System and method for recording web sessions

• US 10,341,205 B2
• Filed: 01/31/2017
• Issued: 07/02/2019
• Est. Priority Date: 02/09/2016
• Status: Active Grant

• Current Assignee: Glassbox Ltd.
• Original Assignee: Glassbox Ltd.
• Inventors: Gueta, Yaron, Ofek, Shachar
• Primary Examiner(s): Zong, Ruolei
• Application Number:
  US15/420,926
• Publication Number:
  US 20170230260A1
• Time in Patent Office: 882 Days
• Field of Search: 709224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms

Abstract

A web session recording system comprising at least one server, the server comprising one or more network cards and at least one processing unit configured to: monitor one or more ports of the network cards, the ports being used for conducting a plurality of web sessions; and send web session recording enabling data relating to the web sessions to a data repository, for recording the web sessions; wherein the monitor and the send enable recording the web sessions without access to resources external to the server.

Claims

1. A web session recording system comprising at least one web-server, the web-server comprising one or more network cards and at least one processing unit configured to:

(a) monitor one or more ports of the network cards, the ports being used for conducting a plurality of web sessions comprised of one or more packets having a destination address designating the web-server; and

(b) send web session recording enabling data based on the packets to a web session recording server for storing the data in a data repository thereby enabling recording the web sessions;

wherein (a) and (b) enable recording the web sessions without manipulating hardware resources external to the web-server.

2. The web session recording system of claim 1 wherein the web session recording enabling data comprises a segment of data including at least payloads of the one or more packets relating to the web sessions passing through the ports, or data enabling reconstructing the segment.

3. The web session recording system of claim 1 further comprising a hash repository storing hashes of sent segments of data, each including at least payloads of the one or more packets relating to the web session passing through the ports;

wherein the processing unit is further configured to activate a hash function on a segment of data including at least payloads of the one or more packets relating to the web session passing through the ports, giving rise to segment hash; and

wherein if the segment hash is not comprised within the hash repository the web session recording enabling data includes the segment of data, and if the segment hash is comprised within the hash repository the web session recording enabling data is data enabling reconstructing the segment, wherein the data enabling reconstructing the segment is of smaller size than the segment of data.

4. The web session recording system of claim 3 wherein the data enabling reconstructing the segment is the segment hash.

5. The web session recording system of claim 3 wherein the segment of data includes at least payloads of a sequence of packets relating to a given Hypertext Transfer Protocol (HTTP) connection.

6. The web session recording system of claim 1 wherein the processing resource is further configured to continuously repeat (a) and (b).

7. The web session recording system of claim 1 wherein (a) and (b) are performed by an agent installed on the web-server.

8. The web session recording system of claim 1 wherein the web session recording server and the web-server are different servers.

9. The web session recording system of claim 1 wherein the web session recording server and the web-server are a single server.

10. The web session recording system of claim 1 wherein at least two web sessions of the plurality of web sessions are conducted simultaneously.

11. The web session recording system of claim 1 wherein at least a first web session of the plurality of web sessions is initiated by a first user and at least a second web session of the plurality of web sessions is initiated by a second user, different than the first user.

12. The web session recording system of claim 11 wherein the first web session and the second web session are conducted simultaneously.

13. A method of recording web sessions, the method comprising:

(a) monitoring, by a processor, one or more ports of one or more network cards comprised within a web-server, the ports being used for conducting a plurality of web sessions comprised of one or more packets having a destination address designating the web-server; and

(b) sending web session recording enabling data based on the packets to a web session recording server for storing the data in a data repository thereby enabling recording the web sessions;

wherein (a) and (b) enable recording the web sessions without manipulating hardware resources external to the web-server.

14. The method of claim 13 wherein the web session recording enabling data comprises a segment of data including at least payloads of the one or more packets relating to the web sessions passing through the ports, or data enabling reconstructing the segment.

15. The method of claim 13 further comprising:

providing a hash repository storing hashes of sent segments of data, each including at least payloads of the one or more packets relating to the web session passing through the ports; and

activating a hash function on a segment of data including at least payloads of the one or more packets relating to the web session passing through the ports, giving rise to segment hash;

wherein if the segment hash is not comprised within the hash repository the web session recording enabling data includes the segment of data, and if the segment hash is comprised within the hash repository the web session recording enabling data is data enabling reconstructing the segment, wherein the data enabling reconstructing the segment is of smaller size than the segment of data.

16. The method of claim 15 wherein the data enabling reconstructing the segment is the segment hash.

17. The method of claim 15 wherein the segment of data includes at least payloads of a sequence of packets relating to a given Hypertext Transfer Protocol (HTTP) connection.

18. The method of claim 13 further comprising continuously repeating (a) and (b).

19. The method of claim 13 wherein (a) and (b) are performed by an agent installed on the web-server.

20. The method of claim 13 wherein the web session recording server and the web-server are different servers.

21. The method of claim 13 wherein the web session recording server and the web-server are a single server.

22. The method of claim 13 wherein at least two web sessions of the plurality of web sessions are conducted simultaneously.

23. The method of claim 13 wherein at least a first web session of the plurality of web sessions is initiated by a first user and at least a second web session of the plurality of web sessions is initiated by a second user, different than the first user.

24. The method of claim 23 wherein the first web session and the second web session are conducted simultaneously.

25. A non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code, executable by at least one processor of a computer to perform a method comprising:

(a) monitoring one or more ports of one or more network cards comprised within a web-server, the ports being used for conducting a plurality of web sessions comprised of one or more packets having a destination address designating the web-server; and

(b) sending web session recording enabling data based on the packets to a web session recording server for storing the data in a data repository thereby enabling recording the web sessions;

wherein (a) and (b) enable recording the web sessions without manipulating hardware resources external to the web-server.