Patent ID: 7853795

Claim:
A method, comprising: deploying a recorder on a boundary between an external network and an internal network to detect an initiation of an encrypted data transaction between at least a server and a client across the boundary, the data transaction comprising a plurality of data packets transmitted between the server and the client, the data transaction being encrypted utilizing a session secret negotiated between the server and the client; capturing a copy of the data transaction by copying the data packets using the recorder as the data packets are transmitted through the network between the server and the client, wherein the copied data packets are hashed as hash-time pairs; associating, utilizing the recorder, at least one identifier with the data transaction; generating timestamps for the copied data packets utilizing the recorder, wherein each timestamp includes information therein identifying at least a portion of the at least one identifiers, wherein each timestamp includes a digital signature, wherein the generating of timestamps adapts to a plurality of loads, wherein during a first of the loads, each hash-time pair is signed with a digital signature, wherein during a second of the loads a plurality of hash-time pairs are signed with a single digital signature, the second of the loads being heavier than the first of the loads; storing the captured copy of the data transaction, the at least one identifier and the timestamps in one or more data stores coupled to the recorder; mapping the at least one identifier associated with the stored captured copy of the data transaction to an entry in an index to permit retrieval of the stored copy of the data transaction and the timestamps from the data store via the index; receiving from the client, a dispute concerning the contents of the data transaction; authenticating the client; if the client is authenticated, retrieving the captured copy of the data transaction from the data store utilizing the entry; submitting a portion of the captured copy of the data transaction to at least one of the server and the client to obtain the session secret; decrypting the captured copy of the data transaction utilizing the obtained session secret; and comparing data received by at least one of the server and the client during the data transaction with data contained in the decrypted captured copy of the data transaction to determine if the received data matches the captured data to thereby resolve the dispute concerning the contents of the data transaction.