LAYER 7 PROXY FOR IMMUTABLE APPLICATION AUDIT TRAILS

• US 20190319927A1
• Filed: 04/13/2018
• Published: 10/17/2019
• Est. Priority Date: 04/13/2018
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Levine, Tyler, Metz, Christopher, Li, Zhaoxing, Dhesikan, Rohan, Ward, David D.
• Granted Patent: US 11,140,133 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A system is provided comprising one or more application layer audit proxies arranged to obtain application layer network traffic sent in a network. Each of the application layer audit proxies configured to: receive application layer network traffic sent as part of a communication session between a producer entity and a consumer entity; record information about the application layer network traffic to an audit log in a distributed permissioned database comprising a blockchain of immutable data blocks; and forward the application layer network traffic to the producer entity or to the consumer entity.

Claims

1. A system comprising:

one or more application layer audit proxies arranged to obtain application layer network traffic sent in a network, each of the application layer audit proxies configured to;

receive application layer network traffic sent as part of a communication session between a producer entity and a consumer entity;

record information about the application layer network traffic to an audit log in a distributed permissioned database comprising a blockchain of immutable data blocks; and

forward the application layer network traffic to the producer entity or to the consumer entity.

2. The system of claim 1, and comprising a plurality of application layer audit proxies that form a proxy network.

3. The system of claim 2, wherein a first application layer audit proxy of the plurality of application layer audit proxies is configured to:

in response to receiving application layer network traffic, send to each of the other application layer audit proxies in the proxy network, a request for a length of its local data blockchain; and

select a longest blockchain among the other application layer audit proxies for writing new data into the audit log.

4. The system of claim 3, wherein the first application layer audit proxy is further configured to:

validate the longest blockchain based on a comparison of hashes computed of each data block in the longest blockchain and a hash computed for a subsequent block in the longest blockchain.

5. The system of claim 4, wherein the first application layer audit proxy is further configured to:

select a next longest blockchain if the longest blockchain cannot be validated; and

if no blockchain among the other application layer audit proxies in the proxy network can be validated, select a local blockchain at the first application layer audit proxy to be used for the audit log.

6. The system of claim 1, wherein each application layer audit proxy records information to the audit log by writing to a current data block of the blockchain a hash value computed from a hash computation of an entirety of a previous data block in the blockchain.

7. The system of claim 1, wherein each application layer audit proxy is configured to:

receive from the consumer entity a request destined for the producer entity;

record audit information derived from the request to the audit log;

forward the request to the producer entity;

receive from the producer entity a response destined for the consumer entity;

record audit information derived from the response to the audit log; and

forward the response to the consumer entity.

8. The system of claim 1, wherein the consumer entity and the application layer audit proxy reside on the same piece of physical hardware.

9. A method comprising:

at one or more application layer audit proxies arranged to obtain application layer network traffic sent in a network;

receiving application layer network traffic sent as part of a communication session between a producer entity and a consumer entity;

recording information about the application layer network traffic to an audit log in a distributed permissioned database comprising a blockchain of immutable data blocks; and

forwarding the application layer network traffic to the producer entity or to the consumer entity.

10. The method of claim 9, wherein a plurality of application layer audit proxies are provided that form a proxy network.

11. The method of claim 9, further comprising a first application layer audit proxy of the plurality of application layer audit proxies:

in response to receiving application layer network traffic, sending to each of the other application layer audit proxies in the proxy network, a request for a length of its local data blockchain; and

selecting a longest blockchain among the other application layer audit proxies for writing new data into the audit log.

12. The method of claim 10, further comprising the first application layer audit proxy:

validating the longest blockchain based on a comparison of hashes computed of each data block in the longest blockchain and a hash computed for a subsequent block in the longest blockchain.

13. The method of claim 12, further comprising the first application layer audit proxy:

selecting a next longest blockchain if the longest blockchain cannot be validated; and

if no blockchain among the other application layer audit proxies in the proxy network can be validated, selecting a local blockchain at the first application layer audit proxy to be used for the audit log.

14. The method of claim 9, further comprising each application layer audit proxy recording information to the audit log by writing to a current data block of the blockchain a hash value computed from a hash computation of an entirety of a previous data block in the blockchain.

15. The method of claim 9, further comprising each application layer audit proxy:

receiving from the consumer entity a request destined for the producer entity;

recording audit information derived from the request to the audit log;

forwarding the request to the producer entity;

receiving from the producer entity a response destined for the consumer entity;

recording audit information derived from the response to the audit log; and

forwarding the response to the consumer entity.

16. An apparatus comprising:

a network interface configured to receive and send traffic in a network, including application layer network traffic sent as part of a communication session between a producer entity and a consumer entity;

a processor coupled to the network interface, and configured to;

record information about the application layer network traffic to an audit log in a distributed permissioned database comprising a blockchain of immutable data blocks; and

cause the application layer network traffic to be forwarded by the network interface to the producer entity or to the consumer entity.

17. The apparatus of claim 16, wherein the processor is configured to record information to the audit log by writing to a current data block of the blockchain a hash value computed from a hash computation of an entirety of a previous data block in the blockchain.

18. The apparatus of claim 17, wherein the processor is configured to validate the blockchain based on a comparison of hashes computed of each data block in the blockchain and a hash computed for a subsequent block in the blockchain.

19. The apparatus of claim 16, wherein the processor is configured to:

record to the audit log audit information derived from a request by the network interface from the consumer entity, the request destined for the producer entity;

forward the request to the producer entity;

record to the audit log audit information derived from a response received from the producer entity, the response destined for the consumer entity; and

forward the response to the consumer entity.

20. The apparatus of claim 16, wherein the apparatus is a first application layer audit proxy among a plurality of application layer audit proxies that form a proxy network, and wherein the processor is configured to:

in response to receiving application layer network traffic, send to each of the other application layer audit proxies in the proxy network, a request for a length of its local data blockchain; and

select a longest blockchain among the other application layer audit proxies for writing new data into the audit log.