Systems and methods for managing messages in an enterprise network

• US 7,882,265 B2
• Filed: 10/09/2007
• Issued: 02/01/2011
• Est. Priority Date: 06/10/2002
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Quest Software, Inc.
• Inventors: Shapiro, Dmitry, Miller, Randy, Poling, Robert, Pugh, Richard S.
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US11/869,575
• Publication Number:
  US 20080256257A1
• Time in Patent Office: 1,211 Days
• Field of Search: 709/223, 709/224, 709/230, 709/236, 709/238, 709/245, 709/250
• US Class Current: 709/238
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A protocol management system is capable of detecting certain message protocols and applying policy rules to the detected message protocols that prevent intrusion, or abuse, of a network'"'"'s resources. In one aspect, a protocol message gateway is configured to apply policy rules to high level message protocols, such as those that reside at layer 7 of the ISO protocol stack.

Claims

1. A method for managing communication traffic in a network, comprising:

intercepting with a gateway module executing on a computing device a message from a source intended for an external server configured to redirect the message to an intended destination, wherein the gateway module and the source are located within an enterprise network and the external server is located outside the enterprise network;

identifying a screen name of a user associated with the intended destination;

determining based at least in part on the screen name of the user if the intended destination is within the enterprise network; and

when it is determined that the intended destination is within the enterprise network, redirecting the intercepted message to the intended destination by bypassing the external server such that the intercepted message does not exit the enterprise network.

2. The method of claim 1, further comprising selecting a policy rule for handling the message and applying the policy rule to the intercepted message.

3. The method of claim 2, wherein the policy rule is based on a unique user name of a second user the source of the intercepted message.

4. The method of claim 2, wherein the policy rule is based on the intended destination of the intercepted message.

5. The method of claim 2, wherein the policy rule is based on information included in the intercepted message.

6. The method of claim 2, where in the policy rule is based on when the intercepted message is sent or intended to be received.

7. The method of claim 2, wherein the policy rule is based on the size of the intercepted message.

8. The method of claim 2, wherein the policy rule is based on whether the intercepted message includes an attachment.

9. The method of claim 2, wherein the policy rule is based on whether the intercepted message includes a virus.

10. The method of claim 2, further comprising determining if a session associated with the intercepted message is still in progress before applying the policy rule.

11. The method of claim 1, further comprising recording information associated with the intercepted message.

12. The method of claim 1, further comprising creating a log comprising information associated with the intercepted message and any related messages.

13. The method of claim 1, wherein the intercepted message is associated with a network address, and further determining a unique user name identifying the source using the network address.

14. The method of claim 13, wherein determining the unique user name further comprises determining a global user identification associated with the source.

15. The method of claim 14, determining the global user identification comprises interrogating a registry associated with the source.

16. The method of claim 1, wherein the message comprises an instant message protocol.

17. The method of claim 1, wherein said determining additionally comprises:

storing in a database a plurality of unique user names associated with individual users within the enterprise network; and

accessing the database to identify one of the plurality of unique user names that is associated with the screen name.

18. A system for managing communication traffic in a network, the system comprising:

a destination computing device;

a source computing device located within an enterprise network; and

a gateway module located within the enterprise network and configured to intercept a message from the source computing device intended for an external server configured to redirect the message to the destination computing device, wherein the external server is located outside the enterprise network, and wherein the gateway module is configured to,

identify a screen name of an intended user recipient of the message and associated with the destination computing device,

determine based at least in part on the screen name of the intended user recipient if the destination computing device is within the enterprise network, and

when it is determined that the destination computing device is within the enterprise network, redirecting the message to the destination computing device by bypassing the external server such that the message does not exit the enterprise network.

19. The system of claim 18, wherein the message comprises an instant message.

20. The system of claim 18, further comprising a database storing a plurality of unique user names associated with users within the enterprise network, wherein the screen name of the intended user recipient is associated with one of the plurality of unique user names.