Systems and methods for authentication of target protocol screen names

• US 20040088423A1
• Filed: 06/10/2003
• Published: 05/06/2004
• Est. Priority Date: 06/10/2002
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Akonix Systems, Inc. (Quest Software, Inc.)
• Inventors: Shapiro, Dmitry, Miller, Randy, Poling, Robert, Pugh, Richard S.
• Granted Patent: US 7,664,822 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A protocol management system is capable of detecting certain message protocols and applying policy rules to the detected message protocols that prevent intrusion, or abuse, of a network'"'"'s resources. In one aspect, a protocol message gateway is configured to apply policy rules to high level message protocols, such as those that reside at layer 7 of the ISO protocol stack.

Claims

1. A method for managing communication policy in a network, comprising:

receiving a message comprising a certain message protocol from a source within the network, the message being associated with a specific screen name;

determining a unique user name for the source;

associating the screen name with the unique user name; and

storing the association between the screen name and the unique user name.

2. The method of claim 1, further comprising selecting a policy rule for handling the received message based on the unique user name and applying the policy rule to the message.

3. The method of claim 2, wherein the policy rule is based on the source of the received message.

4. The method of claim 2, wherein the policy rule is based on the intended destination of the received message.

5. The method of claim 2, wherein the policy rule is based on information included in the received message.

6. The method of claim 2, wherein the policy rule is based on when the received message is sent or intended to be received.

7. The method of claim 2, wherein the policy rule is based on the size of the received message.

8. The method of claim 2, wherein the policy rule is based on whether the received message includes an attachment.

9. The method of claim 2, wherein the policy rule is based on whether the received message includes a virus.

10. The method of claim 2, further comprising determining if a session associated with the received message is still in progress before applying the policy rule.

11. The method of claim 1, further comprising recording information associated with the received message.

12. The method of claim 1, further comprising creating a log comprising information associate with the received message and any related messages.

13. The method of claim 1, wherein the received massage is associated with a network address, and wherein determining a unique user name comprises identifying the source using the network address.

14. The method of claim 13, wherein determining a unique user name further comprises determining a global user identification associated with the source.

15. The method of claim 14, determining a global user identification comprises interrogating a registry associated with the source.

16. The method of claim 1, further comprising determining if the screen name has previously been associated with a unique user name, and if so, then applying a policy rule to the message based on the unique user name.

32. The user authentication module of claim 14, determining a global user identification comprises interrogating a registry associated with the source.

33. The user authentication module of claim 1, further configured to determine if the screen name has previously been associated with a unique user name, and if so, then applying a policy rule to the message based on the unique user name.

17. A user authentication module, comprising a network interface configured to receive a message comprising a certain message protocol from a source within the network, the message being associated with a specific screen name, the user authentication module configured to determine a unique user name for the source and associate the screen name with the unique user name.

18. The user authentication module of claim 17, further configured to storing the association between the screen name and the unique user name.

19. The user authentication module of claim 17, further comprising a plurality of policy rules, the user authentication module further configured to select a policy rule for handling the received message based on the unique user name and to apply the selected policy rule to the message.

20. The user authentication module of claim 19, wherein the selected policy rule is based on the source of the received message.

21. The user authentication module of claim 19, wherein the selected policy rule is based on the intended destination of the received message.

22. The user authentication module of claim 19, wherein the selected policy rule is based on information included in the received message.

23. The user authentication module of claim 19, wherein the selected policy rule is based on when the received message is sent or intended to be received.

24. The user authentication module of claim 19, wherein the selected policy rule is based on the size of the received message.

25. The user authentication module of claim 19, wherein the selected policy rule is based on whether the received message includes an attachment.

26. The user authentication module of claim 19, wherein the selected policy rule is based on whether the received message includes a virus.

27. The user authentication module of claim 19, further configured to determine if a session associated with the received message is still in progress before applying the policy rule.

28. The user authentication module of claim 17, further configured to record information associated with the received message.

29. The user authentication module of claim 17, further configured to create a log comprising information associate with the received message and any related messages.

30. The user authentication module of claim 17, wherein the received massage is associated with a network address, and wherein determining a unique user name comprises identifying the source using the network address.

31. The user authentication module of claim 30, wherein determining a unique user name further comprises determining a global user identification associated with the source.