Signed call recording
Systems and methods provide the generation of signed recordings of audio and video calls. The signed recordings include information that may be used to verify the integrity of a purported copy of the recording. The recording may be generated by capturing the audio and/or video from a monitored communication and streaming the captured data to a recording. As the captured data is streamed to the media file used for the recording, a hash value is calculated for each segment of the received data. Information describing the context of the communication may be used to generate another hash value. A digital signature for the recorded call may be generated based on the two combined hash values. Operating in this manner, a signed recording of the communication may be generated while a recording of the communication to a media file is being made, rather than by post-call processing of a stored file.
1. A method for generating a signed recording of a communication, the method comprising:
receiving a plurality of data segments that comprise the communication between a resident of a controlled-environment facility and a non-resident of the facility, wherein the data segments comprise received communication data from the resident and from the non-resident, the data segments further comprising:
a data stream including a plurality of channels of media data, wherein a first channel of the plurality of channels of media data is received from a voice call device used by the resident of the controlled-environment facility and wherein a second channel of the plurality of channels of media data is received from a voice call device used by the non-resident of the facility;
computing a segment hash for each of the plurality of data segments;
updating a communication data hash based on each generated segment hash;
saving the plurality of data segments received from the resident and from the non-resident in a first track of a multi-track media file;
generating call context information describing the communication;
computing a call context hash based on the call context information;
generating a digital signature, upon termination of the communication, wherein the digital signature comprises a combination of the communication data hash and the call context information; and
saving the digital signature to a second track of the multi-track media file.
2. The method of claim 1 , wherein the segment hashes are generated using a cryptographic hash function.
3. The method of claim 1 , further comprising: saving the call context information to a third track of the multi-track media file.
4. The method of claim 1 , wherein the communication data hash and the call context hash are combined using an XOR logical operation.
5. The method of claim 1 , wherein the call context information includes one or more of: the point of origin for the communication, the point of termination of a voice call, an identity of the non-resident, an identity of the resident, biometric information identifying the resident, the date of the communication, the time of the communication, the duration of the communication, and security protocols applicable to the communication.
6. The method of claim 1 , wherein the digital signature is further generated by encrypting the combined hash using a private key.
7. A system for generating a signed recording of a communication, the system comprising:
a processor; and
a memory coupled to the processor, the memory storing computer-readable instructions that, upon execution by the processor, cause the system to:
receive a plurality of data segments that comprise the communication between a resident of a controlled-environment facility and a non-resident of the facility, wherein the data segments comprise received communication data from the resident and from the non-resident, the data segments further comprising:
a data stream including a plurality of channels of media data, wherein a first channel of the plurality of channels of media data is received from a communication device used by the resident of the controlled-environment facility and wherein a second channel of the plurality of channels of media data is received from a communication device used by the non-resident of the facility;
compute a segment hash for each of the plurality of data segments;
update a communication data hash based on each generated segment hash;
save the plurality of data segments received from the resident and from the non-resident in a first track of a multi-track media file;
generate call context information describing the communication;
compute a call context hash based on the call context information;
generate a digital signature, upon termination of the communication, wherein the digital signature comprises a combination of the communication data hash and the call context information; and
save the digital signature to a second track of the multi-track media file.
8. The system of claim 7 , wherein the segment hashes are generated using a cryptographic hash function.
9. The system of claim 7 , the memory storing additional computer-readable instructions that, upon execution by the processor, cause the system to: save the call context information to a third track of the multi-track media file.
10. The system of claim 7 , wherein the communication data hash and the call context hash are combined using an XOR logical operation.
11. The system of claim 7 , wherein the call context information includes one or more of: the point of origin for the communication, the point of termination of the communication, an identity of the non-resident, an identity of the resident, biometric information identifying the resident, the date of the communication, the time of the communication, the duration of the communication, and security protocols applicable to the communication.
12. The system of claim 7 , wherein the digital signature is further generated by encrypting the combined hash using a private key.
13. A method for verifying a signed recording of a communication, the method comprising:
receiving a multi-track media file storing the signed recording of the communication between a resident of a controlled-environment facility and a non-resident of the facility in a first track of the multi-track media file, the signed recording comprising data segments from a plurality of channels of media data, wherein a first channel of a plurality of channels of media data is from a voice call device used by the resident of the controlled-environment facility and wherein a second channel of the plurality of channels of the media data is received from a voice call device used by the non-resident of the facility;
computing a first hash based on data stored in the first track of the multi-track media file;
decrypting a digital signature stored in a second track of the multi-track media file;
extracting a communication data hash from the decrypted digital signature;
comparing the computed first hash versus the extracted communication data hash; and
signaling that the multi-track media file includes a signed recording of the communication, if the computed first hash and the extracted communication data hash are equivalent.
14. The method of claim 13 , further comprising:
computing a second hash based on call context information stored in a third track of the multi-track media file;
extracting a call context hash from the decrypted digital signature;
comparing the computed second hash versus the extracted call context hash; and
signaling that the multi-track media file includes a signed copy of the call context information for the communication, if the computed second hash and the extracted call context hash are equivalent.
15. The method of claim 13 , wherein the first hash is computed using the same hash function used to generate the extracted communication data hash.
16. The method of claim 13 , further comprising:
retrieving an archived communication data hash computed during the generation of the signed recording of the communication;
comparing the computed first hash versus the archived communication data hash; and
signaling that the multi-track media file includes a signed recording of the communication, if the computed first hash and the archived communication data hash are equivalent.