# US 10,313,371 B2 · System and method for controlling and monitoring access to data processing applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,371 B2 - Document ID: US10313371B2 - Status: Granted - Kind: B2 - Application number: 13/111,572 - Filed: 2011-05-19 - Published: 2011-12-22 - Granted: 2019-06-04 - Earliest claimed: 2010-05-21 - Assignees: CyberArk Software Ltd. - Applicants: Ben Matzkel; Maayan Tal; Aviad Lahav - Inventors: Ben Matzkel; Maayan Tal; Aviad Lahav - Web page: https://patentgrep.com/patent/US10313371B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 67/561: Adding application-functional data or data for application control, e.g. adding metadata - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for auditing data. A first request, the request including at least one data item and generated at a client may be received. The at least one data item may be processed to produce at least one processed data item. A second request may be generated based on the first request and on the processed data items. The second request may be forwarded to a server. ## Claims ### Claim 1 A system for auditing data, the system comprising: a mediator system in communication with a client and a network resource, the mediator system comprising a non-transitory computer readable medium including instructions that, when executed by a first processor, cause the processor to perform operations comprising: identifying an original communication generated at said client, said original communication including at least one data item including client data; processing said at least one data item to produce at least one first processed data item including control information identifying a record associated with the client data, wherein the record is stored on the network resource; generating a modified communication comprising the client data from the original communication and the at least one first processed data item to allow auditing of the processed data item over time; and forwarding said modified communication to said network resource. ### Claim 2 (depends on 1) The system of claim 1, wherein the instructions cause the first processor, when processing said at least one data item, to perform at least one of the following: include a time indication in said at least one first processed data item; include an originator client identity in said at least one first processed data item; or include at least one read-time instruction in said at least one first processed data item. ### Claim 3 (depends on 1) The system of claim 1, wherein the instructions cause the first processor, when processing said at least one data item, to encrypt said at least one data item to provide at least one encrypted data item, and encoding said at least one encrypted data item using a textual encoding scheme. ### Claim 4 (depends on 1) The system of claim 1, wherein the instructions cause the first processor, when processing said at least one data item, to include a statistically rare identifier in said at least one first processed data item. ### Claim 5 (depends on 1) The system of claim 1, wherein the instructions cause the first processor, when processing said at least one data item, to truncate said at least one first processed data item to a maximal data item length. ### Claim 6 (depends on 1) The system of claim 1, further including a reverse mediator system, said reverse mediator system comprising a second processor and a memory, the second processor configured to: accept a response communication generated at said network resource, said response communication including at least one second processed data item comprising user data and control information identifying a record associated with the client data; process said at least one second processed data item to provide at least one unprocessed data item having the control information removed; and generate a modified response communication based on said response communication and on said unprocessed data item. ### Claim 7 (depends on 6) The system of claim 6, wherein the second processor, when processing said at least one second processed data item, is configured to generate and provide event information. ### Claim 8 (depends on 7) The system of claim 7, wherein said event information includes at least one of: an originating user identity, a reading user identify, a time of reading of a data item, a time of writing of a data item, and a read-time instruction. ### Claim 9 (depends on 6) The system of claim 6, wherein processing said at least one second processed data item, comprises associating a record identifier included in said at least one second processed data item with a record identifier included in said response communication and storing a parameter related to the associating in a storage system. ### Claim 10 (depends on 6) The system of claim 6, wherein the second processor is configured to prevent an access to the at least one unprocessed data item based on processing the at least one second processed data item. ### Claim 11 (depends on 1) The system of claim 1, wherein processing said at least one data item further comprises deriving auditing information. ### Claim 12 (depends on 1) The system for auditing data of claim 1, wherein the operations further comprise: controlling access to the at least one first processed data item based on the control information. ### Claim 13 A method of auditing data, the method comprising: identifying an original communication by a client, said original communication including at least one data item including client data; processing said at least one data item to produce at least one first processed data item including control information identifying a record associated with the client data, wherein the record is stored on a network resource; and generating a modified communication comprising the client data from the original communication and the at least one first processed data item to allow auditing of the processed data item over time; and forwarding said modified communication to the network resource. ### Claim 14 (depends on 13) The method of claim 13, wherein processing at least one data item to provide at least one first processed data item includes at least one of: including a time indication in said at least one first processed data item; including an originator client identity in said at least one first processed data item; or including at least one read-time instruction in said at least one first processed data item. ### Claim 15 (depends on 13) The method of claim 13, wherein processing at least one data item to provide at least one first processed data item includes encrypting said at least one data item to provide at least one encrypted data item, and encoding said at least one encrypted data item using a textual encoding scheme. ### Claim 16 (depends on 13) The method of claim 13, wherein processing at least one data item to provide at least one first processed data item includes including a statistically rare identifier in said at least one first processed data item. ### Claim 17 (depends on 13) The method of claim 13, wherein processing at least one data item to provide at least one first processed data item includes truncating processed data items to a maximal data item length. ### Claim 18 (depends on 13) The method of claim 13, further comprising: accepting a response communication generated at said network resource, said response communication including at least one second processed data item comprising client data and control information identifying a record associated with the client data; processing said at least one second processed data item to provide at least one unprocessed data item having the control information removed; generating a modified response communication based on said response communication and on said unprocessed data item. ### Claim 19 (depends on 18) The method of claim 18, wherein processing the at least one second processed data item includes generating and providing event information. ### Claim 20 (depends on 19) The method of claim 19, wherein said event information includes at least one of: an originating client identity, a reading client identity, a time of reading of a data item, a time of writing of a data item, and a read-time instruction. ### Claim 21 (depends on 18) The method of claim 18, wherein processing the at least one second processed data item includes associating a record identifier included in said at least one second processed data item with a record identifier included in said response communication and storing a parameter related to the associating in a storage system. ### Claim 22 (depends on 18) The method of claim 18, further comprising preventing an access to the at least one unprocessed data item based on processing the at least one second processed data item. ### Claim 23 (depends on 1) The system of claim 1, wherein processing said at least one data item further comprises incorporating the control information into said at least one data item to produce at least one first processed data item. ### Claim 24 (depends on 13) The method for auditing data of claim 13, further comprising: controlling access to the at least one first processed data item based on the control information.