System and method for generating a non-repudiatable record of a data stream
View Patent ↗A system and method for generating a non-repudiatable record of a communications data stream is provided, which is applicable to real-time and quasi-real-time data streams. A binary communication data stream is captured and segmented into defined frames. A key frame is generated for each of a number of data frames containing integrity and authentication information. The key frame is inserted into the data stream to provide an authenticated data stream.
1. A method for generating an authenticated record of an active communication session, the active communication session comprising a continuously updating data stream, the method comprising:
receiving a data signal representing authentication information associated with the active communication session;
storing an authenticated data stream representing the authenticated record of the active communication session at least partly by:
segmenting a copy of the continuously updating data stream into a plurality of defined frames, each defined frame associated with a frame sequence identifier;
grouping the plurality of defined frames into respective frame groups, each frame group comprising a predetermined number of frames and a frame group sequence identifier, the respective frames of each frame group being associated with sequential frame sequence identifiers;
for each frame group, generating an associated frame group key frame comprising data integrity information based at least partly on the respective frame group, and the authentication information associated with the communication session;
appending each frame group and associated frame group key frame to the authenticated data stream ordered at least partly by the respective sequential frame group sequence identifier; and
repeating the segmenting, grouping, generating, and appending for authenticating further frame groups of the continuously updating data stream.
2. The method of claim 1 , wherein the communication session is a real-time or quasi-real-time communication session.
3. The method of claim 1 , wherein each frame group key frame comprises an identification block, a data integrity block and a signature block.
4. The method of claim 3 , wherein the identification block comprises any one or more of date, time and location information for the communication session.
5. The method of claim 3 , wherein the data integrity block comprises data generated for each frame by any one or more of:
a bit position mask;
a least significant bit position in each frame;
a most significant bit position in each frame;
a Secure Hash Algorithm (SHA); and
a checksum.
6. The method of claim 3 , wherein the signature block comprises a unique digital signature of at least one party to the communication session.
7. The method of claim 1 wherein the communication session is carried out between two or more parties.
8. The method of claim 1 further comprising encrypting the plurality of defined frames.
9. The method of claim 1 further comprising storing the authenticated data stream at a data repository.
10. The method of claim 1 , wherein the copy of the continuously updating data stream is created by a public switched telephone network (PSTN), and the receiving is performed via the PSTN.
11. The method of claim 10 , wherein the copy of the continuously updating data stream is created by copying pulse code modulation (PCM) data from time division multiplex (TDM) frames.
12. The method of claim 1 wherein the segmenting, grouping, generating, and appending for authenticating further frame groups of the continuously updating data stream are repeated when the continuously updating data stream is updated by a predetermined number “m” of definable frames.
13. A system for generating an authenticated record of an active communication session in a network, the active communication session comprising a continuously updating data stream, the system comprising:
a processor for implementing an authentication module network node configured to produce an authenticated data stream representing the authenticated record of the active communication session at least partly by:
segmenting a copy of the continuously updating data stream into a plurality of defined frames, each defined frame associated with a frame sequence identifier;
grouping the plurality of defined frames into respective frame groups, each frame group comprising a predetermined number of frames and a frame group sequence identifier, the respective frames of each frame group being associated with sequential frame sequence identifiers;
for each frame group, generating an associated frame group key frame comprising data integrity information based at least partly on the respective frame group, and authentication information associated with the communication session;
appending each frame group and associated frame group key frame to the authenticated data stream ordered at least partly by the respective sequential frame group sequence identifier; and
repeating the segmenting, grouping, generating, and appending for authenticating further frame groups of the continuously updating data stream.
14. The system of claim 13 wherein the communication session is a real-time or quasi-real-time communication session.
15. The system of claim 13 wherein each frame group key frame comprises an identification block, a data integrity block and a signature block.
16. The system of claim 15 further comprising a processor for implementing a trust module adapted to generate a respective digital signature for at least one party involved in the communication session for the signature block.
17. The system of claim 13 further comprising a processor for implementing a security module for encrypting at least the plurality of defined frames.
18. The system of claim 13 wherein the data integrity information comprises any one or more of:
a bit position mask;
a least significant bit position for each frame;
a most significant bit position for each frame;
a Secure Hash Algorithm (SHA); and
a checksum.
19. The system of claim 13 wherein the copy of the continuously updating data stream is created at a node of the public switched telephone network (PSTN).
20. The system of claim 19 wherein the copy of the continuously updating data stream is generated by copying pulse code modulation (PCM) data from time division multiplex (TDM) frames.
21. The system of claim 13 wherein authentication module is implemented in a node of a broadband data network, and the copy of the continuously updating data stream is encapsulated for transport through the broadband data network to the authentication module.
22. The system of claim 13 wherein the copy of the continuously updating data stream is generated at a node of a broadband data network by copying Protocol Data Units (PDUs) associated with voice data.
23. The system of claim 22 wherein the broadband data network is either one of an Internet Protocol (IP) network and an Asynchronous Transfer Mode (ATM) network.
24. The system of claim 13 wherein the segmenting, grouping, generating, and appending for authenticating further frame groups of the continuously updating data stream are repeated when the continuously updating data stream is updated by a predetermined number “m” of definable frames.