System and method to associate a private user identity with a public user identity

• US 9,712,493 B2
• Filed: 02/26/2016
• Issued: 07/18/2017
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Wang, Xin, Chen, Lee, Chiong, John
• Primary Examiner(s): SHAW, PETER C
• Application Number:
  US15/054,583
• Publication Number:
  US 20160182456A1
• Time in Patent Office: 508 Days
• Field of Search: 709249
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/401 wherein the services involve a main real-time session and one or more additional parallel real-time or time sensitive sessions, e.g. white board sharing or spawning of a subconference
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user'"'"'s public user identity used to access the public application, the user'"'"'s private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record, if they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

Claims

1. A method executed by a security gateway that comprises a processor and memory for storing instructions, the processor executing the instructions to perform the method, the method comprising:

tracking public application access sessions for a public application accessed by a user through a secured network that comprises the security gateway;

storing information indicative of the public application access sessions in one or more access session record;

receiving a request for a private user identity associated with a public application access session, the request comprising at least a time frame;

locating the public access application session by searching access session records having an application session time frame that corresponds to the time frame of the request; and

returning the private user identity associated with one or more matching access session records.

2. The method according to claim 1, wherein the information indicative of the public application access sessions is stored in the access session record in association with a private identity of the user that is used by the user to gain access to the secure network.

3. The method according to claim 2, wherein the private identity and a public identity of the user that is used to access a public application are different from one another.

4. The method according to claim 1, wherein an access session record is created upon the user accessing a public application.

5. The method according to claim 4, further comprising storing the access session record on an identity server.

6. The method according to claim 1, wherein information indicative of the public application access sessions is stored in an access session record, in association with a public identity of the user that is used by the user to gain access to the public application.

7. The method according to claim 1, wherein information indicative of the public application access sessions comprises a host identity for a host device associated with the public application access sessions and an application session time for an application session.

8. The method according to claim 1, wherein for each public application access session, the method further comprises tracking a host device identifier and an application session time frame.

9. The method according to claim 8, wherein the host device identifier is linked to a private user identity managed by an identity server.