Patent ID: 8141138

Claim:
A method for auditing access of one or more resources by a client, the method comprising: receiving at a single sign-on server from the client a request to access one or more of the resources; assigning with the single sign-on server a session identifier to a user of the client requesting to access one or more of the resources, the session identifier associated with a user identifier for the user of the client; recording the session identifier and user identifier with the single sign-on server in a sign-on repository maintained by the single sign-on server; providing the user identifier and session identifier to the client from the single sign-on server; redirecting the client from the single sign-on server to a server of a plurality of servers other than the single sign-on server; providing the user identifier and session identifier to one or more applications managing the one or more resources requested by the client, the one or more applications executed by the server other than the single sign-on server and wherein each of the plurality of servers further executes a logging agent and wherein each logging agent records in a central log data repository a record of each access of the one or more resources managed by the one or more applications of the server executing the logging agent, wherein the central log data repository is separate from the sign-on repository; accessing the one or more resources requested by the client with the one or more applications based on the request; logging a record of said accessing of the one or more resources requested by the client in the central log data repository with the logging agent of the server executing the one or more applications managing the one or more resources requested by the client, wherein the record includes the user identifier and the session identifier; reading with an auditor system a plurality of records of said accessing of the one or more resources from the central log repository; correlating with the auditor system two or more of the plurality of records of said accessing of the one or more resources based on the user identifier and session identifier of each of the plurality of records; determining with the auditor system, based on the correlated two or more records and a set of rules defining prohibited activity, whether a prohibited activity is being performed by a user with more than one active session, wherein the set of rules defining prohibited activity is maintained by the auditor system and defines patterns of actions related to malicious activity and wherein determining whether a prohibited activity is being performed comprises comparing the correlated two or more records to the set of rules.