MONITORING SIGNED RESOURCES TRANSFERRED OVER A NETWORK

• US 20150372821A1
• Filed: 06/20/2014
• Published: 12/24/2015
• Est. Priority Date: 06/20/2014
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: DESCHENES, Danny, LAROSE, Pierre
• Granted Patent: US 9,712,516 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A system for monitoring resources transferred over a network includes a capture module that is configured to capture content transferred over a network between a requestor device and a server device. The content includes a resource, a digital signature associated with the resource and a digital certificate associated with the digital signature. The system includes a resource monitor module that is configured to receive the captured content from the capture module. The resource monitor module includes at least one memory, at least one processor and a resource analyzer module that is configured to use the at least one processor to inspect one or more attributes of the digital certificate and inspect the digital signature and verify the digital certificate using the attributes and verify the digital signature.

Claims

1. A system for monitoring resources transferred over a network, the system comprising:

a capture module that is arranged and configured to capture content transferred over a network between a requestor device and a server device, wherein the content includes;

a resource,

a digital signature associated with the resource, and

a digital certificate associated with the digital signature; and

a resource monitor module that is operably coupled to the capture module and that is configured to receive the captured content from the capture module, wherein the resource monitor module comprises;

at least one memory,

at least one processor that is operably coupled to the at least one memory, and

a resource analyzer module that is operably coupled to the at least one processor and that is configured to use the at least one processor to;

inspect one or more attributes of the digital certificate and inspect the digital signature, and

verify the digital certificate using the attributes and verify the digital signature.

2. The system of claim 1 wherein the resource monitor module further includes a notifier module that is operably coupled to the resource analyzer module and that is configured to provide a notification to a server device in response to the resource analyzer module verifying an error with the digital certificate or an error with the digital signature.

3. The system of claim 1 wherein:

the attributes of the digital certificate include an expiration date; and

the resource monitor analyzer module is configured to verify the digital certificate using the expiration date.

4. The system of claim 3 wherein the resource monitor module further includes a notifier module that is operably coupled to the resource analyzer module and the notifier module is configured to notify a server device when the resource analyzer module verifies the expiration date of the digital certificate is expired.

5. The system of claim 3 wherein the resource monitor module further includes a notifier module that is operably coupled to the resource analyzer module and the notifier module is configured to notify a server device when the resource analyzer module verifies the expiration date of the digital certificate is within a predetermined period of time before the expiration date.

6. The system of claim 1 wherein the resource monitor module further includes a notifier module that is operably coupled to the resource analyzer module and the notifier module is configured to notify a server device when the resource analyzer module verifies the digital signature is not valid.

7. The system of claim 1 wherein the resource monitor module further includes a cache module that is operably coupled to the resource analyzer module and that is configured to store verification results from the resource analyzer module.

8. The system of claim 7 wherein the resource analyzer module is further configured to analyze content having an identical resource as previously captured content using the cached verification result of the previously captured content.

9. A computer-implemented method for executing instructions stored on a non-transitory computer readable storage medium, the method comprising:

capturing content transferred over a network between a requestor device and a server device, wherein the content includes;

a resource,

a digital signature associated with the resource, and

a digital certificate associated with the digital signature;

inspecting one or more attributes of the digital certificate and inspecting the digital signature; and

verifying the digital certificate using the attributes and verifying the digital signature.

10. The method as in claim 9 further comprising providing a notification to a server device in response to verifying an error with the digital certificate or an error with the digital signature.

11. The method as in claim 9 wherein the attributes of the digital certificate include an expiration date, the method further comprising:

verifying the digital certificate using the expiration date.

12. The method as in claim 11 further comprising notifying a server device when the verification of the expiration date indicates the digital certificate is expired.

13. The method as in claim 11 further comprising notifying a server device when the verification of the expiration date indicates the digital certificate is within a predetermined period of time before the expiration date.

14. The method as in claim 9 further comprising notifying a server device when the verification of the digital signature is not valid.

15. The method as in claim 9 further comprising storing verification results in a cache module.

16. The method as in claim 15 further comprising analyzing content having an identical resource as previously captured content using the cached verification result of the previously captured content.

17. A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable storage medium and comprising instructions that, when executed by at least one computing device, are configured to cause the at least one computing device to:

capture content transferred over a network between a requestor device and a server device, wherein the content includes;

a resource,

a digital signature associated with the resource, and

a digital certificate associated with the digital signature;

inspect one or more attributes of the digital certificate and inspect the digital signature; and

verify the digital certificate using the attributes and verify the digital signature.

18. The computer program product of claim 17 further comprising instructions that, when executed by the at least one computing device, are configured to cause to the at least one computing device to provide a notification to a server device in response to verifying an error with the digital certificate or an error with the digital signature.

19. The computer program product of claim 17 wherein the attributes of the digital certificate include an expiration date, and further comprising instructions that, when executed by the at least one computing device, are configured to cause the at least one computing device to:

verify the digital certificate using the expiration date; and

notify a server device when the verification of the expiration date indicates the digital certificate is expired.

20. The computer program product of claim 17 wherein the attributes of the digital certificate include an expiration date, and further comprising instructions that, when executed by the at least one computing device, are configured to cause the at least one computing device to:

verify the digital certificate using the expiration date; and

notify a server device when the verification of the expiration date indicates the digital certificate is within a predetermined period of time before the expiration date.

21. The computer program product of claim 17 further comprising instructions that, when executed by the at least one computing device, are configured to cause the at least one computing device to notify a server device when the verification of the digital signature is not valid.