System and method for encrypting audit information in network applications

• US 6,286,098 B1
• Filed: 08/28/1998
• Issued: 09/04/2001
• Est. Priority Date: 08/28/1998
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: SAP AG (SAP SE)
• Inventors: Tsyganskiy, Igor, Wenig, Robert
• Primary Examiner(s): Swann, Tod
• Assistant Examiner(s): Smithers, Matthew
• Application Number:
  US09/143,537
• Time in Patent Office: 1,103 Days
• Field of Search: 713/151, 713/154, 705/75, 705/78
• US Class Current: 713/151
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system and method for auditing network applications captures transmissions during a user session between a client and a server. An auditor capture filter captures each request from the client and each response by the server to each request. An auditor encryption module encrypts the captured requests and the captured responses with an encryption key and stores them in an auditor storage. The auditor encryption module also distributes portions of the encryption key to the client and the server. An auditor decryption module collects the portions of the encryption key from the client and the server and decrypts the encrypted requests and the encrypted responses. An auditor analyzer may then use the decrypted requests and the decrypted responses to recreate the user session to thereby analyze what transpired during the user session. In addition, the analyzer may also verify that a particular event occurred during the user session.

Claims

1. A method for recording a user session in a computer environment including a client and a server, the user session comprising at least one request and at least one response between the client and the server, the method comprising:

receiving at least one request from the client at the server;

capturing at the server the at least one request and first environmental data associated with the computer environment;

capturing at the server at least one response to the at least one request sent from the server to the client and second environmental data associated with the computer environment; and

encrypting the user session based on a client key and a server key such that neither the client nor the server can decrypt the user session without the consent of the other.

2. The method of claim 1, further comprising:

verifying that the user session has not been tampered with.

3. The method of claim 2, further comprising:

decrypting the user session based on the client key and the server key; and

recreating the user session at the server.

4. A method for recording a user session in a computer environment including multiple clients and a server, the user session comprising requests and responses between the clients and the server, the method comprising:

receiving requests from the clients at the server;

capturing at the server the requests and first environmental data associated with the computer environment;

capturing at the server responses to the requests sent from the server to the clients and second environmental data associated with the computer environment;

encrypting the user session based on a key;

separating the key into key parts; and

distributing to each client and the server a different key part, such that the user session cannot be decrypted without the participation of all clients and the server.

5. The method of claim 4, further comprising;

providing each client and the server with identifying information for locating each client and the server.

6. The method of claim 5, further comprising:

verifying that the user session has not been tampered with.

7. The method of claim 5, further comprising:

collecting the different key parts from the clients and the server;

decrypting the user session based on the client key and the server key; and

recreating the user session at the server.

8. A system for recording a user session in a computer environment including a client and a server comprising:

a communication link between the client and the server,

a memory, and

an auditor capture filter capable of

receiving at least one request from the client at the server;

capturing at the server the at least one request and first environmental data associated with the computer environment;

capturing at the server at least one response to the at least one request sent from the server to the client and second environmental data associated with the computer environment; and

encrypting the user session based on a client key and a server key such that neither the client nor the server can decrypt the user session without the consent of the other.

9. The system of claim 8, wherein the auditor capture filter is further capable of:

verifying that the user session has not been tampered with.

10. The system of claim 8, wherein the auditor capture filter is further capable of:

decrypting the user session based on the client key and the server key; and

recreating the user session at the server.

11. A system for recording a user session in a computer environment including a client and a server comprising:

a communication link between the client and the server,

a memory, and

an auditor capture filter capable of

receiving requests from the clients at the server;

capturing at the server the requests and first environmental data associated with the computer environment;

capturing at the server responses to the requests sent from the server to the clients and second environmental data associated with the computer environment;

encrypting the user session based on a key;

separating the key into key parts; and

distributing to each client and the server a different key part, such that the user session cannot be decrypted without the participation of all clients and the server.

12. The system of claim 11, wherein the auditor capture filter is further capable of:

providing each client and the server with identifying information for locating each client and the server.

13. The system of claim 11, wherein the auditor capture filter is further capable of:

verifying that the user session has not been tampered with.