System and method for identifying real users behind application servers
A monitoring device and method for identifying the identity of users requesting database accesses. The data request from application servers to an application server are monitored and parsed. The SQL statements associated with the data request from the application server are also monitored and parsed, so are the SQL responses from the database server. The SQL responses are sent back to the user as data responses. The data responses are also monitored and parsed. The monitoring device matches the parsed data request with the parsed SQL statements, the parsed SQL responses, and the parsed data responses. By matching the string portion of these parsed data, the monitoring device can then identity the identity of the user making such data base request.
1. A monitoring device for identifying the user identity of an application client accessing a database server, comprising:
at least one monitoring port for connecting to at least one monitoring point and monitoring data requests from applicant clients and structure query language (SQL) instructions, from a server, captured by the at least one monitoring point;
a parser, connected to the at least one monitoring port and to a storage unit, receiving a data request from the at least one monitoring port, parsing the data request and a SQL query related to the data request, and storing the parsed data request and the parsed SQL query in the storage unit;
a comparator, connected the parser and to the storage unit, comparing the parsed data request and the parsed SQL query; and
a storage unit storing the data requests, the parsed data request, the SQL instructions, and the parsed SQL query,
wherein
the comparator compares a data portion of the parsed data request with a data portion of the parsed SQL query, and
if there is a match between the data portion of the parsed data request and the data portion of the parsed SQL query, the comparator associates the parsed SQL query with the user identity associated with the data request without using any identifier inserted by the application clients for monitoring purpose.
2. The monitoring device of claim 1 , wherein there is a first monitoring port connected to an application client and a second monitoring port connected to a application server.
3. The monitoring device of claim 1 , wherein
the at least one monitoring port captures a SQL response from an application server,
the parser parses the SQL response,
the at least one monitoring port captures a data response from the database server,
the parser parses the data response,
the comparator compares the parsed SQL response with the parsed data response; and
if there is a match between a data portion of the parsed data response and a data portion of the parsed SQL response, the comparator associates the parsed SQL response with the user identity associated with the data response.
4. The monitoring device of claim 3 , wherein the SQL response and the data response having no identifier inserted for monitoring purposes.
5. A method for identifying the user identity of an application client accessing a database server by a monitoring device, the monitoring device being connected to at least one monitoring point, the monitoring device having at least one monitoring port, a parser, a comparator, and a storage unit, comprising the steps of:
parsing a data request, with a data portion, from an application client;
parsing a structure query language (SQL) query from a server, with a data portion, related to the data request by the parser;
comparing, without using any identifier inserted by the application client for the monitoring purpose, the data portion of the parsed data request with the data portion of the parsed SQL query; and
if there is a match between the data portion of the parsed data request and the data portion of the parsed SQL query, associating the parsed SQL query with the user identity associated with the parsed data request without using any identifier inserted by the application client for the monitoring purpose.
6. The method of claim 5 , further comprising the steps of:
capturing the data request from the application client; and
capturing the SQL query from an application server.
7. The method of claim 5 , further comprising the steps of:
parsing a SQL response, with a data portion, by the parser;
parsing a data response, with a data portion, by the parser;
comparing the data portion of the parsed data response with the data portion of the parsed SQL response; and
if there is a match between the data portion of the parsed data response and the data portion of the parsed SQL response, associating the parsed SQL response with the user identity associated with the data response.
8. The method of claim 7 , further comprising the step of associating the data response with a user identity identified by a network address.