Auditing communications

• US 8,595,794 B1
• Filed: 04/13/2007
• Issued: 11/26/2013
• Est. Priority Date: 04/13/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Xceedium Incorporated. (Broadcom, Inc.)
• Inventors: Van, David
• Primary Examiner(s): Blair, April Y
• Application Number:
  US11/786,970
• Time in Patent Office: 2,419 Days
• Field of Search: 726/4, 726/5, 726 17- 19, 726/21, 713/183, 380/247, 380/251
• US Class Current: 726/4
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

Auditing a communication is disclosed. Credentials are received from a client. It is determined whether the client is authorized to communicate with a remote resource. If it is determined that the communication with the remote resource is allowed, a communication is forwarded from the local resource to the remote resource.

Claims

1. A method, comprising:

transmitting resource access instructions to a client device to map a local software port of the client device with a remote resource, wherein a user associated with the client device has been determined as being authorized to access the remote resource;

receiving credentials from the client device;

receiving a communication from the client device intended for the remote resource;

determining, by a gatekeeper device having at least one processor, whether the client device is authorized to communicate with the remote resource;

in the event that it is determined that the communication is authorized, forwarding the communication from the client device to the remote resource; and

in the event that it is determined that the communication is not authorized, not forwarding the communication from the client device to the remote resource.

2. The method of claim 1 wherein determining whether the client device is authorized includes determining whether the credentials are valid.

3. The method of claim 1 wherein determining whether the client device is authorized includes determining whether a client device request occurs at an authorized time.

4. The method of claim 1 wherein determining whether the client device is authorized includes determining a window of time during which a communication request from the client device to the remote resource is authorized.

5. The method of claim 1 further comprising continuing to forward communications between the client device and the remote resource.

6. The method of claim 1 further comprising determining whether the client device ceases to be authorized to communicate with the remote resource.

7. The method of claim 6 further comprising refusing to forward communications immediately upon determining that the client device is no longer authorized to communicate with the remote resource.

8. The method of claim 6 further comprising refusing to forward communications after a period of time upon determining that the client device is no longer authorized to communicate with the remote resource.

9. The method of claim 1 wherein the remote resource has a different geolocation from the client device.

10. The method of claim 1 wherein the resource access instructions map the port of the client device directly with the remote resource.

11. The method of claim 1 wherein the resource access instructions map the port of the client device indirectly with the remote resource, by using the gatekeeper device as an intermediary.

12. A system, including:

a processor configured to;

transmit resource access instructions to a client device to map a local software port of the client device with a remote resource, wherein a user associated with the client device has been determined as being authorized to access the remote resource;

receive credentials from the client device;

receive a communication from the client device intended for the remote resource;

determine, by a gatekeeper device, whether the client device is authorized to communicate with the remote resource;

in the event that it is determined that the communication is authorized, forward the communication from the client device to the remote resource; and

in the event that it is determined that the communication is not authorized, not forward the communication from the client device to the remote resource; and

a memory coupled to the processor and configured to provide the processor with instructions.

13. The system of claim 12 wherein determining whether the client device is authorized includes determining whether the credentials are valid.

14. The system of claim 12 wherein determining whether the client device is authorized includes determining whether a client device request occurs at an authorized time.

15. The system of claim 12 wherein determining whether the client device is authorized includes determining a window of time during which a communication request from the client device to the remote resource is authorized.

16. The system of claim 12 wherein the processor is further configured to continue to forward communications between the client device and the remote resource.

17. The system of claim 12 wherein the processor is further configured to determine whether the client device ceases to be authorized to communicate with the remote resource.

18. The system of claim 17 wherein the processor is further configured to refuse to forward communications immediately upon determining that the client device is no longer authorized to communicate with the remote resource.

19. The system of claim 17 wherein the processor is further configured to refuse to forward communications after a period of time upon determining that the client device is no longer authorized to communicate with the remote resource.

20. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

transmitting resource access instructions to a client device to map a local software port of the client device with a remote resource, wherein a user associated with the client device has been determined as being authorized to access the remote resource;

receiving credentials from the client device;

receiving a communication from the client device intended for the remote resource;

determining, by a gatekeeper device, whether the client device is authorized to communicate with the remote resource;

in the event that it is determined that the communication is authorized forwarding the communication from the client device to the remote resource; and

in the event that it is determined that the communication is not authorized, not forwarding the communication from the client device to the remote resource.

21. A computer program product as recited in claim 20 wherein determining whether the client device is authorized includes determining a window of time during which a communication request from the client device to the remote resource is authorized.