Differentiating Unique Systems Sharing a Common Address

• US 20130275621A1
• Filed: 03/15/2013
• Published: 10/17/2013
• Est. Priority Date: 09/10/2009
• Status: Active Grant

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J.
• Granted Patent: US 9,531,666 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A system for differentiating unique systems and/or users sharing a common address may include an interface, a device identifier, a communication interceptor and a communication processor. The interface may be operative to receive a designation of a plurality of devices and/or users and a specification of corresponding services to be provisioned. The device identifier may be operative to cause the devices to provide a unique identifier with each communication originated by the device and store the unique identifier and the associated specification in a memory. The communication interceptor may be operative to intercept a communication originated by one of the devices and determine the unique identifier associated with the communication. The communication processor may be operative to determine the associated device and/or user specific service to be provisioned based on the unique identifier and process the communication in accordance with the associated device and/or user specific service to be provisioned.

Claims

1. A method of provisioning a service to each device of a plurality of devices, the method comprising:

causing each device of the plurality of devices to provide a unique identifier with each communication originated by the device, each device of the plurality of devices being identifiable from at least the other devices of the plurality of devices independent of any common address based on the unique identifier;

intercepting a communication from an originating device of the plurality of devices and determining the unique identifier provided with the communication, the communication otherwise not uniquely identifying the originating device from the other devices of the plurality of devices, the communication comprising a destination;

processing the communication based on the unique identifier, the processing comprising blocking the communication; and

intercepting a communication sent by the destination to the originating device and processing the communication sent by the destination.

2. The method of claim 1 further comprising:

receiving a designation of each device of the plurality of devices and a specification of a corresponding device specific service to be provisioned; and

determining the associated device specific service to be provisioned based on at least the unique identifier,

wherein the plurality of devices share the common address, the intercepted communication having the common address,

wherein the unique identifier uniquely identifies each device from at least the other devices of the plurality of devices independent of the common address, the unique identifier being associated with the device specific service to be provisioned,

wherein processing the communication based on the unique identifier comprises processing the communication in accordance with the associated device specific service to be provisioned,

wherein the intercepted communication sent by the destination is a response based on the communication, and

wherein processing the response comprises processing the response in accordance with the associated device specific service to be provisioned.

3. The method of claim 2 further comprising blocking communications from a device sharing the common address where the communication is provided without a unique identifier.

4. The method of claim 1 further comprising expiring the unique identifier upon the elapse of a period of time.

5. The method of claim 1 wherein a transport layer and a network layer of the plurality of devices are non-unique and each device is identified at an application layer of each device.

6. The method of claim 2 wherein the determining further comprises determining the device specific service to be provisioned based on the unique identifier and the common address.

7. A system for provisioning a service to each device of a plurality of devices, the system comprising:

means for causing each device of the plurality of devices to provide a unique identifier with each communication originated by the device, each device of the plurality of devices being identifiable from at least the other devices of the plurality of devices independent of any common address based on the unique identifier;

means for intercepting a communication from an originating device of the plurality of devices and determining the unique identifier provided with the communication, the communication otherwise not uniquely identifying the originating device from the other devices of the plurality of devices, the communication comprising a destination;

means for handling the communication based on the unique identifier, the means for handling comprising means for blocking the communication; and

means for intercepting a communication sent by the destination to the originating device and means for handing the communication sent by the destination.

8. The system of claim 7 further comprising:

means for receiving a designation of each device of the plurality of devices and a specification of a corresponding device specific service to be provisioned; and

means for determining the associated device specific service to be provisioned based on at least the unique identifier,

wherein the plurality of devices share the common address, the intercepted communication having the common address,

wherein the unique identifier uniquely identifies each device from at least the other devices of the plurality of devices independent of the common address, the unique identifier being associated with the device specific service to be provisioned,

wherein the means for handling the communication based on the unique identifier comprises a means for handling the communication in accordance with the associated device specific service to be provisioned,

wherein the communication sent by the destination is a response based on the communication, and

wherein the means for handling the response comprises a means for handling the response in accordance with the associated device specific service to be provisioned.

9. The system of claim 8 further comprising a means for blocking communications from a device sharing the common address where the communication is provided without a unique identifier.

10. The system of claim 7 further comprising a means for expiring the unique identifier upon the elapse of a period of time.

11. The system of claim 8 wherein the means for determining further comprises means for determining the device specific service to be provisioned based on the unique identifier and the common address.

12. A system for provisioning a service to each device of a plurality of devices, the system comprising:

a device identifier operative to cause each device of the plurality of devices to provide a unique identifier with each communication originated by the device, each device of the plurality of devices being identifiable from at least the other devices of the plurality of devices independent of any common address based on the unique identifier, the device identifier being further operative to store the unique identifier in a memory;

a communication interceptor operative to intercept a communication from an originating device of the plurality of devices and determine the unique identifier provided therewith, the communication otherwise not uniquely identifying the originating device from the other devices of the plurality of devices, the communication comprising a destination; and

a communication processor coupled with the memory and the communication interceptor and operative to process the communication based on the unique identifier, such that the communication is blocked,

wherein the communication interceptor is further operative to intercept a communication sent by the destination to the originating device and process the communication sent by the destination.

13. The system of claim 12 further comprising an interface coupled with the device identifier, the interface operative to receive a designation of each device of the plurality of devices and a specification of a corresponding device specific service to be provisioned,

wherein the device identifier is further operative to store the specification of the associated device specific service to be provisioned in the memory,

wherein the communication processor is operative to determine the associated device specific service to be provisioned based on at least the unique identifier and process the communication in accordance with the associated device specific service to be provisioned,

wherein the plurality of devices share the common address, the intercepted communication having the common address,

wherein the unique identifier uniquely identifies each device from at least the other devices of the plurality of devices independent of the common address, the unique identifier being associated with the device specific service to be provisioned,

wherein the intercepted communication sent by the destination is a response based on the communication, and

wherein the communication interceptor is further operative to process the response in accordance with the associated device specific service to be provisioned.

14. The system of claim 13 wherein the communication processor is further operative to block communications from a device sharing the common address where the communication does not contain a unique identifier.

15. The system of claim 12 wherein the device identifier is further operative to expire the unique identifier upon the elapse of a period of time.

16. The system of claim 13 wherein the communication processor is further operative to determine the device specific service to be provisioned based on the unique identifier and the common address.

17. A method for provisioning a service to users, the method comprising:

intercepting a communication associated with a service from a device;

processing the communication to identify the communicating device, the device having been previously modified to enable identification thereof based on the communication;

allowing the service to be provisioned based on the identified communicating device, to the device if the service comprises the device specific service to be provisioned, otherwise preventing the service from being provisioned to the device,

wherein the communication comprises a destination, the allowing of the service to be provisioned comprising blocking the communication, and

wherein the method further comprises intercepting a communication sent by the destination to the communicating device and processing the communication sent by the destination.

18. The method of claim 17 further comprising:

receiving a designation of the device and a specification of a corresponding device specific service to be provisioned, wherein the specification specifies a service that should be provided to the device; and

determining whether the service comprises the device specific service to be provisioned,

wherein the allowing comprises allowing the service to be provisioned to the device if the service comprises the device specific service to be provisioned, otherwise preventing the service from being provisioned to the device,

wherein the communication sent by the destination is a response sent by the destination to the communicating device based on the communication, and

wherein processing the response comprises processing the response in accordance with the device specific service to be provisioned.

19. The method of claim 17 further comprising modifying the communication generated by the device to prevent identification of the device via the communication.

20. The method of claim 17 wherein the communication comprises an HTTP request.

21. The method of claim 17 wherein the modifying further comprises modifying a user agent string on the device.

22. The method of claim 21 wherein the modifying further comprises adding a token to the user agent string on the device.

23. The method of claim 18 wherein determining further comprises:

performing deep packet inspection on the communication to determine the service; and

determining whether the service comprises the service specified by the specification.

24. The method of claim 17 wherein modifying the communication generated by the device to enable identification of the device via the communication further comprises modifying the device to enable identification thereof via the communication generated by the device.