Systems and methods for network user resolution

• US 8,122,152 B2
• Filed: 10/14/2004
• Issued: 02/21/2012
• Est. Priority Date: 10/23/2003
• Status: Active Grant

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Inventors: Chittenden, Bruce, Madden, William, Willis, Myk
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Nooristany, Sulaiman
• Application Number:
  US10/965,276
• Publication Number:
  US 20050089048A1
• Time in Patent Office: 2,686 Days
• Field of Search: 709/205, 709/236, 709/245
• US Class Current: 709/245
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76

Abstract

Systems and software that enable mapping of a particular network transaction with a specific computer and user in an organization. The network packet may be a live in-transit packet, or a packet that occurred at some time in the past. In a particular implementation, a database currently comprises a collection of records containing fields for username, computer name, IP address of the computer, and logon time. A name resolution is performed by taking an IP address and time as input, and determining from the records in the database what user'"'"'s computer owned the IP address at that time.

Claims

1. A method for performing user resolution using a network address that is shared by multiple users and a port number, the method comprising:

capturing a user name for each user when each user logs into a multi-user system for a session;

correlating a session ID with each user;

apportioning a range of available port numbers into a number of partitions, wherein the number of partitions is selected to provide a partition for each concurrent user of the multi-user system;

allocating a locally unique set of port numbers to each user for that user'"'"'s session, wherein the locally unique set of port numbers allocated to that user is not assigned during that user'"'"'s session to a different user;

causing port number requests initiated by a process within a particular user'"'"'s session to be assigned a port number from within a partition allocated to that particular user;

for each user, storing a user name resolution record comprising the user name, a network address, and an indication of the locally unique set of port numbers allocated to that user;

retrieving the user name from the user name resolution record using a network address and a port number; and

resolving the user name from information contained in each network communication packet by extracting the network address and port number corresponding to a network packet indicia.

2. The method of claim 1, wherein the user name resolution record further comprises time information indicating when the network session was initiated.

3. The method of claim 1, wherein the user name is captured using security auditing information made available by a domain controller coupled to the network.

4. The method of claim 1, wherein the range of port numbers assigned to each user is assigned by a transport layer process.

5. The method of claim 1, further comprising:

retrieving the user name from the user name resolution record using the network address and time at which a particular network communication occurred.

6. A network-coupled computing device implementing the method of claim 1.

7. A memory device for storing a user name resolution database for access by an application program being executed on a data processing system, said memory comprising:

a plurality of records stored in said memory and used by said application,

wherein each record corresponds to a particular user and each record comprises

a logon time,

a network address, and

an indication of a locally unique set of port numbers allocated to that user for that user'"'"'s session,

wherein the locally unique set of port numbers allocated to that user is not assigned during that user'"'"'s session to a different user, and

wherein said application is configured to

capture a user name for each user when each user logs into a multi-user system for a session;

correlate a session ID with each user;

apportion a range of available port numbers into a number of partitions, wherein the number of partitions is selected to provide a partition for each concurrent user of the multi-user system;

allocate a locally unique set of port numbers to each user for that user'"'"'s session;

cause port number requests initiated by a process within a particular user'"'"'s session to be assigned a port number from within a partition allocated to that particular user;

for each user, store a user name resolution record comprising the user name, a network address, and an indication of the locally unique set of port numbers allocated to that user;

retrieve the user name from the user name resolution record using a network address and a port number; and

resolve the user name from information contained in each network communication packet by extracting the network address and port number corresponding to a network packet indicia.

8. The user name resolution database stored in said memory of claim 7, wherein the indication of the set of port numbers is a session ID associated with the user.

9. A network management device, comprising:

an interface for coupling to a network;

a user name resolution data structure having a plurality of records,

wherein each record comprises fields indicating a logon time and a network address for a particular user as well as an indication of the set of port numbers allocated to that user for that user'"'"'s session, and

wherein the locally unique set of port numbers allocated to that user is not assigned during that user'"'"'s session to a different user; and

a component for determining a particular user name from a given network address and a given port number obtained from a communication packet indicia,

wherein the device is operable to

correlate a session ID with each user;

apportion a range of available port numbers into a number of partitions,

wherein the number of partitions is selected to provide a partition for each concurrent user of the multi-user system; and

cause port number requests initiated by a process within a particular user'"'"'s session to be assigned a port number from within a partition allocated to that particular user.

10. The network management device of claim 9, wherein the device is operable to identify a particular user associated with web (HTTP) traffic on the network.

11. The network management device of claim 9, wherein the device is operable to identify a particular user associated with email (SMTP) traffic on the network.

12. The network management device of claim 9, wherein the device is operable to identify a particular user associated with peer-to-peer (p2p) messaging traffic on the network.

13. The network management device of claim 9, wherein the device is operable to identify a particular user associated with file transfer protocol (FTP) traffic on the network.

14. The network management device of claim 9, wherein the device is operable to identify a particular user associated with instant messaging traffic on the network.

15. The network management device of claim 9, wherein the device is operable to identify a particular user associated with online game traffic on the network.

16. The network management device of claim 9, further comprising:

a blocking component operable to selectively block communication packets associated with a particular user.

17. The network management device of claim 9, further comprising:

a blocking component operable to selectively block communication packets associated with a first user and a particular network accessible resource while allowing communication packets from a second user and the particular network accessible resource.

18. The network management device of claim 9, further comprising:

a bandwidth management component operable to enforce per-user bandwidth policy using the address and port number obtained from communication packets.