Layer 7 proxy for immutable application audit trails

Patent metadata

Field	Value
Publication number	US-11140133-B2
Application number	US-201815952412-A
Country	US
Kind code	B2
Filing date	Apr 13, 2018
Priority date	Apr 13, 2018
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

A system is provided comprising one or more application layer audit proxies arranged to obtain application layer network traffic sent in a network. Each of the application layer audit proxies configured to: receive application layer network traffic sent as part of a communication session between a producer entity and a consumer entity; record information about the application layer network traffic to an audit log in a distributed permissioned database comprising a blockchain of immutable data blocks; and forward the application layer network traffic to the producer entity or to the consumer entity.

First claim

What is claimed is:

1. A system comprising:
a plurality of application layer audit proxies arranged to obtain application layer network traffic sent in a network, each of the plurality of application layer audit proxies includes at least a network interface configured to receive and send the application layer network traffic in the network and a processor configured to:
receive, via the network interface, the application layer network traffic sent as part of a communication session between a producer entity and a consumer entity;
in response to receiving the application layer network traffic, determine a blockchain of immutable data blocks for recording information into an audit log in a distributed permissioned database, wherein the blockchain is a longest blockchain from among a plurality of blockchains available to the plurality of application layer audit proxies;
record the information about the application layer network traffic to the audit log comprising the blockchain and based on the blockchain, detect whether the audit log has been modified; and
forward the application layer network traffic to the producer entity or to the consumer entity,

wherein the plurality of application layer audit proxies are reverse proxies that retrieve resources on behalf of the consumer entity and form a proxy network, and a first application layer audit proxy of the plurality of application layer audit proxies is configured to:
in response to receiving the application layer network traffic, perform a lookup operation to determine whether the communication session of the application layer network traffic is assigned to the first application layer audit proxy, and
in response to determining that the application layer network traffic is assigned to the first application layer audit proxy, record the information about the application layer network traffic to a local blockchain.

2. The system of claim 1 , wherein the first application layer audit proxy is further configured to:
in response to receiving the application layer network traffic, send to each of the other application layer audit proxies in the proxy network, a request for a length of a respective local data blockchain associated with a respective one of the other application layer audit proxies;
receive, from each of the other application layer audit proxies, a response including the length of the respective local data blockchain; and
based on the response from each of the other application layer audit proxies, select the longest blockchain among the other application layer audit proxies for writing new data into the audit log.

3. The system of claim 2 , wherein the first application layer audit proxy is further configured to:
validate the longest blockchain based on a comparison of hashes computed of each data block in the longest blockchain and a hash computed for a subsequent block in the longest blockchain.

4. The system of claim 3 , wherein the first application layer audit proxy is further configured to:
select a next longest blockchain if the longest blockchain cannot be validated; and
when no blockchain among the other application layer audit proxies in the proxy network can be validated, select the local blockchain to be used for the audit log.

5. The system of claim 1 , wherein each application layer audit proxy records information to the audit log by writing, to a current data block of the blockchain, a hash value computed from a hash computation of an entirety of a previous data block in the blockchain.

6. The system of claim 1 , wherein each of the plurality of application layer audit proxies is configured to:
receive from the consumer entity a request destined for the producer entity;
record first audit information derived from the request to the audit log;
forward the request to the producer entity;
receive from the producer entity a response destined for the consumer entity;
record second audit information derived from the response to the audit log; and
forward the response to the consumer entity.

7. The system of claim 1 , wherein the processor is further configured to:
execute a chain resolution procedure in which the longest blockchain available to the plurality of application layer audit proxies is determined; and
determine an authoritative network chain based on the longest blockchain that is valid and available to the plurality of application layer audit proxies based on a comparison of first hashes computed for each data block in the longest blockchain with second hashes written in a respective subsequent block in the longest blockchain, and with third hashes for a corresponding block in a local blockchain of a respective one from among the plurality of application layer audit proxies.

8. The system of claim 1 , where the processor is further configured to determine whether the first application layer audit proxy is to record the information about the application layer network traffic to the audit log based on a floor function that restricts a number of new consecutive blocks a single proxy is to record.

9. The system of claim 1 , wherein the proxy network is configured to provide the audit log to a network operator management entity that analyzes the audit log to ensure compliance with network requirements, wherein the audit log includes context of the communication session and one or more operation types specified in the application layer network traffic.

10. A method comprising:
at a first application layer audit proxy of a plurality of application layer audit proxies arranged to obtain application layer network traffic sent in a network, wherein the plurality of application layer audit proxies are reverse proxies that retrieve resources on behalf of a consumer entity and form a proxy network:
receiving the application layer network traffic sent as part of a communication session between a producer entity and the consumer entity;
in response to receiving the application layer network traffic, performing a lookup operation to determine whether the communication session of the application layer network traffic is assigned to the first application layer audit proxy and determining a blockchain of immutable data blocks for recording information into an audit log in a distributed permissioned database, wherein the blockchain is a longest blockchain from among a plurality of blockchains available to the plurality of application layer audit proxies;
in response to determining that the application layer network traffic is assigned to the first application layer audit proxy, recording, by the first application layer audit proxy, the information about the application layer network traffic to a local blockchain;
recording the information about the application layer network traffic to the audit log comprising the blockchain and based on the blockchain, detecting whether the audit log has been modified; and
forwarding the application layer network traffic to the producer entity or to the consumer entity.

11. The method of claim 10 , further comprising:
in response to receiving the application layer network traffic, sending, by the first application layer audit proxy, to each of the other application layer audit proxies in the proxy network, a request for a length of a local data blockchain associated with a respective one of the other application layer audit proxies;
receiving, by the first application layer audit proxy, from each of the other application layer audit proxies, a response including the length of a respective local data blockchain; and
based on the response from each of the other application layer audit proxies, selecting, by the first application layer audit proxy, the longest blockchain a

Assignees

• Cisco Tech Inc

Inventors

• Levine Tyler
• Metz Christopher
• Li Zhaoxing
• Dhesikan Rohan
• Ward David D

Classifications

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L43/022

  by sampling · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title