Abstract:
A method and platform for preventing unauthorized access to an application server comprises collecting access data associated with an organization, anonymizing the access data, creating identifying keys which allow the anonymized access data to be matched to its associated users, storing the identifying keys at a secure location associated with the organization, transferring the anonymized access data to an access data warehouse, and performing an analysis on the anonymized access data. The access data warehouse can be maintained in a cloud computing environment, and may aggregate anonymized access data from a plurality of organizations. An organization may detect abnormal usage patterns by analyzing its usage data and the anonymized usage data of further organizations, and may use the abnormal usage patterns to predict future events, for example intrusion attempts. An organization can automatically generate protective measures against potential threats associated with abnormal usage patterns.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation-in-part of and claims the priority benefit of U.S. patent application Ser. No. 13/430,566 filed on Mar. 26, 2012, and entitled “Client Specific Interactions with Enterprise Software Systems,” and U.S. patent application Ser. No. 14/195,659 filed Mar. 3, 2014, and entitled “Dynamically Optimized Content Display,” which in turn claims the priority benefit of U.S. Provisional Patent Application Ser. No. 61/901,331 filed Nov. 7, 2013, and entitled “Dynamically Optimized Content Display for Mobile Devices and Security Plugins”. All of the above disclosures are hereby incorporated by reference in their entirety. 
     
    
     TECHNICAL FIELD 
       [0002]    This disclosure relates generally to data processing, and more particularly, to preventing unauthorized access to application servers. 
       BACKGROUND 
       [0003]    Application servers can be vulnerable to many types of unauthorized access by both authorized users and intruders. Perpetrators of unauthorized access continually develop new tools and strategies for circumventing access controls, making prevention of unauthorized access a constant challenge. Embodiments of the present disclosure are directed to making unauthorized access to application servers easier to predict, detect, and prevent. 
       SUMMARY OF THE DISCLOSURE 
       [0004]    This summary introduces the present disclosure in a simplified form that is further described in the Detailed Description below. This summary is not intended to identify essential features of the present disclosure, nor is it intended for use as an aid in determining the scope of the claimed subject matter. 
         [0005]    In one example embodiment, a method for preventing unauthorized access to an application server is disclosed. The application server can operate within an application environment associated with an organization. The application server can collect access data associated with accesses to the application server by its users. The access data can be anonymized, making certain parts of the access data unidentifiable without matching identifying keys. At least one such identifying key can be created with which the anonymized parts of the anonymized access data can be reidentified. 
         [0006]    The anonymized access data can be transferred to an access data warehouse in a remote computing environment. The identifying keys can be retained at a secure location within the application environment. A plurality of organizations can transfer anonymized access data to the access data warehouse in the manner described above. The anonymized access data can be aggregated in the access data warehouse. Each organization can have access to only its own identifying keys, and thus can reidentify only its own anonymized access data when it retrieves anonymized access data from the access data warehouse. 
         [0007]    An analysis of the anonymized access data can be performed to identify abnormal usage patterns in the anonymized access data associated with that application&#39;s application server. The analysis can further generate protective measures adapted to protect that organization&#39;s application server from unauthorized access. The analysis can utilize the organization&#39;s identifying keys to reidentify the anonymized access data associated with that organization. Because the organization does not have access to other organizations&#39; identifying keys, it cannot reidentify the anonymized access data associated with other organizations. Thus the analysis for that organization can utilize all of the organizations&#39; anonymized access data without compromising the security of any other organization. By utilizing anonymized access data associated with a plurality of organizations, the analysis may be better able to identify patterns and trends that affect many organizations, such as emerging security threats. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]    Embodiments are illustrated by way of example, and not by limitation, in the figures of the accompanying drawings, in which like references indicate similar elements. 
           [0009]      FIG. 1  illustrates a method for preventing unauthorized access to an application server. 
           [0010]      FIG. 2  illustrates a method for preventing unauthorized access to an application server in which application servers associated with several organizations store anonymized access data in an access data warehouse located in a remote computing environment. 
           [0011]      FIG. 3  shows a platform for preventing unauthorized access to an application server. 
           [0012]      FIG. 4  shows a platform for preventing unauthorized access to an application server in which application servers associated with several organizations store anonymized access data in an access data warehouse located in a remote computing environment. 
           [0013]      FIG. 5  illustrates a method of taking protective measures in response to abnormal usage patterns. 
           [0014]      FIG. 6  is a diagrammatic representation of an exemplary machine in the form of a computer system, within which a set of instructions for causing the machine to perform any one or more of the methodologies discussed herein may be executed. 
       
    
    
     DETAILED DESCRIPTION 
       [0015]      FIG. 1  illustrates an example method  100  for preventing unauthorized access to an application server. An application server  102  associated with an organization  104  can run in an application environment  106 . The application server  102  can collect access data  108  associated with accesses to the application server  102  by its users. The access data  108  can be anonymized, creating anonymized access data  110  and at least one identifying key  112 . 
         [0016]    The anonymized access data  110  can omit an accessible form of at least one type of information contained in the access data  108 . The information contained in the access data  108  that is omitted in accessible form from the anonymized access data  110  can be referred to as “anonymized information.” The anonymized information can be recovered by reference to the anonymized access data  110  and the identifying keys  112 . The operation of recovering the anonymized information can be referred to as “identifying” the anonymized access data  110 . 
         [0017]    The anonymized information can include the identity of at least one user of the application server  102 . By reidentifying the anonymized access data  110  it can be possible to match each record in the anonymized access data to the associated user. The anonymized information may include further types of information, for example, the identity of the application server  102 , and keys or other identifying characteristics of data being requested from the application server  102 . In some embodiments the access data  108  can be collected by a plug-in  114  installed on the application server  102 . 
         [0018]    The anonymized access data  110  can be transferred to an access data warehouse  116 , located in a remote computing environment  118 , which may include a cloud computing environment. The identifying keys  112  can be stored at a secure location  120  within the application environment  106 . Protection rules  122  can govern the operation of the application server  102  or the plug-in  114  or both. The protection rules  122  can implement security policies, for example, determining the operations that various users are allowed to perform, and limiting access to the application server  102  from certain IP addresses. 
         [0019]    An analysis  124  can be performed on the anonymized access data  110 . The analysis  124  can identify at least one abnormal usage pattern  126 , and can further generate at least one protective measure  128 . The analysis  124  can utilize the identifying keys  112  to reidentify the anonymized access data  110 . The analysis  124  can be governed by at least one analytic criterion  130 . The analysis  124  can be performed automatically or on demand. The protective measures  128  can include both human-readable results such as messages, alerts, and reports, and modifications to the protection rules  122 . Modifications to the protection rules  122  can be applied automatically, or may be proposed for approval by an authorized agent of the organization  104 . In some embodiments the analysis  124  occurs in the remote computing environment  118 , which may include a cloud computing environment. 
         [0020]    In some embodiments, the access data  108  includes one or more of a request, a log-in, a user location, a user name, a role, a content, a header of a data package, a data attribute, an activity associated with content, an activity associated with a type of user, a multi-factor authentication activity, a user identification (ID), an IP address, a browser type, a date, a time, a login page, a portal content, an employee ID, an action taken, a script run, and a response. In some embodiments, the anonymized access data  110  stored in the access data warehouse  116  is formatted prior to the analysis  124 . In some embodiments, the analytic criteria  130  can include a data mining algorithm. 
         [0021]    In some embodiments, the analysis  124  can be performed in the remote computing environment  118 . In some embodiments, the analysis  124  includes comparing the anonymized access data  110  to reference access data  132  which represent events and patterns that the analysis  124  is to recognize in the anonymized access data  110 . Events represented by the reference access data  132  may include user operations, user requests, user IDs, IP address, and any other type of information contained in the anonymized access data  110 . Patterns represented by the reference access data  132  can include any combination of two or more pieces of information in the anonymized access data  110 , such as a user account sending requests from an IP address that is remote from the account user&#39;s usual location, or a user account accessing a specified type of sensitive data more frequently than it historically has done. 
         [0022]    The abnormal usage patterns  126  may include one or more of: a security breach, a threat, at least two segregated users interacting in a single online process, the interacting users having different roles which are intended to enforce segregation of duties with respect to the online process, a payee and a payer accessing the application server  102  from the same IP address, at least two users accessing the application server  102  from different locations with the same credentials, a failed login request, abnormally formatted data, and an attack from an IP address. 
         [0023]    In some embodiments, protective measures  128  include protective measures which modify the protection rules  122 . For example, if one of the abnormal usage patterns  126  represents a payee and payer accessing the application server  102  from the same IP address, a protective measure  128  can modify the protection rules  122  to temporarily or permanently block one or both users from access. In some embodiments, the analysis  124  includes predicting at least one future event, for example an intrusion attempt, based on the abnormal usage patterns  126 . The predictions may be reported in the protective measures  128 . 
         [0024]      FIG. 2  shows certain aspects of the example embodiment of  FIG. 1  in more detail. In the method  200 , an application server  202  can collect and anonymize access data, creating anonymized access data  206 , which is stored in an access data warehouse  208 . The operation of the application server  202  can be subject to a set of protection rules  204  which implement security policies. An analysis  210  can identify at least one abnormal usage pattern  212 , which may be used to generate at least one protective measure  214 . The protective measures  128  can include both human-readable results such as messages, alerts, reports, and modifications to the protection rules  122 . Modifications to the protection rules  122  can be applied automatically, or can be proposed for approval by an authorized agent of the organization  104 . 
         [0025]    The protective measures  214  can include at least one of the following: automatically modifying access  216 , issuing an alert  218 , providing a report  220 , requiring multi-factor authentication  222 , displaying a message  224 , restricting access  226 , blocking access  228 , blocking an Internet Protocol (IP) address  230 , blacklisting the IP address  232 , and generating an ad hoc query result  234 . 
         [0026]      FIG. 3  shows further aspects of the example embodiment of  FIG. 1 . In the method  300 , an application server  302  associated with an organization  304  can run in an application environment  306 . The application server  302  can collect access data  308 . The access data  308  can be anonymized, creating anonymized access data  310  and at least one identifying key  312 . The anonymized access data  310  can be transferred to an access data warehouse  314 , located in a remote computing environment  316 , which can include a cloud computing environment. The identifying keys  312  can be stored at a secure location  318  within the application environment  306 . 
         [0027]    Protection rules  320  can govern the operation of the application server  302 . The protection rules  320  can implement security policies, for example, determining the operations that various users are allowed to perform, and limiting access to the application server  302  from certain IP addresses. An analysis  322  performed for the organization  304  can identify at least one abnormal usage pattern  324  associated with the application server  302 , which can be used to generate at least one protective measure  326  for the organization  304 . 
         [0028]    Organizations  328 ,  332  can represent a plurality of further organizations that use the method  300 . Organizations  328 ,  332  can maintain application environments  330 ,  334 . It should be understood that the application environments  330 ,  334  include components which correspond to the components  302 ,  308 ,  310 ,  312 ,  318 ,  320  of application environment  306 , although those components are not shown in  FIG. 3 . An analysis  322  performed for any particular one of the further organizations  328 ,  332  can selectively identify the abnormal usage patterns  324  associated with that particular further organization&#39;s application server, which can be used to generate protective measures  326  for that particular further organization. 
         [0029]    The anonymized access data  310  associated with the organization  304  and the plurality of further organizations  328 ,  332  can be aggregated in the access data warehouse  314  in such a way that all of the anonymized access data  310  is available to the analysis  322  for the organization  304 . 
         [0030]    When the analysis  322  is performed for the organization  304  it can utilize all of the anonymized access data  310 , but it can utilize only the identifying keys  312  associated with the organization  304 , and thus can reidentify only that part of the anonymized access data  310  which is associated with organization  304 . The analysis  322  performed for the organization  304  thus can utilize all of the anonymized access data  310  without compromising the security of any of the further organizations  328 ,  332 . The analysis  322 , by utilizing anonymized access data  310  associated with a plurality of organizations, may be better able to identify patterns and trends that affect many organizations, such as emerging security threats. 
         [0031]    Similarly, when the analysis  322  is performed for any particular one of the further organizations  328 ,  332 , the analysis  322  can utilize all of the anonymized access data  310  in the access data warehouse  314 , but can utilize only the identifying keys associated with that particular further organization, and thus can reidentify only that part of the anonymized access data  310  which is associated with that particular further organization. The analysis  322  can be performed for that particular further organization thus can utilize all of the anonymized access data  310  without compromising the security of any of the further organizations  328 ,  332 . 
         [0032]      FIG. 4  shows the components of one embodiment of an unauthorized access prevention platform  400  for preventing unauthorized access to an application server according to the present disclosure. An application server  402  associated with an organization  404  can run in an application environment  406  and communicate with an anonymizing module  408 , a secure location  410 , and a set of protection rules  412  through a local bus  414 . Access data may be collected by the application server  402  and anonymized by the anonymizing module  408 , creating anonymized access data  416  and at least one identifying key  418  for the anonymized access data  416 . The identifying keys  418  can be used to reidentify the anonymized access data  416 . 
         [0033]    Anonymized information in the anonymized access data  416  can include data related to the users associated with the access data. The identifying keys  418  can be used to match the anonymized access data to its associated users. In some embodiments the access data can be collected by a plug-in  420  which is installed on the application server  402 . The anonymized access data  416  can be transferred to an access data warehouse  422  through a network connection  424  which is communicatively coupled to the local bus  414  and a remote bus  426 . The access data warehouse  422  and the remote bus  426  can be located in a remote computing environment  428 , which may include a cloud computing environment. The identifying keys  418  can be stored at a secure location  410  associated with the organization  404 . 
         [0034]    The protection rules  412 , accessible through the local bus  414 , can govern the operation of the application server  402  or the plug-in  420  or both. The protection rules  412  can implement security policies, for example, determining the operations that various users are allowed to perform, and limiting access to the application server  402  from certain IP addresses. 
         [0035]    At least one analytics package  430  is connected to the remote bus  426 . The at least one analytics package  430  may be located in the remote computing environment  428 . The at least one analytics package  430  is operable to analyze the anonymized access data  416  and the identifying keys  418 . The operation of the at least one analytics package  430  may be governed by at least one analytic criterion  432  associated with the organization  404 . The at least one analytics package  430  may perform various analytic functions automatically or on demand. 
         [0036]    The at least one analytics package  430  can further generate at least one protective measure adapted to protect the application environment  406  against the abnormal usage patterns identified by the at least one analytics package  430 . The protective measures generated by the at least one analytics package  430  can include both human-readable results such as messages, alerts, and reports, and modifications to the protection rules  412 . Modifications to the protection rules  412  can be applied automatically, or can be proposed for approval by an authorized agent of the organization  404 . 
         [0037]    Protective measures generated by the analytics package  430  can include one or more of the following: automatically modifying access, issuing an alert, providing a report, requiring multi-factor authentication, displaying a message, restricting access, blocking access, blocking an Internet Protocol (IP) address, blacklisting the IP address, and generating an ad hoc query result. 
         [0038]      FIG. 5  shows certain aspects of the example embodiment of  FIG. 4  in more detail. The platform  500 , the organization  502 , and the application environment  504  can correspond to the unauthorized access prevention platform  400 , the organization  404 , and the application environment  406  of  FIG. 4 . The application server  506 , the anonymizing module  508 , the secure location  510 , the identifying keys  512 , and the local bus  514  can correspond to the application server  402 , the anonymizing module  408 , the secure location  410 , the identifying keys  418 , and the local bus  414  of  FIG. 4 . It should be understood that the application environment  504  can include components corresponding to all of the components of the application environment  406  of  FIG. 4 , although some of those components are not shown in  FIG. 5 . 
         [0039]    The organizations  516 ,  520  can represent a plurality of further organizations that share the platform  500 , each of which can correspond to the organization  404  of  FIG. 4 . The application environments  518 ,  522  can correspond to the application environment  406  of  FIG. 4 . It should be understood that each of the application environments  518 ,  522  can include components corresponding to all of the components contained in the application environment  406  of  FIG. 4 , although those components are not shown in  FIG. 5 . 
         [0040]    A remote computing environment  524  can correspond to the remote computing environment  428  of  FIG. 4 , and include corresponding components: anonymized access data  526 , an access data warehouse  528 , a remote bus  530 , and at least one analytics package  532 . The application environment  504  can be commutatively coupled through its local bus  514  and a network  534  to the remote bus  530 . The platform components included in the application environment  504  can communicate with the access data warehouse  528  and the at least one analytics package  532  through the local bus  514 , the network  534 , and the remote bus  530 . 
         [0041]    Similarly, each of the further application environments  518 ,  522  can be communicatively coupled through its local bus and the network  534  to the remote bus  530 . The platform components contained in each of the further application environments  518 ,  522  can communicate with the access data warehouse  528  and the at least one analytics package  532  through that application environment&#39;s local bus, the network  534 , and the remote bus  530 . An analysis performed for organization  502  by the at least one analytics package  532  can selectively identify at least one abnormal usage pattern in the usage of the associated application server  506 . The at least one analytics package  532  can use the results of the analysis to generate at least one protective measure for the application server  506 . 
         [0042]    Similarly, an analysis performed by the at least one analytics package  532  for any particular one of the further organizations  516 ,  520  can identify abnormal usage patterns in the usage of the application server associated with that particular organization. The at least one analytics package  532  can use the results of the analysis to generate protective measures for the application server associated with that particular organization. The anonymized access data  526  associated with the organizations  502 ,  516 ,  520  are aggregated in the access data warehouse  528  in such a way that the at least one analytics package  532  can utilize all of the anonymized access data  526  in an analysis performed for any one of the organizations  502 ,  516 ,  520 . 
         [0043]    When the at least one analytics package  532  performs an analysis for the organization  502 , only that part of the anonymized access data  526  associated with organization  502  can be reidentified, because the at least one analytics package  532  has access only to the identifying keys  512  associated with the organization  502 , and not to the identifying keys associated with the further organizations  516 ,  520 . Similarly, when the at least one analytics package  532  performs an analysis for any particular one of the further organizations  516 ,  520 , only that part of the anonymized access data  526  associated with that particular further organization can be reidentified. Thus, the analytics package  532  can utilize the anonymized access data  526  associated with any one of the organizations  502 ,  516 ,  520  without compromising the security of any other organization. 
         [0044]      FIG. 6  is a diagrammatic representation of an exemplary machine in the form of a computer system  600 , within which a set of instructions for causing the machine to perform any one or more of the methodologies discussed herein may be executed. In various exemplary embodiments, the machine operates as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machine may operate in the capacity of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a portable music player (e.g., a portable hard drive audio device such as an Moving Picture Experts Group Audio Layer 3 (MP3) player), a web appliance, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein. 
         [0045]    The exemplary computer system  600  includes a processor or multiple processors  602  (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), and a main memory  608  and static memory  614 , which communicate with each other via a bus  628 . The computer system  600  may further include a video display  606  (e.g., a liquid crystal display (LCD)). The computer system  600  may also include an alphanumeric input device  612  (e.g., a keyboard), a cursor control device  616  (e.g., a mouse), a voice recognition or biometric verification unit (not shown), a disk drive unit  620 , a signal generation device  626  (e.g., a speaker) and a network interface device  618 . The computer system  600  may further include a data encryption module (not shown) to encrypt data. 
         [0046]    The disk drive unit  620  includes a computer-readable medium  622  on which is stored one or more sets of instructions and data structures (e.g., instructions  610 ) embodying or utilizing any one or more of the methodologies or functions described herein. The instructions  610  may also reside, completely or at least partially, within the main memory  608  and/or within the processors  602  during execution thereof by the computer system  600 . The main memory  608  and the processors  602  may also constitute machine-readable media. 
         [0047]    The instructions  710  may further be transmitted or received over a network  724  via the network interface device  718  utilizing any one of a number of well-known transfer protocols (e.g., HTTP). 
         [0048]    While the computer-readable medium  722  is shown in an exemplary embodiment to be a single medium, the term “computer-readable medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database and/or associated caches and servers) that store the one or more sets of instructions. The term “computer-readable medium” shall also be taken to include any medium that is capable of storing, encoding, or carrying a set of instructions for execution by the machine and that causes the machine to perform any one or more of the methodologies of the present application, or that is capable of storing, encoding, or carrying data structures utilized by or associated with such a set of instructions. The term “computer-readable medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical and magnetic media, and carrier wave signals. Such media may also include, without limitation, hard disks, floppy disks, flash memory cards, digital video disks, random access memory (RAM), read only memory (ROM), and the like. 
         [0049]    The exemplary embodiments described herein may be implemented in an operating environment comprising software installed on a computer, in hardware, or in a combination of software and hardware. 
         [0050]    Although embodiments have been described with reference to specific exemplary embodiments, it will be evident that various modifications and changes may be made to these embodiments without departing from the broader spirit and scope of the system and method described herein. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.