Patent ID: 7124299

Claim:
A method for auditing a message in a message stream, comprising: a) capturing messages in a message stream traversing a security boundary having an encrypted side and a plaintext side with messages being captured in the message stream on both the encrypted and plaintext sides, wherein the messages captured on the encrypted side are in an encrypted format and the messages captured on the plaintext side are in a plaintext format, wherein the messages include at least one message in an extensible markup language (XML) format, at least a portion of the messages being captured using an enhanced operating system kernel having a socket option that suppresses output functions; b) extracting the at least one message in the XML format from the captured messages from both the encrypted side and the plaintext side so that an encrypted version of the at least one message is extracted from the encrypted side and a plaintext version of the at least one message is extracted from the plaintext side; c) applying a timestamp to each version of the extracted at least one message in the XML format using a module running on a tamperproof machine and having a secure time source; and d) storing both versions of the timestamped at least one message in the XML format in a storage device with one version of the timestamped at least one message in the XML format stored as a first set of data and the other version of the timestamped at least one message in the XML format stored as a second set of data.