NETWORK COMMUNICATIONS

• US 20070074018A1
• Filed: 09/22/2006
• Published: 03/29/2007
• Est. Priority Date: 09/23/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.), Network Communication
• Original Assignee: ScanSafe Ltd. (Cisco Systems, Inc.)
• Inventors: Edwards, John
• Granted Patent: US 8,255,465 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata

Abstract

Methods and systems for communicating information between computer networks in which the information to be communicated is required at one location (e.g. for processing) but only available at another location. The information may be absent deliberately (for privacy reasons) or may simply be unavailable as an artefact of the computer network(s) involved. The required information, such as the internal client IP address, is inserted into the outgoing network communication in a manner that does not to materially affect the normal transit or utility of the network communication (e.g. as custom headers). The information is preferably inserted in an encrypted form, so that it may pass over a public network and be invulnerable to unauthorised scrutiny.

Claims

1. A method of appending a message appendix to a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the method comprising:

creating a message appendix including information additional to the content of the network communication;

encrypting the message appendix; and

appending the encrypted message appendix to the network communication.

2. A method according to claim 1, comprising intercepting the network communication, the step of appending the encrypted message appendix comprising modifying the intercepted network communication.

3. A method according to claim 2, wherein the network message is subsequently released to continue its transit to the remote processor via the external network.

4. A method according to claim 1, wherein the additional information contained within the message appendix comprises local network information.

5. A method according to claim 4, wherein said local network information includes any one or more of a user'"'"'s user ID, group membership, phone number, location, address or other information obtained from a local network directory or directories.

6. A method according to claim 1, wherein the additional information includes other data associated with the network communication, derived data associated with the network communication, and/or other information independent of the specific network communication.

26. A method or system according to claim 1, wherein the network communication is an HTTP request, an email communication or an Instant Messaging communication.

27. A method or system according to claim 1, wherein the message appendix is incorporated in to the network communication as header information in the communication.

28. A method or system according to claim 1, wherein the local network is a corporate network.

29. A method or system according to claim 1, wherein the external network is the Internet.

30. Computer program code that when run on a computer or computer network causes the computer or network to operate in accordance with a method according to claim 1.

31. Computer program code according to claim 30 stored on a computer readable medium.

32. An Internet-level network processing service operable in accordance with a method or comprising a system according to claim 1.

33. An Internet-level network processing service according to claim 32, which is a web security service.

34. A web security service according to claim 33 comprising any one or more of web virus scanning, web filtering and web spyware screening.

7. A method of providing a network processing service to users of a local network, the network processing service being hosted remotely to the local network and connected to the local network by an external network, the method comprising, at the remote network processing service:

receiving a network communication from the user via the external network, the network communication including an encrypted message appendix;

extracting and decrypting the message appendix; and

processing the network communication dependent on information contained in the decrypted message appendix.

8. A method according to claim 7, wherein the message appendix is removed from the network communication once received by the network processing service.

9. A method of appending a message appendix to a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the method comprising:

creating a message appendix including information additional to the original content of the network communication; and

appending the message appendix to the network communication;

wherein said information additional to the original content of the network communication comprises one or more of;

a) local network information available from a directory or directories associated with the local network;

b) state information about the local network and/or the user and/or a user group; and

c) tally information about the local network and/or the user and/or user group.

10. The method of claim 9, comprising intercepting the network communication, the step of appending the encrypted message appendix comprising modifying the intercepted network communication.

11. The method of claim 9, wherein the message appendix is encrypted before it is included in the network communication.

12. A method of providing a network processing service to users of a local network, the network processing service being hosted remotely to the local network and connected to the local network by an external network, the method comprising, at the remote network processing service:

receiving a network communication from the user via the external network, the network communication including a message appendix;

extracting the message appendix; and

processing the network communication dependent on information contained in the message appendix;

wherein said information in the appendix on which the processing of the network communication depends comprises one or more of;

a) local network information obtained from a directory or directories associated with the local network;

b) state information about the local network and/or the user and/or a user group; and

c) tally information about the local network and/or the user and/or user group.

13. A method according to claim 12, wherein the message appendix is removed from the network communication once received by the network processing service.

14. A method according to claim 12, wherein the local network information is user or group level information, for example a user'"'"'s user ID, group membership, phone number, location, address or other information obtained from a local network directory or directories.

15. A method according to any one of claim 12, wherein the state information includes other data associated with the network communication, derived data associated with the network communication, and/or other information independent of the specific network communication.

16. A network processing service for processing a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the system comprising:

an encoding agent that operates to;

create a message appendix including information additional to the original content of the network communication;

encrypt the message appendix; and

append the encrypted message appendix to the network communication to create a modified network communication;

a decoding agent at said remote processor that operates to;

receive the modified network communication from the user via the external network; and

extract and decrypt the message appendix; and

a processing agent that subsequently processes the network communication, the processing being dependent on information contained in the decrypted message appendix.

17. The network processing service of claim 16, wherein the encoding agent intercepts the network communication in order to append the encrypted appendix to it.

18. A system for appending a message appendix to a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the system comprising an encoding agent that operates to:

create a message appendix including information additional to the original content of the network communication;

encrypt the message appendix; and

append the encrypted message appendix to the network communication to create a modified network communication.

19. The system of claim 18, wherein the encoding agent intercepts the network communication in order to append the encrypted appendix to it.

20. A network processing service for users of a local network, the network processing service being hosted remotely to the local network and connected to the local network by an external network, the remote network processing service comprising:

a decoding agent that operates to;

receive a network communication from the user via the external network, the network communication including an encrypted message appendix; and

extract and decrypt the message appendix, and

a processing agent that subsequently processes the network communication, the processing being dependent on information contained in the decrypted message appendix.

21. A network processing service for processing a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the system comprising:

an encoding agent that operates to;

create a message appendix including information additional to the content of the network communication; and

append the message appendix to the network communication to create a modified network communication;

a decoding agent at said remote processor that operates to;

receive the modified network communication from the user via the external network; and

extract the message appendix; and

a processing agent that subsequently processes the network communication, the processing being dependent on information contained in the extracted message appendix;

wherein said information additional to the original content of the network communication comprises one or more of;

a) local network information available from a directory or directories associated with the local network;

b) state information about the local network and/or the user and/or a user group; and

c) tally information about the local network and/or the user and/or user group.

22. The network processing service of claim 21, wherein the encoding agent intercepts the network communication in order to append the message appendix to it.

23. A system for appending a message appendix to a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the system comprising and encoding agent that operates to:

create a message appendix including information additional to the original content of the network communication; and

append the message appendix to the network communication to include the message appendix;

wherein said information additional to the original content of the network communication comprises one or more of;

a) local network information available from a directory or directories associated with the local network;

b) state information about the local network and/or the user and/or a user group; and

c) tally information about the local network and/or the user and/or user group.

24. The system of claim 23, wherein the encoding agent intercepts the network communication in order to append the message appendix to it.

25. A network processing service for users of a local network, the network processing service being hosted remotely to the local network and connected to the local network by an external network, the network processing service comprising:

a decoding agent that operates to;

receive a network communication from the user via the external network, the network communication including a message appendix; and

extract the message appendix; and

a processing agent that operates to process the network communication, the processing being dependent on information contained in the message appendix;

wherein said information in the appendix on which the processing of the network communication depends comprises one or more of;

a) local network information obtained from a directory or directories associated with the local network;

b) state information about the local network and/or the user and/or a user group; and

c) tally information about the local network and/or the user and/or user group.

35. A network processing service for processing a network communication sent from a user processor connected to a local network to a remote processor that is connected to the local network via an external network, the system comprising:

an encoding agent that operates to;

create a message appendix including information additional to the content of the network communication; and

forward the network communication and the message appendix to the remote processor;

a decoding agent at said remote processor that operates to;

receive the forwarded network communication and message appendix via the external network; and

a processing agent that subsequently processes the received network communication, the processing being dependent on information contained in the message appendix.

36. A network processing service according to claim 35, wherein said encoding agent is not the originator of the network communication and additionally operates to intercept the network communication.

37. A network processing service according to claim 35, wherein said information additional to the original content of the network communication comprises one or more of:

a) local network information available from a directory or directories associated with the local network;

b) state information about the local network and/or the user and/or a user group; and

c) tally information about the local network and/or the user and/or user group.

38. A network processing service according to claim 35, wherein the encoding agent encrypts the message appendix prior to forwarding it to the remote processor and the decoding agent decrypts the received message appendix.

39. A network processing service according to claim 35, wherein the encoding agent appends the message appendix to the network communication for transmission to the remote processor.