Method and apparatus for remote network access logging and reporting

• US 6,122,740 A
• Filed: 12/19/1996
• Issued: 09/19/2000
• Est. Priority Date: 12/19/1996
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Andersen, David B.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): ELISCA, PIERRE E
• Application Number:
  US08/769,373
• Time in Patent Office: 1,370 Days
• Field of Search: 395/186, 395/187.01, 395/200.59, 395/188.01, 380/4, 380/9, 380/23, 380/25, 707/9, 713/200, 713/201, 713/202, 709/229
• US Class Current: 726/4
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and apparatus for remote network access logging and reporting intercepts an access request at a client system on a network and sends log data identifying the access request to a log server on the network. According to one embodiment, the client system receives an access list from the log server and compares the access request to the access list. In this embodiment, access to the host system is allowed only if the request does not conflict with the access list. According to another embodiment, the client system receives an access list from the log server and compares the access request to the access list. In this embodiment, the log data is sent to the log server only if the request conflicts with the access list.

Claims

1. A method comprising:

intercepting an access request at a client system to access information at a host system on a network, said access request originating at the client system;

sending log data from the client system to a log server on the network, said log data to identify the access request; and

receiving an access summary from the log server that summarizes at least a portion of the log data received from the client system.

2. The method of claim 1, wherein the access request is a request to access a world wide web page on the host system.

3. The method of claim 1, further comprising:

receiving an access list at the client system from the log server;

comparing the access request to the access list; and

initiating an access from the client system to the host system only if the access request does not conflict with the access list.

4. The method of claim 1, further comprising

the log server accessing the host system in response to the log server receiving the log data from the client system;

and

the log server obtaining site description information regarding the host system from the host system.

5. The method of claim 1, wherein the sending comprises:

comparing the access request at the client system to an access list received from the log server; and

sending the log data from the client system to the log server only if the access request conflicts with the access list.

6. The method of claim 1, wherein the log data identifies a source of the access request and site description information corresponding to the access request.

7. The method of claim 1, further comprising:

the log server comparing the log data to a plurality of predetermined host systems; and

the log server alerting a predetermined user in response to the log data matching at least one of the plurality of predetermined host systems.

8. The method of claim 7, wherein the alerting comprises sending an electronic mail message to the predetermined user.

13. The system of claim 8 wherein the log server is further to store an access list, said client system to retrieve the access list from the log server and compare a first access request to the access list,

said client system to send first log data identifying the first access request to the log server only if the first access request conflicts with the access list.

9. A machine-readable medium having stored thereon a plurality of instructions, designed to be executed by a processor, for implementing a function, implementation of the function comprising:

intercepting an access request at a client system to access information at a host system on a network, said access request originating at the client system;

sending log data from the client system to a log server on the network, said log data to identify the access request; and

receiving an access summary from the log server that summarizes at least a portion of the log data received from the client system.

10. The machine-readable medium of claim 9, wherein the access request is a request to access a specified file on the host system.

11. The machine-readable medium of claim 9, wherein implementation of the function further comprises:

receiving an access list at the client system from the log server;

comparing the access request to the access list; and

initiating an access from the client system to the host system only if the access request does not conflict with the access list.

12. The machine-readable medium of claim 9, wherein implementation of the function further comprises:

comparing the access request at the client system to an access list received from the log server; and

sending the log data from the client system to the log server only if the access request conflicts with the access list.

14. An apparatus comprising:

an interface to intercept an access request at a client system to access information at a host system on a network, said access request originating at the client system; and

a logging process to send log data from the client system to a log server on the network, said log data to identify the access request, and said logging process to receive an access summary from the log server that summarizes at least a portion of the log data.

15. The apparatus of claim 14, wherein the access request is a request to access a particular file on the host system.

16. The apparatus of claim 14, wherein the logging process is also to retrieve an access list from the log server, compare the access request to the access list, and initiate an access from the client system to the host system only if the access request does not conflict with the access list.

17. The apparatus of claim 14, wherein the logging process is also to compare the access request at the client system to an access list received from the log server, and to send the log data to the log server only if the access request conflicts with the access list.

18. A system comprising:

a client system on a network to request access to information stored at a host system on the network; and

a log server on the network to store an access log for the client system, said client system to send log data to the log server for addition to the access log to identify access requests made by the client system, said log server to sent an access summary to the client system that summarizes at least a portion of the log data received from the client system.

19. A system comprising:

a client system on a network to request access to information stored at a host system on the network; and

a log server on the network to store an access list for the client system, said client system to retrieve the access list from the log server, compare a first access request to the access list, and initiate the first access request only if the first access request does not conflict with the access list, said log server further to store an access log for the client system, said client system to send log data to the log server for addition to the access log to identify access requests made by the client system, said client system further to send first log data identifying the first access request to the log server only if the first access request conflicts with the access list.