Collecting Account Access Statistics from Information Provided by Presence of Client Certificates

• US 20090222901A1
• Filed: 02/28/2008
• Published: 09/03/2009
• Est. Priority Date: 02/28/2008
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Schneider, James P.
• Granted Patent: US 8,412,932 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method and system for collecting account access statistics from information provided by client certificates. In one embodiment, the method comprises requesting client certificates from remote terminals that request to access a computing resource. The method further comprises updating the account access statistics based on information provided by presence or absence of the client certificates and contents of the client certificates for the client certificates that are present.

Claims

1. A computer-implemented method comprising:

requesting client certificates from remote terminals that request to access a computing resource; and

updating account access statistics based on information provided by presence or absence of the client certificates and contents of the client certificates for the client certificates that are present.

2. The method of claim 1, wherein updating account access statistics further comprises:

collecting the account access statistics of users who fail to provide the client certificates.

3. The method of claim 1, wherein updating account access statistics further comprises:

collecting the account access statistics of users whose access credentials do not match the information provided by the client certificates.

4. The method of claim 1, wherein requesting client certificates further comprises:

requesting, and without requiring, the client certificates to allow the remote terminals to access the resource when one or more of the remote terminals do not have the client certificates.

5. The method of claim 1, wherein requesting client certificates further comprises:

requiring a client certificate after receiving access credentials of a user;

denying access to the computing resource in response to absence of the client certificate; and

collecting the account access statistics in connection with the user and the absence of the client certificate.

6. The method of claim 1, wherein requesting client certificates further comprises:

identifying, from the account access statistics, an indication of non-compliance with a company policy.

7. The method of claim 1, wherein updating statistics further comprises:

updating the account access statistics in a real-time process that manages account access.

8. The method of claim 1, wherein updating statistics further comprises:

scanning a log file, in a background process, to update the account access statistics.

9. A system comprising:

data storage to store a collection of statistics; and

a computing entity coupled to the data storage, the computing entity to request client certificates from remote terminals that request to access a computing resource, and to update account access statistics based on information provided by presence or absence of the client certificates and contents of the client certificates for the client certificates that are present.

10. The system of claim 9, further comprising:

a server coupled to the computing entity to manage the computing resource, the server to request, but not require, the client certificates from the remote terminals that request to access the computing resource.

11. The system of claim 9, further comprising:

a server coupled to the computing entity to manage the computing resource, the server to require a client certificate after receipt of access credentials of a user who requests to access the computing resource.

12. The system of claim 9, wherein the collection of statistics comprises the account access statistics of users who fail to provide the client certificates.

13. The system of claim 9, wherein the collection of statistics comprises the account access statistics of users whose access credentials do not match the information provided by the client certificates.

14. The system of claim 9, wherein the computing resource is a web application or a mail application.

15. A computer readable storage medium including instructions that, when executed by a processing system, cause the processing system to perform a method comprising:

requesting client certificates from remote terminals that request to access a computing resource; and

updating account access statistics based on information provided by presence or absence of the client certificates and contents of the client certificates for the client certificates that are present.

16. The computer readable medium of claim 15, wherein updating account access statistics further comprises:

collecting the account access statistics of users who fail to provide the client certificates.

17. The computer readable medium of claim 15, wherein updating account access statistics further comprises:

collecting the statistics of users whose access credentials do not match the information provided by the client certificates.

19. The computer readable medium of claim 15, wherein requesting client certificates further comprises:

requiring a client certificate after receiving access credentials of a user;

denying access to the computing resource in response to absence of the client certificate; and

collecting the statistics in connection with the user and the absence of the client certificate.

20. The computer readable medium of claim 15, wherein requesting client certificates further comprises:

identifying, from the statistics, an indication of non-compliance with a company policy.

18. The computer readable medium of 15, wherein requesting client certificates further comprises:

requesting, and without requiring, the client certificates to allow the remote terminals to access the resource when one or more of the remote terminals do not have the client certificates.