Patent ID: 8799447

Claim:
A method implemented by a computer for capturing non-forgeable packet traces, the method comprising: the computer, responsive to a start-up of a sniffer, obtaining a first quote of values in one or more platform configuration registers in a trusted platform module utilized by the sniffer, wherein the first quote comprises a list of starting values in the one or more platform configuration registers, and wherein the first quote is signed by the trusted platform module and stored in a packet log; the computer, responsive to intercepting a packet of interest at the sniffer, obtaining a hash of the packet of interest; the computer instructing the trusted platform module to extend a platform configuration register with the hash of the packet of interest by appending the hash of the packet of interest with the hash of the current value of the platform configuration register; the extended value then rehashed to form a composite hash value for the platform configuration register; the computer storing the packet of interest in the packet log; and the computer, responsive to a shutdown of the sniffer, obtaining a second quote of values in the platform configuration registers, wherein the second quote comprises a list of current values in the platform configuration registers, and wherein the second quote is signed by the trusted platform module and stored in the packet log.