System and Method to Associate a Private User Identity with a Public User Identity

• US 20100217819A1
• Filed: 04/30/2010
• Published: 08/26/2010
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Chen, Lee, Wang, Xin, Chiong, John
• Granted Patent: US 7,979,585 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/401 wherein the services involve a main real-time session and one or more additional parallel real-time or time sensitive sessions, e.g. white board sharing or spawning of a subconference
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user'"'"'s public user identity used to access the public application, the user'"'"'s private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record. If they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

Claims

1. A method for associating a user identity used for accessing a network, comprising:

(a) recognizing an application session between a network and an application via a security gateway; and

(b) creating an application session record for the application session, wherein the application session record comprises the user identity used for accessing the network through a host, a host identity for the host, and an application session time, wherein the creating comprises;

(b1) querying an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time;

(b2) comparing by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time;

(b3) returning by the identity server the second user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time; and

(b4) storing the second user identity as the user identity used for accessing the network in the application session record.

2. The method of claim 1, wherein the recognizing (a) comprises:

(a1) identifying a pattern of a data packet transmitted between the network and the application; and

(a2) matching the pattern with an application identifier for the application.

3. The method of claim 1, wherein the creating (b) further comprises:

(b5) extracting a source IP address from an IP header of a data packet transmitted during the application session; and

(b6) storing the source IP address as the host identity in the application session record.

4. The method of claim 1, wherein the creating (b) further comprises:

(b5) storing a user identity used for accessing the application in the application session record.

5. The method of claim 4, wherein the storing (b5) comprises:

(b5i) examining a pattern of a data packet transmitted between the network and the application; and

(b5ii) extracting the user identity used for accessing the application based on the pattern.

6. The method of claim 1, wherein the application comprises a public application and the network comprises a company internal network.

7. The method of claim 6, wherein the public application comprises one of the following:

an instant messaging application;

an email application;

a conferencing application;

a voice application;

a video application;

or a collaboration application.

8. The method of claim 1, wherein the application comprises one of the following:

an instant messaging application;

an email application a conferencing application;

a voice application;

a video application;

or a collaboration application.

9. A system, comprising:

a host;

a network comprising a gateway;

an application, wherein an access session for a user is established between the application and the network via the gateway, wherein the gateway creates an application session record for the application session, wherein the application session record comprises a user identity for the user used for accessing the network through the host, a host identity for the host, and an application session time; and

an identity server, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time,

wherein the gateway queries the identity server by sending the host identity and the application session time in the application session record,

wherein the identity server compares the host identity in the application session record with the second host identity in the access session record, and compares the access session time with the application session time,

wherein the identity server returns the second user identity in the access session record to the gateway, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time,

wherein the gateway stores the second user identity as the user identity used for accessing the network in the application session record.

10. The system of claim 9, wherein the gateway identifies a pattern of a data packet transmitted between the network and the application, and matches the pattern with an application identifier for the application.

11. The system of claim 9, wherein the gateway extracts a source IP address from an IP header of a data packet transmitted during the application session, and stores the source IP address as the host identity in the application session record.

12. The system of claim 9, wherein the gateway stores a user identity used for accessing the application in the application session record.

13. The system of claim 12, wherein the gateway examines a pattern of a data packet transmitted between the network and the application, and extracts the user identity used for accessing the application based on the pattern.

14. The system of claim 9, wherein the application comprises a public application and the network comprises a company internal network.

15. The system of claim 14, wherein the public application comprises one of the following:

an instant messaging application;

an email application;

a conferencing application;

a voice application;

a video application;

or a collaboration application.

16. The system of claim 9, wherein the application comprises one of the following:

an instant messaging application;

an email application a conferencing application;

a voice application;

a video application;

or a collaboration application.

17. A computer program product comprising a computer useable medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

recognize an application session between a network and an application via a security gateway; and

create an application session record for the application session, wherein the application session record comprises the user identity used for accessing the network through a host, a host identity for the host, and an application session time, wherein the create comprises;

query an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time;

compare by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time;

return by the identity server the second user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time; and

store the second user identity as the user identity used for accessing the network in the application session record.

18. A computer program product comprising a computer useable medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

recognize an application session between a network and a public application via a gateway, wherein the public application resides externally to the network; and

create an application session record for the application session, wherein the application session record comprises the public user identity used to access the public application, the private user identity used for accessing the network through a host, a host identity for the host, and an application session time, wherein the create comprises;

query an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second private user identity, a second host identity for the second host, and an access session time;

compare by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time;

return by the identity server the second private user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time; and

store the second private user identity as the private user identity in the application session record.