Abstract:
The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user&#39;s public user identity used to access the public application, the user&#39;s private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record. If they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     The present application is a continuation of co-pending U.S. patent application entitled “System and Method to Associate a Private User Identity with a Public User Identity”, Ser. No. 13/153,385, filed on Jun. 3, 2011; which is a continuation of U.S. patent application Ser. No. 12/771,491, filed on Apr. 30, 2010, now U.S. Pat. No. 7,979,585, issued on Jul. 12, 2011; which is a continuation of U.S. patent application Ser. No. 11/582,613, filed on Oct. 17, 2006, now U.S. Pat. No. 7,716,378, issued on May 11, 2010. 
    
    
     BACKGROUND OF THE INVENTION 
     1. Field 
     This invention relates generally to data networking, and more specifically, to a system and method to associate a public user identity with a private user identity during an application session. 
     2. Related Art 
     The secure data network of a company is a critical component for day-to-day functioning of company business activities. Company employees access the secure data network for communication within the company and with the outside world. Company information, oftentimes proprietary or confidential, is exchanged during the communication. 
     Typically, an employee gains access to the company&#39;s secure data network by means of a network logon procedure using a private user identity, such as a user name “Robert P. Williamson” or an employee number “NGO1-60410”. Subsequent information exchange using the company&#39;s office applications, such as email, file transfer or document control is traceable based on the private user identity through network event logs. 
     Since the late 1990&#39;s, we have been witnessing the phenomenal rising popularity of public communication services, such as email and Instant Messaging offered by Yahoo™, America Online™ (AOL), or Google™, conferencing and collaboration services offered by Webex™ or Centra™, or peer-to-peer services for a variety of file sharing. Generally, a public communication service allows a user to exchange information through messaging, text chat or document exchange using a public user identity, such as “butterdragon”, “fingernail1984”, or “peterrabbit”. 
     However, in a company setting, when an employee connects to a public communication service with a public user identity over the company&#39;s secure data network, the information exchange is not easily traceable if at all since the public user identity is not tied to the private user identity. 
     In one example, a company&#39;s information technology (IT) department notices that an employee Victor has been using the company&#39;s email system to send out proprietary documents, violating the company&#39;s security policy. After issuing a warning to Victor, the IT department finds no further violations. Unfortunately, they are not aware of the fact that Victor has continued this activity using Yahoo™ email with a public user identity “PiratesOfCaribbean@Yahoo.com”. 
     In another example, two weeks before a major trade show, a company implements a security measure to monitor communication activities of employees of director level and above to ensure confidentiality of competitive information. This security measure, covering company email, phone conversation and voice messaging, nevertheless proves to be a failure as sensitive information leaks out to a business reporter anyway prior to the trade show. The source of the leak may never be confirmed, but the business reporter privately discloses that he gets the information from an anonymous employee of the company using AOL Instant Messaging™ with screen name “opensecret2006”. 
     The above discussion illustrates the need for a solution to associate a public user identity to a private user identity. 
     BRIEF SUMMARY OF THE INVENTION 
     A system and method for associating a private user identity with a public user identity is disclosed. The system includes a host, a network which includes a security gateway, and a public application residing externally to the network. An access session is established between the network and the host. An application session is established between the public application and the network via the security gateway, and an application session record is created for it. The application session record includes the user&#39;s public user identity, used to access the public application, and the user&#39;s private user identity, used for accessing the network through the host. It further includes a host identity, and an application session time. To determine the private user identity for the application session, the security gateway queries an identity server, on which the access session record resides. The host identities in the application and access session records are then compared, as well as the access session time with the application session time. If they match, then the private user identity in the access session record is returned to the security gateway, which stores it as the private user identity in the application session record. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE FIGURES 
         FIG. 1   a  illustrates a secure network. 
         FIG. 1   b  illustrates an access session and an application session. 
         FIG. 1   c  illustrates an access session record and an application session record. 
         FIG. 2  illustrates a process to generate an application session record. 
         FIG. 3  illustrates a process to recognize an application session. 
         FIG. 4   a  illustrates a process to determine a public user identity of application session. 
         FIG. 4   b  illustrates a data packet in an AIM log-on packet. 
         FIG. 5  illustrates a process to determine a private user identity. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       FIG. 1   a  illustrates a secure network. 
     A secure network  160  includes a host  130 . User  120  uses host  130  to access a public application  180  hosted in application server  190 . Application server  190  is outside of secure network  160 . The network traffic between host  130  and application server  190  passes through security gateway  150 . 
     Host  130  is a computing device with network access capabilities. In one embodiment, host  130  is a workstation, a desktop personal computer or a laptop personal computer. In one embodiment, host  130  is a Personal Data Assistant (PDA), a smartphone, or a cellular phone. 
     In one embodiment, secure network  160  is an Internet Protocol (IP) network. In one embodiment, secure network  160  is a corporate data network or a regional corporate data network. In one embodiment, secure network  160  is an Internet service provider network. In one embodiment, secure network  160  is a residential data network. In one embodiment, secure network  160  includes a wired network such as Ethernet. In one embodiment, secure network  160  includes a wireless network such as a WiFi network. 
     Public application  180  provides a service that allows user  120  to communicate with other users in a real-time fashion. In one embodiment, the service includes text chat. In one embodiment, the service includes a voice call or a video call. In one embodiment, the service includes a network game. In one embodiment, the service includes exchanging a document, such as sending or receiving a text document, a powerpoint presentation, an excel spreadsheet, an image file, a music file or a video clip. 
     In one example, public application  180  provides America Online Instant Messenger™ service. In one example, public application  180  provides Yahoo Instant Messenger™ voice service. In one embodiment, public application  180  provides a file sharing service such as Kazaa™ file sharing service. In one embodiment, public application  180  provides a network game service such as Microsoft™ Network Game service. 
     Security gateway  150  is situated at the edge of secure network  160 . Security gateway  150  connects secure network  160  to public application  180 . Security gateway  150  receives network traffic from secure network  160  and transmits the network traffic to application server  190 . Likewise, security gateway  150  receives network traffic from application server  190  and transmits the network traffic to secure network  160 . 
     In one embodiment, security gateway  150  includes the function of a corporate Wide Area Network (WAN) gateway. In one embodiment, security gateway  150  includes the function of a residential broadband gateway. In one embodiment, security gateway  150  includes the function of a WAN gateway for an Internet service provider. 
       FIG. 1   b  illustrates an access session and an application session. 
     User  120  uses host  130  to access secure network  160  during an access session  162 . 
     Host  130  has a host identity  134 . Host  130  uses host identity  134  to connect to secure network  160 . In one embodiment, host identity  134  includes an IP address. In one embodiment, host identity  134  includes a Media Access Control (MAC) address. 
     Within secure network  160 , user  120  has a private user identity  124 . In one embodiment, private user identity  124  is an employee number or an employee name. In one embodiment, private user identity  124  is an Internet service subscription identity. In one embodiment, access session  162  is established after a successful network user log-in procedure, such as an employee network log-in, for secure network  160  using private user identity  124 . Private user identity  124  is associated with host identity  134 . 
     User  120  uses host  130  to access public application  180  in an application session  182 . User  120  uses a public user identity  127  during application session  182 . In one embodiment, public application  180  prompts user  120  to log-in before establishing application session  182 . During the application user log-in procedure, user  120  provides to public application  180  public user identity  127 . In another embodiment, public application  180  selects a public user identity  127  for user  120  for application session  182 . In one embodiment, public user identity  127  is set up through a user registration process or a service subscription process. Network traffic in application session  182  passes through security gateway  150 . 
       FIG. 1   c  illustrates an access session record and an application session record. 
     Access session record  164  records information about access session  162 . The information includes private user identity  124 , host identity  134  and access session time  166 . In one embodiment, access session time  166  is the starting time when access session  162  is established. In one embodiment, access session time  166  includes the starting time and the ending time when user  120  finishes access session  162 . 
     Application session record  184  records information about application session  182 . The information includes private user identity  124 , public user identity  127 , and application session time  186 . In one embodiment, the information further includes host identity  134 . In one embodiment, application session time  186  includes the starting time when application session  182  is established. In one embodiment, application session time  186  includes a time stamp during application session  182 . In one embodiment, application session time  186  includes a time stamp when security gateway  150  recognizes application session  182 . 
       FIG. 2  illustrates a process to generate an application session record. 
     The process of generating application session record  184  includes multiple steps. 
     In step  201 , security gateway  150  recognizes an application session. 
     In step  202 , security gateway  150  determines a public user identity  127  of the application session. 
     In step  203 , security gateway  150  determines a private user identity  124  using information about the application session. 
       FIGS. 3-5  illustrates steps  201 - 203  respectively. 
       FIG. 3  illustrates a process to recognize an application session. 
     Security gateway  150  inspects network traffic between host  130  and application server  190  to recognize application session  182  for public application  180 . 
     In one embodiment, security gateway  150  inspects data packet  339  between host  130  and application server  190  for the recognition of application session  182 . 
     Security gateway  150  includes an application identifier  355  for public application  180 . Application identifier  355  includes information for recognizing application session  182 . In one embodiment, application identifier  355  includes a transport layer information, such as Transmission Control Protocol (TCP) or User Diagram Protocol (UDP); and at least one transport port number, such as a TCP port number or a UDP port number. In one embodiment, application identifier  355  includes application layer information, such as one or more data filters wherein a data filter specifies a value and a position of the value in a data packet  339 . In one example, a data filter is [byte  0  with value “Ox52”]. In one example, a data filter is [byte  4 - 7  with ASCII value of “ADEH”]. 
     Security gateway  150  matches data packet  339  against application identifier  355 . 
     In one embodiment, application identifier  355  includes transport protocol type of TCP and a destination TCP port number of  5190 , the TCP port number used by AIM protocol. In this embodiment, data packet  339  is a TCP packet from host  130  to application server  190 . Security gateway  150  matches data packet  339  against application identifier  355  and determines that public application  180  provides AIM service. 
     Security gateway  150  creates application session record  184 . Security gateway  150  extracted the source IP address from the IP header of data packet  339 , and stores the source IP address as host identity  134 . In one embodiment, data packet  339  includes link layer information, such as a source MAC address; security gateway  150  extracts and stores the source MAC address as host identity  134 . 
     In one embodiment, security gateway  150  connects to a clock  359 . Clock  359  indicates the current time of day. Security gateway  150  stores the time of day indicated by clock  359  in application session time  186 . 
       FIG. 4   a  illustrates a process to determine a public user identity of application session  182 . 
     The method for determining public user identity  127  is typically specific to public application  180 . In one embodiment, data packet  339  is an application packet. For example, public application  180  provides AIM service; data packet  339  is an AIM packet. 
     An AIM packet includes multiple fields, for example 
     Command start field is a 1-byte data field starting at byte offset 0 having a fixed hexadecimal value “Ox02”; 
     Channel ID field is a 1-byte data field starting at byte offset 1; 
     Sequence number field is a 2-byte integer starting at byte offset 2; 
     Data field length field is a 2-byte data field starting at byte offset 4; 
     Family field is a 2-byte data field starting at byte offset 6; and 
     Subtype field is a 2-byte data field starting at byte offset 8. 
     An AIM log-on packet is a AIM packet with family field having a fixed hexadecimal value of “OxOO Oxl?” and subtype field having a fixed hexadecimal value of “OxOO Ox06”. 
     AIM log-on packet further includes buddy name length field, a I-byte integer starting at byte offset 19, and a variable length buddy name field  407  starting at byte offset 20. Buddy name length field  405  indicates the length in bytes of buddy name field  407 . 
     Security gateway  150  matches data packet  339  to determine if data packet  339  is an AIM log-on packet. In one embodiment, data packet  339  is an AIM log-on packet  400  illustrated in  FIG. 4   b . Security gateway  150  extracts buddy name length field  405 . Security gateway  150  furthers extracts buddy name field  407 . In this embodiment, buddy name length field  405  is integer “13” and buddy name field  407  is “JohnSmith1984”. Security gateway  150  stores “JohnSmith1984” as public user identity  127  in application session record  184 . 
     In one embodiment, data packet  339  is not an AIM log-on packet. Security gateway  150  inspects another data packet  339  from host  130 . 
       FIG. 5  illustrates a process to determine a private user identity. 
     Secure network  160  includes an identity server  570 . Identity server  570  includes access session record  164  of access session  162  during which user  120  accesses application session  182 . 
     Security gateway  150  queries identity server  570 . Security gateway  150  sends host identity  134  and application session time  186  to identity server  570 . 
     Identity server  570  receives host identity  134  and application session time  186 . Identity server  570  matches host identity  134  and application session time  186  against access session record  164 . Identity server  570  determines that host identity  134  matches host identity  134  of access session record  164 . Identity server  570  further determines that application session time  186  matches access session time  166  of access session record  164  as application session time  186  is between the starting time and the ending time of access session record  164 . Identity server  570  sends private user identity  124  of access session record  164  to security gateway  150  as a response to the query. 
     Security gateway  150  receives private user identity  124  from identity server  570 , and stores private user identity  124  in application session record  184 . 
     In one embodiment, security gateway  150  stores public user identity  127  in application session record  184  after recognizing a log-on approval indication for the public user identity  127  from public application  180 . 
     In one embodiment, security gateway  150  queries identity server  570  immediately after determining public user identity  127 . In one embodiment, security gateway  150  queries identity server  570  after application session  182  ends. 
     In one embodiment, security gateway  150  queries identity server  570  by sending a plurality of host identities in a bulk request; and receives a plurality of private user identities in a bulk response. 
     In one embodiment, application session record  184  includes additional user information associated with private user identity  124 , such as cubicle or office number, cubicle or office location, telephone number, email address, mail-drop location, department name/identity, or manager name. 
     In one embodiment, security gateway  150  obtains the additional user information from identity server  570 . In one embodiment, security gateway  150  obtains the additional user information by querying a different server, such as a corporate directory server, by using the private user identity  124  received from identity server  570 . 
     In one embodiment, security gateway  150  generates a security report based on application session record  184 . In one embodiment, security gateway  150  generates a security report based on a pre-defined private user identity  124  or a list of pre-defined private user identities. In one embodiment, security gateway  150  generates a security report based on a pre-defined schedule or when requested by an operator. In one embodiment, security gateway  150  generates a security report based on corporate security policy. 
     In one embodiment, public application  180  provides file transfer service using File Transfer Protocol (FTP) protocol or a proprietary protocol. In one embodiment, public application  180  provides email service using Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP) or Post Office Protocol version 3 (POP3) protocol. 
     Foregoing described embodiments of the invention are provided as illustrations and descriptions. They are not intended to limit the invention to precise form described. In particular, it is contemplated that functional implementation of invention described herein may be implemented equivalently in hardware, software, firmware, and/or other available functional components or building blocks, and that networks may be wired, wireless, or a combination of wired and wireless. Other variations and embodiments are possible in light of above teachings, and it is thus intended that the scope of invention not be limited by this Detailed Description, but rather by Claims following.