METHOD AND DATA PROCESSING SYSTEM FOR INTERCEPTING COMMUNICATION BETWEEN A CLIENT AND A SERVICE

• US 20070174469A1
• Filed: 01/05/2007
• Published: 07/26/2007
• Est. Priority Date: 01/16/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: von Kulessa, Thomas, Andress, Jiri, Heine, Stefan
• Granted Patent: US 8,024,785 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A method and data processing system for intercepting communication between a user and a service. An authentication component receives, from the user, a user request directed to the service. The authentication component adds a user-specific token to the user request to generate a tokenized request. The tokenized request includes the user request and the token. The token includes a unique user identifier that identifies the user. The authentication component sends the tokenized request to a proxy. The proxy sends the tokenized request to the service. The proxy invokes an interceptor plug-in that is plugged into the proxy. The interceptor plug-in ascertains that the unique user identifier in the tokenized request is present in an interception control list of unique user identifiers. The interception control list is accessible to the interceptor plug-in. The interceptor plug-in sends the tokenized request to an interceptor manager who stores the tokenized request.

Claims

1. A method of intercepting communication between a user and a service, said method comprising:

receiving, by an authentication component from the user, a user request directed to the service;

adding, by the authentication component, a user-specific token to the user request to generate a tokenized request comprising the user request and the token added thereto, said user-specific token comprising a unique user identifier that identifies the user uniquely;

sending, by the authentication component, the tokenized request to a proxy;

receiving, by the proxy, the tokenized request sent by the authentication component;

sending, by the proxy, the tokenized request to the service;

invoking, by the proxy, an interceptor plug-in plugged into the proxy for processing the tokenized request;

ascertaining, by the interceptor plug-in, that the unique user identifier in the tokenized request is present in an interception control list of unique user identifiers accessible to the interceptor plug-in;

sending, by the interceptor plug-in, the tokenized request to an interceptor manager; and

storing, by the interceptor manager, the tokenized request.

2. The method of claim 1, wherein said storing the tokenized request to the interceptor manager comprises storing the tokenized request to the interceptor manager via a message queue disposed between the interceptor plug-in and the interceptor.

3. The method of claim 1:

wherein said sending the tokenized request comprises sending, by the interceptor plug-in, the unique user identifier along with the tokenized request to the interceptor manager; and

wherein said storing the tokenized request comprises storing, by the interceptor manager, the unique user identifier along with the tokenized request.

4. The method of claim 1, wherein said storing the tokenized request comprises storing the tokenized request in an encrypted way.

5. The method of claim 1, wherein the method further comprises storing, by the interceptor plug-in, the tokenized request in a transient memory of the interceptor plug-in.

6. The method of claim 1, wherein the method further comprises storing, by the interceptor plug-in, the tokenized request in a cache of the interceptor plug-in.

7. The method of claim 1, wherein the method further comprises storing the interception control list in the interception manager.

8. The method of claim 7, wherein said storing the interception control list in the interception manager comprises storing the interception control list in the interception manager in an encrypted way.

9. The method of claim 7, wherein the method further comprises loading the interception control list into the interceptor plug-in from the interception manager.

10. The method of claim 1, wherein the method further comprises sending, by the interceptor manager, the tokenized request to a law enforcement agency.

11. The method of claim 10, wherein the method further comprises receiving, by the proxy, a response to the user request.

12. The method of claim 11, wherein the method further comprises sending, by the proxy, the response to the user.

13. The method of claim 11, wherein the method further comprises:

invoking, by the proxy, the interceptor plug-in for processing the response; and

determining, by the interceptor plug-in, that the response relates to the user request.

14. The method of claim 13, wherein the method further comprises storing the response in a transient memory of the interceptor plug-in.

15. The method of claim 14, wherein said storing the response in the transient memory of the interceptor plug-in comprises storing the response in the transient memory of the interceptor plug-in in an encrypted way.

16. The method of claim 13, wherein the method further comprises sending, by the proxy, the response to the interception manager.

17. The method of claim 16, wherein the method further comprises storing the response in the interception manager.

18. The method of claim 16, wherein the method further comprises sending, by the interceptor manager, the response to the law enforcement agency.

19. A computer program product comprising computer executable instructions stored in a computer readable medium of a data processing system, wherein said instructions are adapted to be executed by the data processing system to perform the method of claim 1.

20. A data processing system comprising a computer readable medium on which computer executable instructions are stored, wherein said instructions are adapted to be executed to perform the method of claim 1, said data processing system further comprising the authentication component, the proxy, and the interception manager.