Asset tracker for identifying user of current internet protocol addresses within an organization's communications network

• US 7,555,550 B2
• Filed: 09/07/2006
• Issued: 06/30/2009
• Est. Priority Date: 07/28/2003
• Status: Expired due to Fees

• Current Assignee: ETelemetry, Inc.
• Original Assignee: ETelemetry, Inc.
• Inventors: Schunemann, Alan J.
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US11/470,871
• Publication Number:
  US 20070288579A1
• Time in Patent Office: 1,027 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A network attached apparatus, system, method and computer program product for identifying users of networked computers is provided. The apparatus is installed at core network uplink points and analyzes packets as they traverse the network and intelligently correlates the contents of the traffic with user contact and system access information. The resulting information is used to identify the user of the networked computer for security or accounting purposes.

Claims

1. A computerized system for identifying users of Internet Protocol addresses within at least one organization'"'"'s communications network by matching user identification information from at least one organization'"'"'s director information with non-encrypted user identification information and current Internet Protocol addresses extracted by at least one discovery apparatus, comprising:

at least one database storing the at least one organization'"'"'s directory information, the at least one organization'"'"'s directory information including user identification information but not requiring any list of devices;

at least one discovery apparatus for extracting non-encrypted user identification information and associated Internet Protocol addresses, having at least one connection to at least one switch in the at least one communications network for passively monitoring traffic thru the at least one switch; and

at least one server, connected to the at least one discovery apparatus and having access to the at least one database via the at least one communications network, the at least one server capable of matching the extracted non-encrypted user identification information and the user identification information from the at least one organization'"'"'s directory information as keys to link the extracted Internet Protocol addresses to contacts in the at least one organization'"'"'s directory information, automatically determining which contacts in the at least one organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses.

2. The system of claim 1, wherein the at least one communications network is at least one local area network.

3. The system of claim 2, wherein the at least one local area network is at least one Ethernet network.

4. The system of claim 1, further comprising:

at least one central repository, accessible by the at least one discovery apparatus and the at least one Web server, for storing traffic monitored by the at least one discovery apparatus.

5. The system of claim 1, wherein the at least one formatted database contains the following fields of data:

(i) First Name and Last Name; and

/or (ii) electronic mail address and/or user name.

6. The system of claim 5, wherein the at least one formatted database also contains one of the following fields of data:

(i) Middle Initial;

(ii) Nick Names;

(iii) Name Aliases;

(iv) Building;

(v) Room;

(vi) Permanent E-mail;

(vii) Temporary E-mail;

or (viii) Affiliation/Organization;

or (ix) any combination thereof.

7. The system of claim 1, wherein the user identification information includes at least one electronic mail address, at least one user name, or any combination thereof.

8. A computerized method for identifying users of Internet Protocol addresses within at least one organizations communications network by matching user identification information from at least one organization'"'"'s directory information with non-encrypted user identification information and current Internet Protocol addresses extracted by at least one discovery apparatus, the method comprising:

monitoring traffic through at least one switch in the at least one communications network;

extracting non-encrypted user identification information and associated Internet Protocol addresses from the monitored traffic;

accessing at least one database of the at least one organization'"'"'s directory information, the at least one organizations directory information comprising user identification information but not requiring at least one list of devices; and

matching the extracted non-encrypted user identification information and the user identification information from the at least one organization'"'"'s directory information as keys to link extracted Internet Protocol addresses to contacts in the at least one organization'"'"'s directory information automatically determining which contacts in the at least one organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses.

9. The method of claim 8, further comprising:

storing the user identification information and associated Internet Protocol addresses in at least one central repository.

10. The method of claim 9, further comprising:

accessing the at least one central repository; and

producing a data file, on at least one pre-determined time interval, the data file containing information on which user used which Internet Protocol address during the at least one pre-determined time interval.

11. The method of claim 8, wherein the user identification information includes at least one electronic mail address and/or at least one user name.

12. The method of claim 8, wherein the extracting comprises:

using pattern matching based upon a known electronic mail protocol and/or authentication protocol to extract the non-encrypted user identification information and associated Internet Protocol address from the monitored traffic.

13. The method of claim 8, wherein the at least one local area communications network is at least one Ethernet network.

14. The method of claim 8, wherein the at least one formatted database contains the following fields of data:

(i) First Name and Last Name; and

(ii) electronic mail address and/or user name.

15. A system for identifying users of Internet Protocol addresses within at least one organization'"'"'s communications network by matching user identification information from at least one organization'"'"'s directory information with non-encrypted user identification information and current Internet Protocol addresses extracted by at least one discovery apparatus, comprising:

at least one formatted database storing the at least one organization'"'"'s directory information, the organization'"'"'s directory information including user identification information but not requiring any list of devices;

at least one discovery apparatus for extracting non-encrypted user identification information and associated Internet Protocol addresses, having at least one connection to at least one switch in the communications network for passively monitoring traffic through the at least one switch; and

at least one Web server, connected to the at least one discovery apparatus and having access to the at least one formatted database via the at least one organization'"'"'s communications network, the at least one Web server capable of matching the extracted non-encrypted user identification information and the user identification information from the at least one organization'"'"'s directory information as keys to link the extracted Internet Protocol addresses to contacts in the organization'"'"'s directory information, automatically determining which contacts in the at least one organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses;

the at least one Web server also capable of responding to browser-based queries to identify which user is using which computer.

16. A method for identifying users of Internet Protocol addresses within at least one organization'"'"'s at least one local area communications network by matching user identification information from at least one organization'"'"'s directory information with non-encrypted user identification information and current Internet Protocol addresses extracted by at least one discovery apparatus, the method comprising:

monitoring traffic through at least one switch in the at least one local area communications network;

extracting non-encrypted user identification information and associated Internet Protocol addresses from the monitored traffic;

accessing at least one formatted database of the at least one organization'"'"'s directory information, the at least one organization'"'"'s directory information comprising user'"'"'identification information but not requiring any list of devices; and

matching the extracted non-encrypted user identification information and the user identification information from the at least one organization'"'"'s directory information as keys to link extracted Internet Protocol addresses to contacts in the at least one organization'"'"'s directory information automatically determining which contacts in the at least one organization'"'"'s directory information are currently using each of the extracted Internet Protocol addresses.