In order to track communications between a device and a server, conventional systems employ a “Man-in-the-Middle” technique (MITM). A middle server, between the device and server, acts as a recorder for the communication(s) that occurs between the device and the server. The device is configured to talk with the recorder and the recorder forwards all requests up to the server. Any information the server sends the recorder is then forwarded on to the device. Both the device and the server do not realize they are not directly communicating with each other. Thus, MITM is a technique that simultaneously fools two parties into thinking they are communicating with each other while, in fact, they are both talking to the “Man-in-the-Middle.”
The MITM approach is typically used to be able to read a public-key encrypted conversation. It relies on having complete access to all messages between the two parties wanting to communicate, e.g., parties A and B. All messages between A and B must pass between the “Man-in-the-Middle,” M. Upon the start of communication, the public keys must be exchanged between A and B. This is where M starts to interfere by creating its own key-pairs, for both A and B, that are distributed back to A and B in a way that M is able to decrypt, read, and encrypt as the messages pass by. A and B will think they are communicating though a secure channel, but only the channel between A and M, and M and B is actually secured and M can read and modify all of their messages. Since the parties do not detect the presence of an intermediary, such conventional systems present security concerns such as eavesdropping on the communications.
An eavesdropper is a network device, also known as a “sniffer,” that can implement MITM to intercept information being transmitted between parties. This sniffing takes place without the knowledge of either the client or server and is called passive monitoring. User data, including passwords, can be stolen this way if insecure protocols like telnet and FTP are employed. During such a MITM attack, if the first connection and host key exchange between a client and a particular host is compromised, the MITM attack fools both the client and server into thinking that they are communicating directly with one another when, in fact, an attacker is actually intercepting all traffic between the two parties. This technique usually requires very active involvement by the attacker. Often, it requires the constant involvement of the attacker from beginning to end of the communication in order to avoid detection. MITM is often attempted when the attacker desires communication with a system under the identity of a particular user. Often this user has some sort of secret information that the attacker cannot acquire.
Therefore, there is a need for systems that allow for the tracking of conversations between a device and server without relying on an intermediary party to record and forward the data exchanged.
The following presents a simplified summary of the invention in order to provide a basic understanding of some aspects of the invention. This summary is not an extensive overview of the invention. It is intended to neither identify key or critical elements of the invention nor delineate the scope of the invention. Its sole purpose is to present some concepts of the invention in a simplified form as a prelude to the more detailed description that is presented later.
The subject invention, in one aspect thereof, relates to a system and/or methodology that can record and playback server/device communications from a device. Such playback from the device can be implemented without a network connection and can simulate the actions of a real server that has previously interacted with the device. The system provides for a device to communicate with at least one server and a module integrated with the device to playback at least one recorded server response to the device. Such played back recorded server responses can be matched to device responses. Further, the system can provide for a component integrated with the device to record server responses and device responses on the device and to store the recorded responses in a memory of the device. The server/device communication responses can comprise of one or more layers implemented to effectuate data transmission, formatting, organization, and/or packing and unpacking. As an example, such layers can be Transmission Control Protocol/Intemet Protocol (TCP/IP) layers, Secure Sockets Layers (SSL), transport code layers, and the like.
A trigger file in the device can further provide by the system to be detected by an initial server response. Upon detection of the trigger file, an application program interface can be called to begin recording the server/device communications. The device can include a hook that facilitates the component to capture server response data of the at least one server response and/or device response data of the at least one device response, while recording the server/device communications. In one aspect, such captured data is located above the TCP/IP layer, above the SSL, but below the transport code layers. The hook can also facilitate the module to forward recorded server responses to the device during playback. In addition, the system can include a password handler component to facilitate the component in detecting password characters in order to substitute the password characters with random characters in device memory. During playback, the password handler component can also facilitate the module to playback a positive response to the device if the module detects password characters in a device response.
In another aspect, the subject invention relates to a server communication playback method. The method can include transmitting a conversation between a device and at least one server, recording the conversation on the device, storing a record of the conversation in device memory as a plaintext file, and executing the record back from the device without a network connection and at a device state equal to when the plaintext file was created.
In order to return the device to the desired state, the device can be staged. To facilitate staging of the device with an activated Send/Receive button of the device, the invention can create the same values the device had when the plaintext log file was created. Thus, the invention can set incoming/outgoing server names, usemames, passwords, day filters, etc. Folders or messages that were sunk down to the device via previous server sessions can be re-created. Outgoing mails and/or draft mails can be recreated within respective device folders. Device registries can be set to appropriate values, paths, names, headers, and/or filenames, etc.
Upon staging the device to an identical state from a point when the plaintext log file was created, the communications played back from the device can match up within the plaintext file. Playback can match up all outgoing device communications with the corresponding response from the server and ‘play’ that response back to the device. In other words, the invention can allow the device to ‘think’ it is receiving ‘played’ response from the server and act accordingly. Such identical playback can allow for reproduction of responses from a server that developers can employ in order to identify bugs, for example. Upon a developer implementing a fix for the problem, a tester can take that same log file and play it back to confirm the device now correctly handles what was once a failing case. At a later point in time, the tester can replay that same log to confirm the fixed functionality had not regressed from the fixed state.
The following description and the annexed drawings set forth in detail certain illustrative aspects of the invention. These aspects are indicative, however, of but a few of the various ways in which the principles of the invention may be employed and the subject invention is intended to include all such aspects and their equivalents. Other advantages and novel features of the invention will become apparent from the following detailed description of the invention when considered in conjunction with the drawings.
As utilized in this application, terms “component,” “system,” “interface,” “module,” “layer,” “message,” “device” and the like are intended to refer to a computer-related entity, either hardware, software (e.g., in execution), and/or firmware. For example, a module can be a process running on a device, a processor, an object, an executable, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component, and a conversation can be exchange of information between and/or among a device and one or more servers. One or more components can reside within a process and a component can be localized on one computer and/or distributed between two or more computers. Furthermore, one or more modules can reside and/or be integrated with a device and/or other modules. As utilized in this application, terms such as “conversation,” “communication,” “layer,” and “session,” and the like are intended to refer to the exchange of data between and/or among a device and one or more servers. In addition, terms such as “response,” “message,” and “data” can further relate to information exchange between a server and a device and can be used interchangeably.
In addition, as utilized in this application, the following discussion relates to, but does not limit, services and communications between a device and server in accordance with one or more aspects of the subject invention. Accordingly, Post Office Protocol 3 (POP3) is a standard mail server commonly used on the Internet. It can provide a message store that holds incoming e-mail until users log on and download it. POP3 is a simple system with little selectivity. All pending messages and attachments are downloaded at the same time. POP3 uses the SMTP, infra, messaging protocol. Further, Internet Messaging Access Protocol (IMAP) is a standard mail server that can be widely used on the Internet. It provides a message store that holds incoming e-mail until users log on and download it. IMAP4 is the latest version.
IMAP is more sophisticated than the Post Office Protocol (POP3) mail server. IMAP messages can be archived in folders, mailboxes can be shared, and a user can access multiple mail servers. There can also better integration with Multipurpose Internet Mail Extensions (MIME), which is used to attach files. For example, users can read only the headers in the message without having to automatically accept and wait for attached files to download that they do not want. Both IMAP and POP accept SMTP-formatted messages that have been routed across the Internet.
Simple Mail Transfer Protocol (SMTP) is often considered the standard e-mail protocol on the Internet. It is a TCP/IP protocol that defines the message format and the message transfer agent (MTA), which stores and forwards the mail. SMTP was originally designed for only ASCII text, but MIME and other encoding methods enable program and multimedia files to be attached to e-mail messages. SMTP servers route SMTP messages throughout the Internet to a mail server, such as POP3 or IMAP4, which provides a message store for incoming mail.
A Secure Sockets Layer (SSL) can be employed to provide privacy and reliability between two communicating entities. The protocol can be composed of two layers. At the lowest level, layered on top of a common transport protocol (e.g. TCP), is an SSL Record Protocol. The SSL Record Protocol is employed for encapsulation of various higher-level protocols. One such encapsulated protocol, an SSL Handshake Protocol, can enable the first and second party to authenticate each other and to negotiate an encryption algorithm and cryptographic keys before an application protocol transmits or receives its first byte of data. An advantage of SSL is that it is application protocol independent.
The subject invention is now described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the subject invention. It may be evident, however, that the subject invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing the subject invention.
The recorded response 120 can be, for example, a recorded server response from a previous server session. When the device 105 is set to a state when the recorded response 120 was logged, the playback module 125 can play the recorded response 120 back to the device 105 in order to simulate the server while not requiring the device 105 to maintain a network connection. Thus, after the device 105 detects that it is at a device state equal to when the recorded response 120 was logged in device memory, the playback module 125 can access the recorded response 120 and play it back by sending it to the response buffer 110. The response buffer 110 can intake not only recorded responses 120 but also actual responses sent during actual sessions with one or more servers.
The playback module 125 plays back the recorded response 120 to the device 105 via the response buffer 110. The device processor 115 can process the data of recorded response 120 and produces a corresponding device response. The playback module 125 can match up the corresponding device response with another recorded response and ‘play’ that response back to the response buffer 110 without a network connection. Thus, the device 105 behaves as though it is actually communicating with a server, without a network connection. It is to be appreciated that the recorded response 120 can be a data, a data packet, a signal, and/or message sent between the device 105 and a server. In addition, the device 105 is not limited to storing only one recorded response 120 and can record and store plurality of responses.
In operation, the server 205 can send an initial server message 215 to the device 210. Upon the initial server message detecting a trigger file maintained by the device 210, the device 210 can call an application program interface to trigger a recording of the conversation between the server 205 and the device 210. Such a conversation can entail an exchange of a plurality of messages 215, 220. When one or more server messages reach the device 210, each message can placed in the buffer 225 for processing. The hook module 245 can coordinate with the record component 230 to filter and capture data from the server messages 215, 220 in the buffer 225. In addition, the password handler component 250 coordinates with the record component 230 to replace any password information in the captured data with garbage data in order to provide security during playback. The record component can place the captured data in the message log 240. The message log 240 can be, for example, a plaintext file as a recording of each server message and device message (e.g., 215, 220) exchanged by the device 210 and server 205 during a conversation. The message log 240 can include the captured data of each server and/or device message (e.g., 215, 220). As well, the message log 240 can include the message data filtered by the hook module 245. The device 210 is not limited to storing one message log 240, nor is the device 210 limited to interacting with one server 205. In addition, it is understood that the device 210 can engage in a plurality of conversations with a plurality of servers, and can concurrently record such conversations to be stored in the message log 240 for future playback.
In the aspect illustrated in
Continuing with the example, each device 410, 430, 435 can record a POP3/IMAP4/SMTP server/device communication. The recording of the communication can occur on the device, above the SSL and TCP/IP layers, but below the transport code that actions on the data received from the server (e.g., unpack a message, parse a folder list, etc.). The recorded data can be stored on the device in a log file as a plaintext file located in a ToxicLogs directory, for example. One recording situation, as an example, occurs from a fresh device with its first sync to a server. This can eliminate several staging challenges that can occur later (e.g., reproducing existing folders/messages on the device).
A trigger capable of recording on each of the devices 410, 430, 435 can be a detection of the presence of a ToxicD.dll device file, for example, as a trigger file. If this file is found by the POP3/IMAP4/SMTP transport, it will call a record application program interface within the device it is interacting with in order to begin recording server/device communications. In order to minimize security concerns regarding password disclosure, the record component 415 of each device can been special cased to handle writing a password to the plaintext log. When the component 415 detects a password being written, it can write garbage characters into the plaintext file instead. It is understood that each device 410, 430, 435 can record independently of each other, and that the respective plaintext files of each device 410, 430, 435 can be distinct.
Each device 410, 430, 435 can also playback the plaintext log it previously recorded. This simulates a real server without having a network connection or an actual connection to the server that the fault, for example, originated on. To begin playback on a device, one or more registry keys can be set and the device can be staged exactly the way it was when the plaintext log file was recorded. Staging each device 410, 430, 435 can include, for example, but is not limited to, the following: (1) the POP3IMAP4SMTP service of the server cluster 405 to be created with the same values it had when the plaintext log file was created in order to set the incoming/outgoing server names, usernames, passwords, day filters, etc., (2) folders or messages that were sunk down to the device via previous server sessions to be staged (or recreated), (3) outgoing mails or draft mails can be recreated within the respective folders, (4) the registry DWORD value SOFTWARE\Inbox\ToxicReplayFlag can be set to 1, (5) the registry STRING value ToxicLogDir can be set to the path of the log file, (6) the registry STRING value SOFTWARE\Inbox\SMTPLog can be set to the name of the SMTP log filename, (7) the registry STRING value SOFTWARE\Inbox\IMAPHeaderLog and registry STRING value SOFTWARE\Inbox\IMAPBodyLog can be set to the respective IMAP header and body log filename, (8) the registry STRING value SOFTWARE\ Inbox\POP3Log can be set to the POP3 log filename. Finally, it is understood that the staging of a device can be independent of other devices in the testing matrix 400.
When staging of each device 410, 430, 435 is sufficient, each device 410, 430, 435 can be in the identical state at when each plaintext log was created. Thus, any communications each device 410, 430, 435 sends out can match up within the log files. The playback module 420 of device 410, for example, can match up all outgoing communications with the corresponding response from the server and ‘play’ that response back to device 410. Each device 410, 430, 435,during playback, can think it is receiving a response from a server and can act accordingly. This identical playback can allow the reproduction of the same response from a server that developers can reproduce a problem to identify a fix. Once a developer has implemented a fix for the problem, a tester can take that same plaintext log file and play it back to confirm a device 410, 430, 435 now correctly handles what was once a failing case. At a later point in time, the tester can replay that same log to confirm the fixed functionality had not regressed from the fixed state.
At least one of the novel aspects of the subject invention utilized by testing matrix 405 is that record and playback can be solely device based. The playback can occur on each device 410, 430, 435 before the TCP/IP layer is actually used, for example. For example, in accordance with the invention, a network connection is not required to utilize the playback feature. Removing the requirement for a network connection means that recorded logs from any server on any network can be used.
As noted in the aspects described supra, actual passwords are not included within the log files. Instead, when each device 410, 430, 435 receives the password from the device during playback, it can respond back with a positive response. Meaning that if device 430 sends a different password than when the recording was originally made, the playback module of device 430 can assume the original correct password had been sent.
Further, artificial intelligence components 440, 445, 450 (e.g., explicitly and/or implicitly trained classifiers) can be employed with each device 410, 430, 435, respectively, in connection with performing inference and/or probabilistic determinations and/or statistical-based determinations as in accordance with one or more aspects of the subject invention. The term “inference” refers generally to the process of reasoning about or inferring states of the system, environment, and/or tester from a set of observations as captured via events and/or data. Inference can be employed to identify a specific context or action, or can generate a probability distribution over states, for example. The inference can be probabilistic-that is, the computation of a probability distribution over states of interest based on a consideration of data and events. Inference can also refer to techniques employed for composing higher-level events from a set of events and/or data. Such inference results in the construction of new events or actions from a set of observed events and/or stored event data, whether or not the events are correlated in close temporal proximity, and whether the events and data come from one or several event and data sources. Various classification schemes and/or systems (e.g., support vector machines, neural networks, expert systems, Bayesian belief networks, fuzzy logic, data fusion engines . . . ) can be employed in connection with performing automatic and/or inferred action in connection with the testing matrix 400. In addition, artificial intelligence components 440, 445, 450 can be employed to determine whether to have the respective device 410, 430, 435 to record depending on a number of factors, such as, user identity, user behavior, user information, device type, data type, and data traffic, etc.
In order to provide additional context for implementing various aspects of the subject invention,
Moreover, those skilled in the art will appreciate that the inventive methods may be practiced with other computer system configurations, including single-processor or multi-processor computer systems, minicomputers, mainframe computers, as well as personal computers, hand-held computing devices, microprocessor-based and/or programmable consumer electronics, and the like, each of which may operatively communicate with one or more associated devices. The illustrated aspects of the invention may also be practiced in distributed computing environments where certain tasks are performed by remote processing devices that are linked through a communications network. However, some, if not all, aspects of the invention may be practiced on stand-alone computers. In a distributed computing environment, program modules may be located in local and/or remote memory storage devices.
One possible communication between a client 910 and a server 920 can be in the form of a data packet adapted to be transmitted between two or more computer processes. The system 900 includes a communication framework 940 that can be employed to facilitate communications between the client(s) 910 and the server(s) 920. The client(s) 910 are operably connected to one or more client data store(s) 950 that can be employed to store information local to the client(s) 910. Similarly, the server(s) 920 are operably connected to one or more server data store(s) 930 that can be employed to store information local to the servers 940.
With reference to
The system bus 1018 can be any of several types of bus structure(s) including the memory bus or memory controller, a peripheral bus or external bus, and/or a local bus using any variety of available bus architectures including, but not limited to, Industrial Standard Architecture (ISA), Micro-Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Card Bus, Universal Serial Bus (USB), Advanced Graphics Port (AGP), Personal Computer Memory Card International Association bus (PCMCIA), Firewire (IEEE 1094), and Small Computer Systems Interface (SCSI).
The system memory 1016 includes volatile memory 1020 and nonvolatile memory 1022. The basic input/output system (BIOS), containing the basic routines to transfer information between elements within the computer 1012, such as during start-up, is stored in nonvolatile memory 1022. By way of illustration, and not limitation, nonvolatile memory 1022 can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory 1020 includes random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM).
Computer 1012 also includes removable/non-removable, volatile/non-volatile computer storage media.
It is to be appreciated that
A user enters commands or information into the computer 1012 through input device(s) 1036. Input devices 1036 include, but are not limited to, a pointing device such as a mouse, trackball, stylus, touch pad, keyboard, microphone, joystick, game pad, satellite dish, scanner, TV tuner card, digital camera, digital video camera, web camera, and the like. These and other input devices connect to the processing unit 1014 through the system bus 1018 via interface port(s) 1038. Interface port(s) 1038 include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). Output device(s) 1040 use some of the same type of ports as input device(s) 1036. Thus, for example, a USB port may be used to provide input to computer 1012, and to output information from computer 1012 to an output device 1040. Output adapter 1042 is provided to illustrate that there are some output devices 1040 like monitors, speakers, and printers, among other output devices 1040, which require special adapters. The output adapters 1042 include, by way of illustration and not limitation, video and sound cards that provide a means of connection between the output device 1040 and the system bus 1018. It should be noted that other devices and/or systems of devices provide both input and output capabilities such as remote computer(s) 1044.
Computer 1012 can operate in a networked environment using logical connections to one or more remote computers, such as remote computer(s) 1044. The remote computer(s) 1044 can be a personal computer, a server, a router, a network PC, a workstation, a microprocessor based appliance, a peer device or other common network node and the like, and typically includes many or all of the elements described relative to computer 1012. For purposes of brevity, only a memory storage device 1046 is illustrated with remote computer(s) 1044. Remote computer(s) 1044 is logically connected to computer 1012 through a network interface 1048 and then physically connected via communication connection 1050. Network interface 1048 encompasses wire and/or wireless communication networks such as local-area networks (LAN) and wide-area networks (WAN). LAN technologies include Fiber Distributed Data Interface (FDDI), Copper Distributed Data Interface (CDDI), Ethernet, Token Ring and the like. WAN technologies include, but are not limited to, point-to-point links, circuit switching networks like Integrated Services Digital Networks (ISDN) and variations thereon, packet switching networks, and Digital Subscriber Lines (DSL).
Communication connection(s) 1050 refers to the hardware/software employed to connect the network interface 1048 to the bus 1018. While communication connection 1050 is shown for illustrative clarity inside computer 1012, it can also be external to computer 1012. The hardware/software necessary for connection to the network interface 1048 includes, for exemplary purposes only, internal and external technologies such as, modems including regular telephone grade modems, cable modems and DSL modems, ISDN adapters, and Ethernet cards.
What has been described above includes examples of the subject invention. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the subject invention, but one of ordinary skill in the art may recognize that many further combinations and permutations of the subject invention are possible. Accordingly, the subject invention is intended to embrace all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims.
In particular and in regard to the various functions performed by the above described components, devices, circuits, systems and the like, the terms (including a reference to a “means”) used to describe such components are intended to correspond, unless otherwise indicated, to any component which performs the specified function of the described component (e.g., a functional equivalent), even though not structurally equivalent to the disclosed structure, which performs the function in the herein illustrated exemplary aspects of the invention. In this regard, it will also be recognized that the invention includes a system as well as a computer-readable medium having computer-executable instructions for performing the acts and/or events of the various methods of the invention.
In addition, while a particular feature of the invention may have been disclosed with respect to only one of several implementations, such feature may be combined with one or more other features of the other implementations as may be desired and advantageous for any given or particular application. Furthermore, to the extent that the terms “includes,” and “including” and variants thereof are used in either the detailed description or the claims, these terms are intended to be inclusive in a manner similar to the term “comprising.”