Filtering of authenticated synthetic transactions

Patent metadata

Field	Value
Publication number	US-2019166094-A1
Application number	US-201715825547-A
Country	US
Kind code	A1
Filing date	Nov 29, 2017
Priority date	Nov 29, 2017
Publication date	May 30, 2019
Grant date	—

Abstract

A method of filtering authenticated synthetic transactions comprises receiving over a network, at a server providing a first networked application, a plurality of requests for the first networked application, wherein the plurality of requests includes a first synthetic transaction. The method further comprises analyzing a respective header of each of the plurality of requests; identifying a synthetic token in the respective header of the first synthetic transaction in response to analyzing the respective header of each of the plurality of requests; determining that the identified synthetic token corresponds to the first networked application; and bypassing usage monitoring for the first synthetic transaction in response to determining that the identified synthetic token corresponds to the first networked application.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
receiving over a network, at a server providing a first networked application, a plurality of requests for the first networked application, wherein the plurality of requests includes a first synthetic transaction; analyzing, via the server, a respective header of each of the plurality of requests; identifying, via the server, a synthetic token in the respective header of the first synthetic transaction in response to analyzing the respective header of each of the plurality of requests; determining, via the server, that the identified synthetic token corresponds to the first networked application; and bypassing, via the server, usage monitoring for the first synthetic transaction in response to determining that the identified synthetic token corresponds to the first networked application.

2 . The computer-implemented method of claim 1 , wherein the synthetic token is encrypted using a pre-shared key provided by the server to a synthetic transaction monitoring engine prior to generation of the first synthetic transaction by the synthetic transaction monitoring engine; and
wherein determining whether the identified synthetic token corresponds to the first networked application includes decrypting the synthetic token using a private key corresponding to the pre-shared key.

3 . The computer-implemented method of claim 2 , wherein the first networked application is one of a plurality of networked applications provided by the server and the first synthetic transaction is one of a plurality of synthetic transactions, each of the plurality of synthetic transactions directed to a respective one of the plurality of networked applications;
wherein each of the plurality of synthetic transactions includes a respective synthetic token, each of the synthetic tokens including a same first value encrypted by a different pre-shared key of a plurality of pre-shared keys provided by the server, each of the plurality of pre-shared keys corresponding to a respective one of the plurality of networked applications and to a respective private key; wherein determining that the identified synthetic token in the first synthetic transaction corresponds to the first networked application comprises decrypting the identified synthetic token in the first synthetic transaction using the respective private key corresponding to the first networked application to obtain a decrypted value and comparing the decrypted value to the first value.

4 . The computer-implemented method of claim 2 , wherein the first networked application is one of a plurality of networked applications provided by the server and the first synthetic transaction is one of a plurality of synthetic transactions, each of the plurality of synthetic transactions directed to a respective one of the plurality of networked applications;
wherein each of the plurality of synthetic transactions includes a respective synthetic token, each of the synthetic tokens including a different respective value chosen based on the respective networked application, each of the synthetic tokens encrypted by a same pre-shared key provided by the server, the same pre-shared key corresponding to a private key; wherein determining that the identified synthetic token in the first synthetic transaction corresponds to the first networked application comprises decrypting the identified synthetic token in the first synthetic transaction using the private key to obtain a decrypted value and comparing the decrypted value to the respective value chosen based on the first networked application.

5 . The computer-implemented method of claim 2 , wherein the first networked application is one of a plurality of networked applications provided by the server and the first synthetic transaction is one of a plurality of synthetic transactions, each of the plurality of synthetic transactions directed to a respective one of the plurality of networked applications;
wherein each of the plurality of synthetic transactions includes a respective synthetic token, each of the synthetic tokens including a different respective value chosen based on the respective networked application, each of the synthetic tokens encrypted by a different pre-shared key of a plurality of pre-shared keys provided by the server, each of the plurality of pre-shared keys corresponding to a respective one of the plurality of networked applications and to a respective private key; wherein determining that the identified synthetic token in the first synthetic transaction corresponds to the first networked application comprises decrypting the identified synthetic token in the first synthetic transaction using the respective private key corresponding to the first networked application to obtain a decrypted value and comparing the decrypted value to the respective value chosen based on the first networked application.

6 . The computer-implemented method of claim 1 , wherein the identified synthetic token is generated based on a Hypertext Transfer Protocol (HTTP) endpoint address of the first networked application.

7 . The computer-implemented method of claim 1 , wherein the first networked application is a web service implemented using a REpresentational State Transfer (RESTful) Application Programming Interface (API); and
wherein the first synthetic transaction comprises an HTTP request.

8 . The computer-implemented method of claim 1 , further comprising:
receiving, at the server, a second synthetic transaction directed to the first networked application; analyzing, via the server, a header of the second synthetic transaction; identifying, via the server, a second synthetic token in the header of the second synthetic transaction in response to analyzing the header of the second synthetic transaction; determining, via the server, that the second identified synthetic token does not correspond to the first networked application; and rejecting, via the server, the second synthetic transaction in response to determining that the second identified synthetic token does not correspond to the first networked application.

9 . A server configured to provide a first networked application, the server comprising:
a network interface configured to receive a plurality of requests for the first networked application, wherein the plurality of requests includes a first synthetic transaction; and a processor communicatively coupled to the network interface and configured to: identify the first synthetic transaction based on a first synthetic token in a header of the first synthetic transaction; compare the first synthetic token to a pre-determined value for the first networked application; and exclude the first synthetic transaction from usage monitoring in response to determining that the first synthetic token corresponds to the pre-determined value for the first networked application.

10 . The server of claim 9 , wherein the first synthetic token is encrypted using a pre-shared key provided by the processor to a synthetic transaction monitoring engine via the network interface prior to generation of the first synthetic transaction by the synthetic transaction monitoring engine; and
wherein to compare the first synthetic token to the pre-determined value the processor is further configured to decrypt the first synthetic token using a private key corresponding to the pre-shared key.

11 . The server of claim 10 , wherein the first networked application is one of a plurality of networked applications provided by the server and the first synthetic transaction is one of a plurality of synthetic transactions, each of the plurality of synthetic transactions dire

Assignees

• IBM

Inventors

• Weatherill Mark N
• Bailey Andrew J
• George Randy

Classifications

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0245

  Filtering by information in the payload · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title