Method and system for validating timestamps

• US 20050138383A1
• Filed: 12/22/2003
• Published: 06/23/2005
• Est. Priority Date: 12/22/2003
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: PSS Systems, Inc. (International Business Machines Corporation)
• Inventors: Vainstein, Klimenty
• Granted Patent: US 7,702,909 B2
• Time in Patent Office: Days
• US Class Current: 713/178
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp

Abstract

Improved techniques for validating timestamps used in a client-server environment are disclosed. A client can associate client-provided timestamps with events that occur at the client. The client can then send event information as well as the timestamps to a server. Preferably, the event information and timestamps are sent in a batch pertaining to a plurality of events that have occurred at the client. The server, which has greater time accuracy, can then validate the client-provided timestamps. The server can also modify the client-provided timestamps so as to improve accuracy of the timestamps. Once modified, the timestamps can pertain to a range (e.g., window) of time during which the associated events can be known to have reliably occurred. In one embodiment, the client-server environment is a distributed file security system in which the events and event information pertain to audit files. The distributed file security system provides efficient and reliable techniques to ensure accuracy of client-provided timestamps.

Claims

1. A method for time stamping events occurring in a client-server software system, the client-server software system operating on at least one client and at least one server, said method comprising:

receiving a group of events at the server, the events being associated with the client, and each of the events including at least event information and a client timestamp;

evaluating at least one of the client timestamps for the group of events to determine whether the client timestamps are reliable; and

modifying the client timestamps dependent upon whether the client timestamps have been determined to be reliable.

2. A method as recited in claim 1, wherein the event information includes an event designator.

3. A method as recited in claim 1, wherein the group of events are sent as a batch from the client to the server.

4. A method as recited in claim 1, wherein the number of events in the group of events is controllable.

5. A method as recited in claim 1, wherein said evaluating compares the at least one of the client timestamps with at least one server provided time reference.

6. A method as recited in claim 1, wherein said evaluating comprises:

obtaining an earliest client timestamp and a latest client timestamp from the client timestamps of the group of events;

comparing the earliest client timestamp with a first server reference time;

comparing the latest client timestamp with a second server reference time; and

determining the client timestamps to be reliable when both said comparing indicates that the earliest client timestamp is not less than the first server reference time and said comparing indicates that the latest client timestamp is not more than the second server reference time.

7. A method as recited in claim 6, wherein the first server reference time is a last receipt server time in which a prior group of events was received at the server from the client, and the second server reference time is a current server time in which the group of events was received at the server from the client.

8. A method as recited in claim 1, wherein said modifying the client timestamps operates to modify the client timestamps to provide a range of time.

9. A method as recited in claim 8, wherein the range of time is a validated timestamp window.

10. A method as recited in claim 8, wherein the range of time is dependent on whether the client timestamps have been determined to be reliable.

11. A method as recited in claim 8, wherein when the client timestamps are determined to be reliable, the range of time for each of the client timestamps is dependent on the client timestamp and an accuracy value.

12. A method as recited in claim 8, wherein when the client timestamps are determined to be unreliable, the range of time for each of the client timestamps is dependent on the first and second server reference times.

13. A method for time stamping audit events of a client-server software system, said method comprising:

receiving audit events that occur at a client program of the client-server software system, each of the audit events having at least a client timestamp and an audit descriptor to describe the audit event;

transmitting a batch of the audit events to a server program of the client-server software system;

validating the client timestamps for the audit events in the batch against one or more server timestamps; and

modifying the client timestamps based on said validating.

14. A method as recited in claim 13, wherein, after said validating operates to validate one of the client timestamps, said modifying operates to modify the one of the client timestamps to provide a validated timestamp window for the audit event associated therewith.

15. A method as recited in claim 14, wherein the client program and the server program communicate through a network, and

wherein the validated timestamp window has a width that is dependent on at least network delay of communications between the client program and the server program.

16. A method as recited in claim 14, wherein the validated timestamp window is formed from the one of the client timestamps plus and minus a value, thereby forming two endpoints of the validated timestamp window.

17. A method as recited in claim 16, wherein the value is dependent on at least network delay between the client program and the server program.

18. A method as recited in claim 13, wherein the batch has a batch size.

19. A method as recited in claim 18, wherein the batch size is dependent on an elapsed time.

20. A method as recited in claim 18, wherein the batch size is dependent on an administrator action.

21. A method as recited in claim 14, wherein the validated timestamp window has a width that is dependent on a current server time and a last validated server time.

22. A method as recited in claim 14,

wherein said validating provides an indication of whether the one of the client timestamps is reliable or unreliable, and

wherein the validated timestamp window has a width that is dependent on whether the one of the client timestamps is reliable or unreliable.

23. An audit system for a client-server software system, the client-server software system operating on at least one client and at least one server, said system comprising:

an audit event monitor for receiving events associated with at least one client process of the client-server software program operating on the client, each of the events including at least event information and a client timestamp;

a batch sender operating on the client to send the events received by said audit event monitor to the server in a batch;

a batch receiver operating on the server to receive the batch of the events from said batch sender; and

a timestamp manager operating on the server to validate the client timestamps of the events in the batch received by said batch receiver based on an accurate time reference available to the server.

24. An audit system as recited in claim 23, wherein said timestamp manager further modifies the client timestamps dependent on the validation of the client timestamps.

25. An audit system as recited in claim 24, wherein, when said timestamp manager modifies the client timestamps, the client timestamps modified become a range of time.

26. An audit system as recited in claim 25, wherein the range of time is dependent on the validation of the client timestamps.

27. An audit system as recited in claim 25, wherein the validation of the client timestamps determines whether the client timestamps are reliable, and wherein the range of time is dependent on whether or not the client timestamps are determined to be reliable.

28. A computer readable medium including at least computer program code for time stamping events occurring in a client-server software system, the client-server software system operating on at least one client and at least one server, said computer readable medium comprising:

computer program code for receiving a group of events at the server, the events being associated with the client, and each of the events including at least event information and a client timestamp;

computer program code for evaluating at least one of the client timestamps for the group of events to determine whether the client timestamps are reliable; and

computer program code for modifying the client timestamps dependent upon whether the client timestamps have been determined to be reliable.

29. A computer readable medium as recited in claim 28, wherein said computer program code for modifying the client timestamps operates to modify the client timestamps to provide a range of time.

30. A computer readable medium as recited in claim 29, wherein the range of time is dependent on whether the client timestamps have been determined to be reliable.

31. A computer readable medium as recited in claim 29, wherein when the client timestamps are determined to be reliable, the range of time for each of the client timestamps is dependent on the client timestamp and an accuracy value.

32. A computer readable medium as recited in claim 29, wherein when the client timestamps are determined to be unreliable, the range of time for each of the client timestamps is dependent on the first and second server reference times.

33. A computer readable medium as recited in claim 28, wherein said computer program code for evaluating compares the at least one of the client timestamps with at least one server provided time reference.

34. A computer readable medium as recited in claim 28, wherein said computer program code for evaluating comprises:

computer program code for obtaining an earliest client timestamp and a latest client timestamp from the client timestamps of the group of events;

computer program code for comparing the earliest client timestamp with a first server reference time;

computer program code for comparing the latest client timestamp with a second server reference time; and

computer program code for determining the client timestamps to be reliable when both said computer program code for comparing indicates that the earliest client timestamp is not less than the first server reference time and said computer program code for comparing indicates that the latest client timestamp is not more than the second server reference time.

35. A computer readable medium as recited in claim 34, wherein the first server reference time is a last receipt server time in which a prior group of events was received at the server from the client, and the second server reference server time is a current server time in which the group of events was received at the server from the client.

36. A computer readable medium as recited in claim 28, wherein the events are audit events.