated by and communicated between nodes of a network; authentication of communicating parties; enforcement of proof of receipt of data communications; and the detection of compromised user identifiers. The object of these principles being that, should a dispute arise over the substance of an authenticated e-mail or other data item, it would be possible to prove, with mathematical precision, the following features of the communication: the content of the message sent; the e-mail location to which the message was addressed; the fact that the message was despatched; the time and date of despatch; the fact that the message was received; the time and date it was received; and the fact that the content of the message had not been changed since it was sent. It is also intended to make it possible to prove the identity of the sender and the identity of the recipient.

Claims

1. A computer-implemented method of authenticating data and providing a dated audit trail, said method comprising:

(a) storing copies of a plurality of data items at a first location;

(b) generating a first data file at the end of a predetermined dated audit period, the first data file comprising a respective hash value of each said plurality of stored data items;

(c) generating a single hash value of said first data file, the single hash value corresponding to said predetermined dated audit period;

(d) transmitting said single hash value to a second location remote from said first location, via an information technology communications network;

(e) creating at said remote location a second data file for said predetermined dated audit period, said second data file comprising said single hash value and one or more additional data items relating to said single hash value;

(f) generating a hash value for said second data file, said hash value for said second data file corresponding to said predetermined dated audit period;

(g) publishing said hash value for said second data file in a dated journal of record published in numerous copies and held in separate public libraries, wherein the published hash value for said second data file corresponds to said predetermined dated audit period;

(h) at a date subsequent to the publishing of (g), generating a hash value for said second data file; and

(i) comparing the hash value for the second data file generated in (h) with the hash value for said second data file published in said dated journal, whereby if the hash value generated in step (h) is identical to the hash value published in said dated journal said second data file is authenticated.

2. A computer-implemented method according to claim 1, wherein:

said first data file contains at least one identifier selected from the group consisting of a file name, a path name, a file size and a time stamp.

3. A computer-implemented method according to claim 1, wherein:

least one of said first data items comprises a message to be transmitted from a sender to a receiver.

4. A computer-implemented method according to claim 3, further comprising:

the sender generating a first hash value of said message;

the sender encrypting said message with a first secret key and producing a second hash value from said encrypted message;

the sender encrypting said first secret key with a second secret key;

the sender transmitting to the receiver said encrypted message, said encrypted first secret key and said first hash value;

the sender transmitting said second hash value and said second secret key to a third party;

the third party storing the transmitted second hash value and second secret key for audit purposes;

the receiver receiving said encrypted message and generating a purported copy of said second hash value of said encrypted message;

the receiver transmitting the purported copy of said second hash value to the third party;

the third party determining whether the purported copy matches said second hash value; and

the third party then releasing said second key if a match is so determined.

5. A computer-implemented method according to claim 4, wherein:

the first secret key is symmetric and the second secret key is asymmetric.

6. A computer-implemented method according to claim 1, wherein:

said first location is a predetermined audit location that stores data items supplied thereto over the predetermined dated audit period, and the first data file generated in (a) comprises respective hash values of the data items stored in said predetermined audit location at the end of the predetermined dated audit period.