System and method to associate a private user identity with a public user identity

• US 9,294,467 B2
• Filed: 05/22/2015
• Issued: 03/22/2016
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Wang, Xin, Chen, Lee, Chiong, John
• Primary Examiner(s): SHAW, PETER C
• Application Number:
  US14/720,012
• Publication Number:
  US 20150312237A1
• Time in Patent Office: 305 Days
• Field of Search: 709/249
• US Class Current: 1/1
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/401 wherein the services involve a main real-time session and one or more additional parallel real-time or time sensitive sessions, e.g. white board sharing or spawning of a subconference
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user'"'"'s public user identity used to access the public application, the user'"'"'s private user identity used to access the network, a host identity, and an application session time, To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record, if they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

Claims

1. A communications system comprising:

at least one network connection communicatively coupled to a secure network; and

a processor communicatively coupled to the at least one network connection, the processor executing instructions to perform a method, the method including;

conveying an application session between a first host and an application server, the first host communicating with the application server using an application session, the application server provisioning an application;

ascertaining a first host identity associated with the first host, a first user identity associated with the application session, and an application session time associated with the application session;

receiving a second host identity associated with a second host, a second user identity associated with an access session, and an access session time associated with the application session, the second host communicating with the secure network using the access session, the access session time including a starting time and an ending time associated with the access session;

comparing the application session time and the access session time;

matching the first host identity with the second host identity, in response to the application session time being between the starting time and the ending time;

associating the first user identity and the second user identity using the matching; and

storing the association.

2. The communications system of claim 1 wherein the application server is outside of the secure network.

3. The communications system of claim 1 wherein the application session is an authenticated access session and the access session is an authenticated access session.

4. The communications system of claim 1 wherein the application includes at least one of File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), Post Office Protocol (POP), and instant messaging (IM) protocol.

5. The communications system of claim 1 wherein the application session time includes at least one of a starting time associated with the application session and a time stamp associated with the application session.

6. The communications system of claim 1 wherein the second user identity includes at least one of a name of a user, an Internet service subscription identity, and a network login.

7. The communications system of claim 1 wherein the first host identity and the second host identity each include at least one of a respective Internet Protocol (IP) address and a Media Access Control (MAC) address.

8. The communications system of claim 1 wherein the storing further includes storing at least one of the first user identity, the second user identity associated with the first user identity, the first host identity, and the application session time.

9. The communications system of claim 1 wherein the processor further obtains user information associated with the second user identity, the user information including at least one of contact information, location information, and departmental information.

10. The communications system of claim 1 wherein the processor further generates a report including the association.

11. A processor-implemented method comprising:

conveying an application session between a first host and an application server, the first host communicating with the application server using an application session, the application server provisioning an application;

ascertaining a first host identity associated with the first host, a first user identity associated with the application session, and an application session time associated with the application session;

receiving a second host identity associated with a second host, a second user identity associated with an access session, and an access session time associated with the application session, the second host communicating with the secure network using the access session, the access session time including a starting time and an ending time associated with the access session;

comparing the application session time and the access session time;

matching the first host identity with the second host identity, in response to the application session time being between the starting time and the ending time;

associating the first user identity and the second user identity using the matching; and

storing the association.

12. The method of claim 11 wherein the application server is outside of the secure network.

13. The method of claim 11 wherein the application session is an authenticated access session and the access session is an authenticated access session.

14. The method of claim 11 wherein the application includes at least one of File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), Post Office Protocol (POP), and instant messaging (IM) protocol.

15. The method of claim 11 wherein the application session time includes at least one of a starting time associated with the application session and a time stamp associated with the application session.

16. The method of claim 11 wherein the second user identity includes at least one of a name of a user, an Internet service subscription identity, and a network login.

17. The method of claim 11 wherein the first host identity and the second host identity each include at least one of a respective Internet Protocol (IP) address and a Media Access Control (MAC) address.

18. The method of claim 11 wherein the storing further includes storing at least one of the first user identity, the second user identity associated with the first user identity, the first host identity, and the application session time.

19. The method of claim 11 further comprising obtaining user information associated with the second user identity, the user information including at least one of contact information, location information, and departmental information.

20. The method of claim 11 further comprising generating a report including the association.

21. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method, the method comprising:

conveying an application session between a first host and an application server, the first host communicating with the application server using an application session, the application server provisioning an application;

ascertaining a first host identity associated with the first host, a first user identity associated with the application session, and an application session time associated with the application session;

receiving a second host identity associated with a second host, a second user identity associated with an access session, and an access session time associated with the application session, the second host communicating with the secure network using the access session, the access session time including a starting time and an ending time associated with the access session;

comparing the application session time and the access session time;

matching the first host identity with the second host identity, in response to the application session time being between the starting time and the ending time;

associating the first user identity and the second user identity using the matching; and

storing the association.