Patent ID: 7769997

Claim:
A method, comprising: detecting on a network an initiation of a data transaction comprising a plurality of data packets transmitted between a server and a client over a protected channel, the data transaction being encrypted utilizing a session secret negotiated between the server and the client; capturing a copy of the data transaction by copying the data packets from a point in the protected channel during transmission; associating an identifier with the data transaction; generating timestamps for the copied data packets, each timestamp including information identifying the identifier; storing the captured copy of the data transaction, the identifier and the timestamps in a database; mapping the identifier to an entry in an index; retrieving the captured copy of the data transaction from the database utilizing the entry; submitting a portion of the captured copy of the data transaction to at least one of the server and the client to obtain the session secret; decrypting the captured copy of the data transaction utilizing the obtained session secret; and comparing data received by at least one of the server and the client during the data transaction with data contained in the decrypted captured copy of the data transaction to determine if the received data matches the captured data.