Patent ID: 7900257

Claim:
A method to enable detection of unauthorized access to a platform, the method comprising: providing at least one parameter that is associated with an authentication process; encrypting the at least one parameter to form at least one audit identifier; recording an audit entry in an audit log, the audit entry comprising the at least one audit identifier, an associated audit event and an associated unique device identifier, wherein the audit entry is associated with a principal seeking authentication; and sending the audit entry to an auditing service over a network, the auditing service being configured to gather and analyze a plurality of audit entries from a plurality of platforms, the sending enabling the auditing service to analyze the recorded audit entry, wherein the auditing service tracks principal movement and login ID used at each platform of a plurality of platforms by analyzing audit entries associated with the at least one audit identifier and with the principal seeking authentication, the analyzing the associated audit entries comprising: identifying within the associated audit entries, at least one audit entry that contains an audit event that is a switch event, the switch event indicating that the principle seeking authentication has switched from a first login ID to a second login ID; and deducing that the principle is masquerading as a user associated with the second login ID based on correlation of the switch event with audit identifiers, audit events and unique device identifiers contained in the associated audit entries.