System and method for generating a non-repudiatable record of a data stream
View Patent ↗A system and method for generating a non-repudiatable record of a communications data stream is provided, which is applicable to real-time and quasi-real-time data streams. A binary communication data stream is captured and segmented into defined frames. A key frame is generated for each of a number of data frames containing integrity and authentication information. The key frame is inserted into the data stream to provide an authenticated data stream.
1. A method, in a public switched telephone network (PSTN), for generating an authenticated record of a communications data stream comprising:
receiving, via the PSTN, a data signal representing authentication information associated with the communications data stream;
capturing, at a node of the PSTN, a data signal representing the communications data stream;
segmenting the data stream into defined frames;
for each m frames, generating a key frame containing integrity information associated with said m frames, and authentication information associated with the communications data stream;
inserting said key frame as an m+1th frame into the segmented data stream after m frames of the data stream; and
generating a data signal representing the authenticated record of the communications data stream, the authenticated record including the communications data stream and the key frame;
wherein the communications data stream is generated by copying pulse code modulation (PCM) data from time division multiplex (TDM) frames.
2. The method of claim 1 , wherein the communications data stream is a real-time or quasi-real-time data stream.
3. The method of claim 1 , wherein the key frame comprises an identification block, an integrity block and a signature block.
4. The method of claim 3 , wherein the identification block comprises any one or more of date, time and location information for a communication session represented by the communications data stream.
5. The method of claim 3 , wherein the data integrity block comprises data generated for each frame by any one or more of:
a bit position mask;
a least significant bit position in each frame;
a most significant bit position in each frame;
a Secure Hash Algorithm (SHA); and
a checksum.
6. The method of claim 3 , wherein the signature block comprises a unique digital signature of at least one party to the communications data stream.
7. The method of claim 1 wherein the communications data stream is between two or more parties.
8. The method of claim 1 further comprising a step of encrypting the segmented data stream.
9. The method of claim 1 further comprising the step of storing the authenticated record of the communications data stream at a data repository.
10. A system for generating an authenticated record of a communication data stream in a network, the system comprising:
a network hardware element for capturing a communications data stream, the network hardware element comprising a node of a public switched telephone network (PSTN); and
an authentication module adapted to:
segment the communications data stream into m frames of predetermined length;
generate a key frame including respective authentication and data integrity information in respect of each frame of the segmented data stream; and
insert the key frame as the m+1th frame into to the segmented data stream;
wherein the communications data stream is generated by copying pulse code modulation (PCM) data from time division multiplex (TDM) frames.
11. The system of claim 10 wherein the communications data stream is a real-time or quasi-real-time data stream.
12. The system of claim 10 wherein the key frame comprises an identification block, an integrity block and a signature block.
13. The system of claim 12 further comprising a trust module adapted to generate a respective digital signature for at least one party involved in the communications data stream for the signature block.
14. The system of claim 10 further comprising a security module for encrypting at least the segmented data stream.
15. The system of claim 10 wherein the data integrity information comprises any one or more of:
a bit position mask;
a least significant bit position for each frame;
a most significant bit position for each frame;
a Secure Hash Algorithm (SHA); and
a checksum.
16. The system of claim 10 wherein authentication module is implemented in a node of a broadband data network, and the network element is further adapted to encapsulate the communications data stream for transport through the broadband data network to the authentication module.
17. The system of claim 10 wherein the network element comprises a node of a broadband data network, and the communications data stream is generated by copying Protocol Data Units (PDUs) associated with the communications data stream.
18. The system of claim 17 wherein the broadband data network is either one of an Internet Protocol (IP) network and an Asynchronous Transfer Mode (ATM) network.