Data access logging

Patent metadata

Field	Value
Publication number	US-9396085-B2
Application number	US-201213679863-A
Country	US
Kind code	B2
Filing date	Nov 16, 2012
Priority date	Nov 16, 2012
Publication date	Jul 19, 2016
Grant date	Jul 19, 2016

Abstract

Data characterizing a plurality of data accesses of objects at one or more log points is received by a data access framework. Thereafter, data accesses requiring logging are identified and one or more corresponding pre-specified attributes are then logged. Related apparatus, systems, techniques and articles are also described.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by a data access log framework, data characterizing a plurality of data accesses of objects at one or more log points originating from at least one channel;
identifying data accesses requiring logging by:
first determining, for each data access by a log writer during runtime, which fields should be logged for the data access to fulfill country specific legal requirements,
second determining, after the first determining, if values should be logged for the determined fields, and
logging the determined fields and the determined values;

logging one or more pre-specified attributes for each identified data access requiring logging, the attributes including a purpose of the logging, a configuration key of a filter associated with the logging, and a log domain for grouping semantically identical determined fields; and
determining, using at least one of an automated pattern recognition and a random sampling, that at least one data access in the plurality of data accesses represents an unauthorized data access, and generating an alert indicative of the unauthorized data access, wherein at least one authorization restriction is used to restrict access to at least one logged data access;
wherein the at least one channel is a user interface channel, and wherein corresponding log points for the user interface channel comprise both: at a backend server after receiving an event from a user interface, and at the backend server after responding to the event from the user interface.

2. A method as in claim 1 , wherein the data accesses are read accesses.

3. A method as in claim 1 , wherein the data accesses are write accesses.

4. A method as in claim 1 , wherein the identifying comprises:
checking, for each data access, whether data access logging is enabled for a corresponding object and an entity providing the accessed data.

5. A method as in claim 1 , wherein
the identifying further comprises:
determining which fields are required for condition evaluation;
determining, using a pre-defined rule set, whether the determined fields require logging; and

further comprising:
logging values for the determined fields.

6. A method as in claim 5 , wherein the pre-defined rule set is specified by log configuration settings.

7. A method as in claim 6 , wherein the log configuration settings are generated using at least one configuration template.

8. A method as in claim 1 , wherein the logging comprises:
storing values for the determined fields in at least one data buffer and/or data store.

9. A method as in claim 8 , further comprising:
asynchronously transferring the buffered values to at least one data store.

10. A method as in claim 8 , further comprising:
generating at least one report based on the stored values.

11. A method as in claim 1 , wherein at least one channel is a remote application programming interface (API) channel, and wherein corresponding log points for the remote API channel comprise one or more of: at a client upon initiating a request to a server, at the server upon receiving the request from the client, at the server upon responding to the request from the client, and at the client receiving the response from the server.

12. A method as in claim 1 , wherein the user interface channel comprises a graphical user interface.

13. A method as in claim 1 , wherein the user interface channel comprises an audio and/or audiovisual channel.

14. A method as in claim 1 , further comprising:
matching a structure defined by the data characterizing a plurality of data accesses of objects at one or more log points with a pre-defined data access log configuration;
wherein the pre-defined data access log configuration specifies the pre-specified attributes to be logged.

15. A method as in claim 1 , wherein the receiving, identifying, and logging are implemented by at least one data processor forming part of at least one computing system.

16. A non-transitory computer program product storing instructions which, when executed by one or more hardware data processors forming part of one or more computing systems, result in operations comprising:
receiving, by a data access log framework, data characterizing a plurality of data accesses of objects at one or more log points;
identifying data accesses requiring logging by:
first determining, for each data access by a log writer during runtime, which fields should be logged for the data access to fulfill country specific legal requirements,
second determining, after the first determining, if values should be logged for the determined fields, and
logging the determined fields and the determined values; and

logging one or more pre-specified attributes for each identified data access requiring logging by first logging raw data and subsequently and asynchronously filtering the logged raw data to result in final logging data, the attributes including a purpose of the logging, a configuration key of a filter associated with the logging, and a log domain for grouping semantically identical determined fields; and
determining, using at least one of an automated pattern recognition and a random sampling, that at least one data access in the plurality of data accesses represents an unauthorized data access, and generating an alert indicative of the unauthorized data access, wherein at least one authorization restriction is used to restrict access to at least one logged data access.

17. A system comprising:
one or more data processors; and
memory storing instructions, which when executed by at least one data processor, result in operations comprising:
receiving, by a data access log framework, data characterizing a plurality of data accesses of objects at one or more log points;
identifying data accesses requiring logging by:
first determining, for each data access by a log writer during runtime, which fields should be logged for the data access to fulfill country specific legal requirements,
second determining, after the first determining, if values should be logged for the determined fields, and
logging the determined fields and the determined values; and

logging one or more pre-specified attributes for each identified data access by first buffering the pre-specified attributes in a data buffer and subsequently and asynchronously flushing the buffered pre-specified attributes in the data buffer into a data store, the attributes including a purpose of the logging, a configuration key of a filter associated with the logging, and a log domain for grouping semantically identical determined fields; and
determining, using at least one of an automated pattern recognition and a random sampling, that at least one data access in the plurality of data accesses represents an unauthorized data access, and generating an alert indicative of the unauthorized data access, wherein at least one authorization restriction is used to restrict access to at least one logged data access.

18. A method as in claim 1 , wherein log entries corresponding to a same event from the user interface include a same correlation identifier (ID), the correlation ID being indicative of the same behavior of data, corresponding to the log entries, in the user interface and at least another user interface using the data corresponding to the correlation ID.

19. A method as in claim 1 , wherein the attributes include at least one data access status being indicative of whether a data access is successful.

Assignees

• Hoffmeister Fritz
• Boehrer Otto
• Gales Frank
• Chrosziel Florian
• Hassforther Jona
• Kunz Thomas
• Rossmanith Stefan
• Rodeck Marco
• Zink Rene
• Sap Se

Inventors

• Hoffmeister Fritz
• Boehrer Otto
• Gales Frank
• Chrosziel Florian
• Hassforther Jona
• Kunz Thomas
• Rossmanith Stefan
• Rodeck Marco
• Zink Rene

Classifications

• G06F16/2358

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06F11/3034

  where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097) · CPC title

• G06F11/3072 Primary

  where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting · CPC title

• G06F17/30368

  Physics · mapped topic