SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT FOR AUDITING XML MESSAGES IN A NETWORK-BASED MESSAGE STREAM

• US 20080091821A1
• Filed: 10/16/2006
• Published: 04/17/2008
• Est. Priority Date: 05/18/2001
• Status: Active Grant

• Current Assignee: Chemtron Research LLC (Intellectual Ventures LLC)
• Original Assignee: Network Resonance Incorporated
• Inventors: Rescorla, Eric Kenneth, Dick, Kevin Stewart
• Granted Patent: US 7,979,533 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A system, method and computer program product for auditing a message in a message stream are disclosed. Messages in a message stream are captured including at least one message in an extensible markup language (XML) format. Each message in the XML format is then extracted from the captured messages and has a timestamp applied thereto. Each timestamped message in the XML format is then stored in a memory.

Claims

1. A method, comprising:

capturing messages in a message stream traversing a security boundary defining at least two sides with messages being captured in the message stream on each side of the security boundary;

extracting at least one message from the captured messages from each side of the security boundary to obtain a version of the extracted message from each side of the security boundary;

applying a timestamp to each version of the extracted message; and

storing all timestamped versions of the extracted message with at least a first timestamped version of the message stored as a first set of data and at least a second timestamped version of the message stored as a second set of data.

2. The method of claim 1, wherein the message stream comprises a plurality of messages utilizing a plurality of protocols.

3. The method of claim 1, wherein the captured messages are parsed to identify to the message for extraction.

4. The method of claim 1, wherein the message stream is carried out over a communication path having one or more segments, and wherein messages are captured at each segment.

5. The method of claim 4, wherein the captured messages are aggregated prior to extraction of the message.

6. The method of claim 1, wherein the timestamp includes a digital signature.

7. The method of claim 1, wherein the timestamped versions of the extracted message are stored in a write once storage medium.

8. The method of claim 1, wherein a report relating to the captured messages is generated.

9. The method of claim 1, wherein at least one timestamped version of the extracted message is encrypted prior to storage.

10. The method of claim 1, wherein at least the first and second timestamped versions of the extracted message are correlated to detect any changes therebetween.

11. The method of claim 1, wherein the timestamped versions of the extracted message are stored in a memory.

12. The method of claim 1, wherein socket connections associated the first and second sets of data are matched together to correlate of the first set of data to the second set of data to determine whether the first and second sets of data are the same.

13. A system, comprising:

a message stream traversing a security boundary defining at least two sides;

at least one capture module for capturing messages in the message stream on each side of the security boundary;

an extraction module for extracting at least one message from the captured messages from each side of the security boundary to obtain a version of the extracted message from each side of the security boundary;

a module for applying a timestamp to each version of the extracted message; and

a storage device for storing all timestamped versions of the extracted message with at least a first timestamped version of the message stored as a first set of data and at least a second timestamped version of the message stored as a second set of data.

14. The method of claim 13, wherein the message stream comprises a plurality of messages utilizing a plurality of protocols.

15. The method of claim 13, wherein the captured messages are parsed to identify to the message for extraction.

16. The method of claim 13, wherein the message stream traverses a communication path having one or more segments, and wherein messages are captured at each segment.

17. The method of claim 16, wherein the captured messages are aggregated prior to extraction of the message.

18. The method of claim 17, wherein the timestamp includes a digital signature.

19. The method of claim 13, wherein the storage device comprises a write once storage medium.

20. A computer program product containing computer code in a computer-readable medium for causing a computer to perform a method, comprising:

computer code for capturing messages in a message stream traversing a security boundary defining at least two sides with messages being captured in the message stream on each side of the security boundary;

computer code for extracting at least one message from the captured messages from each side of the security boundary to obtain a version of the extracted message from each side of the security boundary;

computer code for applying a timestamp to each version of the extracted message; and

computer code for storing all timestamped versions of the extracted message with at least a first timestamped version of the message stored as a first set of data and at least a second timestamped version of the message stored as a second set of data.