Asset tracker for identifying user of current internet protocol addresses within an organization's communications network

• US 7,133,916 B2
• Filed: 07/28/2003
• Issued: 11/07/2006
• Est. Priority Date: 07/28/2003
• Status: Expired due to Fees

• Current Assignee: ETelemetry, Inc.
• Original Assignee: ETelemetry, Inc.
• Inventors: Schunemann, Alan J.
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US10/627,672
• Publication Number:
  US 20050027806A1
• Time in Patent Office: 1,198 Days
• Field of Search: 709203-204, 709/206, 709/224, 709/229, 713/201
• US Class Current: 709/224
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A network attached apparatus, system, method and computer program product for identifying users of networked computers is provided. The apparatus is installed at core network uplink points and analyzes packets as they traverse the network and intelligently correlates the contents of the traffic with user contact and system access information. The resulting information is used to identify the user of the networked computer for security or accounting purposes.

Claims

1. A system for identifying users of Internet Protocol addresses within an organization'"'"'s communications network by matching user identification information from an organization'"'"'s directory information with non-encrypted user identification information and current Internet Protocol addresses extracted by a discovery apparatus, comprising:

a database storing the organization'"'"'s directory information, the organization'"'"'s directory information including user identification information but not requiring a list of devices;

a discovery apparatus for extracting non-encrypted user identification information and associated Internet Protocol addresses, having at least one connection to a switch in the communications network for passively monitoring traffic thru the switch; and

a server, connected to the discovery apparatus and having access to the database via the communications network, the server capable of matching the extracted non-encrypted user identification information and the user identification information from the organization'"'"'s directory information as keys to link the extracted Internet Protocol addresses to contacts in the organization'"'"'s directory information, automatically determining which contacts in the organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses.

2. The system of claim 1, wherein the communications network is a local area network.

3. The system of claim 2, wherein the local area network is an Ethernet network.

4. The system of claim 1, further comprising:

a central repository, accessible by the discovery apparatus and a Web server, for storing the traffic monitored by the discovery apparatus.

5. The system of claim 1, wherein the database is a formatted database.

6. The system of claim 1, wherein the database contains the following fields of data:

(i) First Name and Last Name; and

(ii) electronic mail address and/or user name.

7. The system of claim 6, wherein the database also contains one of the following fields of data:

(i) Middle Initial;

(ii) Nick Names;

(iii) Name Aliases;

(iv) Building;

(v) Room;

(vi) Permanent E-mail;

(vii) Temporary E-mail;

or (viii) Affiliation/Organization;

or (ix) any combination thereof.

8. The system of claim 1, wherein the server is a Web server capable of responding to browser-based queries to identify which user is using which computer.

9. The system of claim 1, wherein the user identification information includes an electronic mail address and/or a user name.

10. A method for identifying users of Internet Protocol addresses within an organization'"'"'s communications network by matching user identification information from an organization'"'"'s directory information with non-encrypted user identification information and current Internet Protocol addresses extracted by a discovery apparatus, the method comprising the steps of:

monitoring traffic through a switch in the communications network;

extracting non-encrypted user identification information and associated Internet Protocol addresses from the monitored traffic;

accessing a database of the organization'"'"'s directory information, the organization'"'"'s directory information comprising user identification information but not requiring a list of devices; and

matching the extracted non-encrypted user identification information and the user identification information from the organization'"'"'s directory information as keys to link extracted Internet Protocol addresses to contacts in the organization'"'"'s directory information automatically determining which contacts in the organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses.

11. The method of claim 10, further comprising the step of:

storing the user identification information and associated Internet Protocol addresses in a central repository.

12. The method of claim 11, further comprising the steps of:

accessing the central repository; and

producing a data file, on a pre-determined time interval, the data file containing information on which user used which Internet Protocol address during the pre-determined time interval.

13. The method of claim 10, wherein the user identification information includes an electronic mail address and/or a user name.

14. The method of claim 13, wherein the extracting step comprises the step of:

using pattern matching based upon a known electronic mail protocol and/or authentication protocol to extract the non-encrypted user identification information and associated Internet Protocol address from the monitored traffic.

15. The method of claim 10, wherein the communications network is a local area network.

16. The method of claim 15, wherein the local area network is an Ethernet network.

17. The method of claim 10, wherein the database is a formatted database.

18. The method of claim 10, further comprising the step of:

receiving, via the communications network, a query to identify a user of a computer within the communications network, the query including an Internet Protocol address; and

responding to the query using the matching of a subset of the extracted Internet Protocol addresses with a subset of users, using the received Internet Protocol address.

19. The method of claim 10, wherein the database contains the following fields of data:

(i) First Name and Last Name; and

(ii) electronic mail address and/or user name.

20. The method of claim 19, wherein the database also contains one of the following fields of data:

(i) Middle Initial;

(ii) Nick Names;

(iii) Name Aliases;

(iv) Building;

(v) Room;

(vi) Permanent E-mail;

(vii) Temporary E-mail;

or (viii) Affiliation/Organization;

or (ix) any combination thereof.

21. The method of claim 19, further comprising the step of:

receiving, via the communications network, a query to identify a user of a computer within the communications network, the query including at least one of the fields of data; and

responding to the query using the matching of a subset of the extracted Internet Protocol addresses to a subset of users and using a received field of data.

22. A computer program product comprising a computer usable medium having instructions and control logic stored therein for causing a computer to execute instructions to identify users of Internet Protocol addresses within an organization'"'"'s communications network by matching user identification information from an organization'"'"'s directory information with non-encrypted user identification information and current Internet Protocol addresses extracted by a discovery apparatus, the control logic comprising:

first computer readable program code means for causing the computer to monitor traffic through a switch in the communications network;

second computer readable program code means for causing the computer to extract non-encrypted user identification information and associated Internet Protocol addresses from the monitored traffic;

third computer readable program code means for causing the computer to access a database of the organization'"'"'s directory information, the organization'"'"'s directory information comprising user identification information but not requiring a list of devices; and

fourth computer readable program code means for causing the computer to match the extracted non-encrypted user identification information and the user identification information from the organization'"'"'s directory information as keys to link the extracted Internet Protocol addresses to contacts in the organization'"'"'s directory information;

wherein the matching automatically determines which contacts in the organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses.

23. The computer program product of claim 22, further comprising:

fifth computer readable program code means for causing the computer to store the extracted non-encrypted user identification information and associated Internet Protocol addresses in a central repository.

24. The computer program product of claim 23, further comprising:

sixth computer readable program code means for causing the computer to access the central repository; and

seventh computer readable program code means for causing the computer to create a data file, on a pre-determined time interval, the data file containing information on which user used which terminal during the pre-determined time interval.

25. The computer program product of claim 22, wherein the user identification information includes an electronic mail address and/or a user name.

26. The computer program product of claim 25, wherein the second computer readable program code means comprises:

fifth computer readable program code means for causing the computer to perform pattern matching based upon a known electronic mail protocol and/or authentication protocol to extract the non-encrypted user identification information and the associated Internet Protocol address from the monitored traffic.

27. The computer program product of claim 22, wherein the database is a formatted database.

28. The computer program product of claim 22, further comprising:

fifth computer readable program code means for causing the computer to receive, via the communications network, a query to identify a user of a terminal within the communications network, the query including an Internet Protocol address; and

sixth computer readable program code means for causing the computer to respond to the query using the matching of a subset of the extracted Internet Protocol addresses with a subset of users, using a received Internet Protocol address.

29. The computer program product of claim 22, wherein the database contains the following fields of data:

(i) First Name and Last Name; and

(ii) electronic mail address and/or user name.

30. The computer program product of claim 29, wherein the database also contains one of the following fields of data:

(i) Middle Initial;

(ii) Nick Names;

(iii) Name Aliases;

(iv) Building;

(v) Room;

(vi) Permanent E-mail;

(vii) Temporary E-mail;

or (viii) Affiliation/Organization;

or (ix) any combination thereof.

31. The computer program product of claim 29, further comprising:

fifth computer readable program code means for causing the computer to receive, via the communications network, a query to identify a user of a terminal within the communications network, the query including a field of data; and

sixth computer readable program code means for causing the computer to respond to the query using the matching of a subset of the extracted Internet Protocol addresses with a subset of users, using the fields of data.