System and method for identifying real users behind application servers
First Claim
1. A method for identifying the user identity of an application client accessing a database server by a monitoring device, the monitoring device being connected to a plurality of monitoring points, the monitoring device having at least one monitoring port, a parser, a comparator, and a storage unit, comprising the steps of:
- capturing a data request from an application client by at least one monitoring port at a first monitoring point, the data request having a data portion and no identifier being inserted by the application client for monitoring purpose;
parsing the data request by the parser;
translating the data request into at least one structure query language (SQL) instruction;
capturing an SQL instruction from an application server by the at least one monitoring port at a second monitoring point, the SQL instruction having a data portion;
parsing the SQL instruction by the parser;
comparing, without using any identifier inserted by the application client for the monitoring purpose, the data portion of the parsed data request with the data portion of the parsed SQL instruction; and
if there is a match between the data portion of the parsed data request and the data portion of the parsed SQL instruction, associating the parsed SQL instruction with the user identity associated with the parsed data request without using any identifier inserted by the application client for the monitoring purpose.
2 Assignments
0 Petitions
Accused Products
Abstract
The present invention provides a monitoring device and method for identifying the identity of users requesting database accesses. The data request from application servers to an application server are monitored and parsed. The SQL statements associated with the data request from the application server are also monitored and parsed, so are the SQL responses from the database server. The SQL responses are sent back to the user as data responses. The data responses are also monitored and parsed. The monitoring device matches the parsed data request with the parsed SQL statements, the parsed SQL responses, and the parsed data responses. By matching the string portion of these parsed data, the monitoring device can then identity the identity of the user making such data base quest.
8 Citations
18 Claims
-
1. A method for identifying the user identity of an application client accessing a database server by a monitoring device, the monitoring device being connected to a plurality of monitoring points, the monitoring device having at least one monitoring port, a parser, a comparator, and a storage unit, comprising the steps of:
-
capturing a data request from an application client by at least one monitoring port at a first monitoring point, the data request having a data portion and no identifier being inserted by the application client for monitoring purpose; parsing the data request by the parser; translating the data request into at least one structure query language (SQL) instruction; capturing an SQL instruction from an application server by the at least one monitoring port at a second monitoring point, the SQL instruction having a data portion; parsing the SQL instruction by the parser; comparing, without using any identifier inserted by the application client for the monitoring purpose, the data portion of the parsed data request with the data portion of the parsed SQL instruction; and if there is a match between the data portion of the parsed data request and the data portion of the parsed SQL instruction, associating the parsed SQL instruction with the user identity associated with the parsed data request without using any identifier inserted by the application client for the monitoring purpose. - View Dependent Claims (2, 3, 4, 5, 6, 16)
-
-
7. A monitoring device for identifying the user identity of an application client accessing a database server, comprising:
-
at least one monitoring port for connecting to a plurality of monitoring points and monitoring data at the plurality of monitoring points; a parser for parsing data captured by the at least one monitoring port; a comparator for comparing the parsed data; and a storage unit for storing the captured data and the parsed data, wherein the at least one monitoring port captures a data request from an application client at a first monitoring point, the data request having a data portion; translating the data request into at least one structure query language (SQL) instruction; capturing an SQL instruction from an application server by the at least one monitoring port at a second monitoring point, the SQL instruction having a data portion; the parser parses the data request from an application client and the SQL instruction from the application server captured by the at least one monitoring port, the data request and the SQL instruction containing no identifier inserted for monitoring purpose, and if there is a match between the data portion of the parsed data request and the data portion the parsed SQL instruction, the comparator associates the parsed SQL instruction with the user identity associated with the data request without using any identifier inserted by the application client for the monitoring purpose. - View Dependent Claims (8, 9)
-
-
10. A non-transitory computer-readable medium containing a computer program for identifying the user identity of an application client accessing a database server through a monitoring device, the monitoring device being connected to a plurality of monitoring points, the monitoring device having at least one monitoring port, a parser, a comparator, and a storage unit, the computer program when executed by the monitoring device causes the monitoring device to perform the following steps:
-
capturing a data request from the application client by at least one monitoring port at a first monitoring point, the data request having a data portion and no identifier inserted by the application client for monitoring purpose; parsing the data request by the parser; translating the data request into at least one structure query language (SQL) instruction; capturing a SQL instruction from an application server by the at least one monitoring port at a second monitoring point, the SQL instruction having a data portion; parsing the SQL instruction by the parser; comparing, without using any identifier inserted by the application client for the monitoring purpose, the parsed data request with the parsed SQL instruction; and if there is a match between the data portion of the parsed data request and the data portion of the parsed SQL instruction, associating the parsed SQL instruction with the user identity associated with the data request without using any identifier inserted by the application client for the monitoring purpose. - View Dependent Claims (11, 12, 13, 14, 15, 17, 18)
-
Specification