Abstract:
A system and method for resolving an identity includes a security console, which displays security information regarding a secure network. The security information includes at least a first identity used to access the secure network. An operator selects the first identity, and the security console sends it to a resolver. The resolver connects with an identity server to find an access session record with an identity matching the first identity. A second identity is extracted from this record, and the resolver returns a result that includes the second identity. The security console displays the second identity; The first identity can be a user identity of a user, where the second identity is corresponding host identity, or vise versa. In this manner, an efficient interface to security information is provided to an operator, where the operator may resolve a user/host identity to a host/user identity interactively.

Description:
BACKGROUND 
       [0001]    1. Field 
         [0002]    This invention relates generally to data networking, and more specifically, to a system and method to interactively resolve an identity. 
         [0003]    2. Related Art 
         [0004]    The secure data network of a company is a critical component for day-to-day functioning of company business activities. A company employee uses a host device, such as a desktop personal computer, a laptop personal computer, a personal data assistant (PDA), a workstation, or a smartphone to access the secure data network for communication within the company and with the outside world. An employee typically accesses the secure data network after a successful log-on process, using an employee name or an employee identity. 
         [0005]    Information about an employee&#39;s access to the secure data network is recorded in the secure data network, such as in an identity server, an authentication server, or an identity management system. The information associates an employee identity with an identity of the host device used for the secure data network access, such as an Internet Protocol (IP) address or a Media Access Control (MAC) address. 
         [0006]    Security data network also records network activities of the host device in the form of event logs, security alerts, network performance reports, or security monitor records. Information technologies (IT) staff supporting the security data network often have to plow through a large volume of such information to troubleshoot security instances, such as security breaches, suspicious network activities or employee complaints. Oftentimes, IT staff has to discover the owner of a host device, or the employee who is using the host device at the time of the security instance in order to troubleshoot a security instance. 
         [0007]    In one example, IT support engineer Eddie receives a security alert, flagging a suspected malicious attack to the secure data network from a host device. The security alert includes an Internet Protocol (IP) address of the host device. In order to contact the employee using the host device for remedial action, Eddie first queries a Dynamic Host Control Protocol (DHCP) server to find a device identity such as a Media Access Control (MAC) address of the host device. In one scenario, Eddie queries a directory server, or an identity server to find the employee who is using the host device. In another scenario, Eddie checks an inventory record, such as an inventory database, a spreadsheet or a hard copy list to find the employee or the department who owns the host device. This largely manual process unfortunately, takes minutes if not hours to complete. This not only hampers Eddie&#39;s ability to solve other security issues, but may also spell lost opportunity to come up with a timely remedial solution for the security instance. 
         [0008]    In another example, while monitoring the secure data network, Eddie notices unusual confidential document retrieval activities associated with an employee name “Maria Vista”. Eddie manually queries an identity server for security network access information, and finds that “Maria Vista” has accessed secure data network using three different devices in the past 2 hours. Alarmed, Eddie manually looks up inventory database and other network configuration information to locate the devices. This slow process causes unacceptable delay, and by the time Eddie sends a security guard to investigate, the alleged perpetrator is nowhere to be found. 
         [0009]    Accordingly, there is a need for a system and method to allow an IT personnel to interactively resolve a host device identity to an employee identity, and vice versa. This invention addresses such a need. 
       SUMMARY 
       [0010]    A system and method for resolving an identity includes a security console, which displays security information regarding a secure network. The security information includes at least a first identity used to access the secure network. An operator selects the first identity, and the security console sends it to a resolver. The resolver connects with an identity server to find an access session record with an identity matching the first identity. A second identity is extracted from this record, and the resolver returns a result that includes the second identity. The security console displays the second identity. The first identity can be a user identity of a user, where the second identity is corresponding host identity, or vise versa. In this manner, an efficient interface to security information is provided to an operator, where the operator may resolve a user/host identity to a host/user identity interactively. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0011]      FIG. 1   a  illustrates a secure network. 
           [0012]      FIG. 1   b  illustrates a security console and a resolver. 
           [0013]      FIG. 2   a  illustrates a process for an operator to select an identity. 
           [0014]      FIG. 2   b  illustrates a process for security console to invoke resolver. 
           [0015]      FIG. 2   c  illustrates an identity resolution process. 
           [0016]      FIG. 2   d  illustrates identity resolution choices. 
       
    
    
     DETAILED DESCRIPTION 
       [0017]      FIG. 1   a  illustrates a secure network. A secure network  160  includes a host  130 . A user  120  uses host  130  to access secure network  160 . 
         [0018]    In one embodiment, secure network  160  includes a data network based on an Internet Protocol (IP). In one embodiment, secure network  160  includes a wired Local Area Network (LAN) such as an Ethernet. In one embodiment, secure network  160  includes a Wireless Local Area Network (WLAN). In one embodiment, secure network  160  includes a Wide Area Network (WAN). In one embodiment, secure network  160  includes a public data network, such as a WiFi hotspot network, or a cellular data network such as General Packet Radio Service (GPRS) network. In one embodiment, secure network  160  includes a private data network such as a home network, a corporate network, a regional corporate network or a corporate Virtual Private Network (VPN). In one embodiment, secure network  160  includes a service provider network. 
         [0019]    Host  130  is a computing device with network access capabilities. In one embodiment, host  130  is a desktop personal computer or a laptop personal computer. In one embodiment, host  130  is a Personal Data Assistant (PDA), a smartphone, or a cellular phone. 
         [0020]    Typically, user  120  uses host  130  to access secure network  160  over an access session  170  for some duration. During access session  170 , user  120  assumes a user identity  172  and host  130  assumes a host identity  173 . User identity  172  corresponds to host identity  173  for the access session  170 . 
         [0021]    In one embodiment, user identity  172  includes a user name, a subscriber name, or an employee number. In one embodiment, user identity  172  includes a telephone number, an extension number, or an email address. 
         [0022]    In one embodiment, host identity  173  includes an Internet Protocol (IP) address. In one embodiment, host identity  173  includes a Media Access Control (MAC) address. In one embodiment, host identity  173  includes a host name. In one embodiment, host identity  173  includes an International Mobile Subscriber Identity (IMSI), a Temporary Mobile Subscriber Identity (TMSI), or an International Mobile Equipment Identity (IMEI), or a Mobile Equipment Identifier (MEID). 
         [0023]    Access session record  178  records information about access session  170 . Access session record  178  includes user identity  172  and host identity  173 . In one embodiment, access session record  178  includes access time  175 . Access time  175  records the time of the access session  170 . In one embodiment, access time  175  includes a time stamp of the starting time of access session  170 . In one embodiment, access time  175  includes a time stamp of the ending time of access session  170 . 
         [0024]    Identity server  162  stores access session record  178 . In one embodiment, identity server  162  creates access session record  178  at the starting time of access session  170 . In another embodiment, identity server  162  creates access session record  178  after the ending time of access session  170 . In an embodiment, identity server  162  creates access session record  178  during access session  170 . Identity server  162  may record access time  175  during or after access session  170 . 
         [0025]      FIG. 1   b  illustrates a security console and a resolver. 
         [0026]    Security console  180  is a software application presenting security information  184  about secure network  160 . Resolver  110  is a software program associated with security console  180 . 
         [0027]    Security console  180  runs on a computing device with a display screen. The computing device can be a server, a workstation, a desktop personal computer, a laptop personal computer, a Personal Data Assistant (PDA), or a smartphone. Security console  180  presents security information  184  about secure network  160  on the display screen. 
         [0028]    In one embodiment security information  184  is an event log, a security alert, a network report, a result of a security query, a network performance summary, a security monitoring record, or a historical network usage report. In one embodiment, security console  180  includes a browser. 
         [0029]    An operator  190  uses security console  180  to interactively monitor secure network  160 . In one embodiment, the computing device provides input module  185  such as a mouse, a pointing device, a stylus or a touchscreen for operator  190  to interact with security console  180 . 
         [0030]    In one embodiment, security console  180  presents user identity  172 . Operator  190  uses input module  185  to select user identity  172  and invokes resolver  110  to resolve user identity  172 . In one embodiment, resolver I  10  resolves user identity  172  to host identity  173 . In one embodiment, resolver  110  resolves user identity  172  to access session record  178 . 
         [0031]    In one embodiment, operator  190  selects user identity  172  by using the mouse to highlight user identity  172 . In one embodiment, operator  190  selects user identity  172  by placing the mouse over user identity  172 . 
         [0032]    In another embodiment, security console  180  presents host identity  173 . Operator  190  uses input module  185  to select host identity  173  and invokes resolver  110  to resolve host identity  173  to user identity  172 . In one embodiment, resolver  110  resolves host identity  173  to access session record  178 . 
         [0033]      FIG. 2   a  illustrates a process for an operator to select an identity. 
         [0034]    Operator  290  selects a character sequence  281  in security information  284  displayed on security console  280 . 
         [0035]    In one embodiment, operator  290  highlights character sequence  281  using input module  285 . In one embodiment, operator  290  highlights by indicating the first character and the last character of character sequence  281 . In one embodiment, operator  290  indicates the first character by clicking a mouse button of input module  285  at a location before the first character. Likewise, operator  290  indicates the last character by clicking a mouse button of input module  285  at a location after the last character. In one embodiment, character sequence  281  is a word or a sequence of words. In one embodiment, operator  290  highlights the word by double clicking a mouse button of input module  285 . 
         [0036]    In one embodiment, security console  280  includes identity recognizer  283 . Identity recognizer  283  analyzes character sequence  281  to determine identity  274 . In one embodiment, identity recognizer  283  recognizes a string of four numbers separated by periods such as “172.168.0.105” in character sequence  281 . Identity recognizer  283  determines identity  274  to be a host identity as an IP address. In one embodiment, identity recognizer  283  recognizes a string of six two-digit hexadecimal numbers separated by hyphens or colons such as “00-08-74-4C-7F-1D” or “01:23:45:6C:89:AB” in character sequence  281 . Identity recognizer  283  determines identity  274  to be a host identity as an Ethernet MAC address. 
         [0037]    In one embodiment, identity recognizer  283  recognizes character sequence  281  as one or more words such as “John Smith”. Identity recognizer  283  determines identity  274  to be a user identity as a user name. In one embodiment, identity recognizer  283  recognizes character sequence  281  as one or more digits such as “0239581”. Identity recognizer  283  determines identity  274  to be a user identity as an employee number. In one more embodiment, identity recognizer  283  recognizes character sequence  281  as one word that includes an “@” character such as “johnsmith@goldenbank.com”. Identity recognizer  283  determines identity  274  to be a user identity as an email address. 
         [0038]      FIG. 2   b  illustrates a process for security console to invoke resolver. 
         [0039]    In one embodiment, security console  280  includes a browser such as Internet Explorer, Firefox, Netscape, Safari or Opera. In one embodiment, security console  280  includes a text editor. In one embodiment, security console  280  includes a network management application, a network monitor application, a network security management application, a network performance monitor application. 
         [0040]    Security console  280  connects to resolver  210  over a plug-in interface  289 . 
         [0041]    In one embodiment, plug-in interface  289  is an ActiveX Control Application Programming Interface (API). In one embodiment, plug-in interface  289  is based on Component Object Model (COM) or Distributed Component Object Model (DCOM). In one embodiment, plug-in interface  289  is based on Object Linking and Embedding (OLE) technology. In one embodiment, plug-in interface  289  is based on Firefox extension system. In one embodiment, plug-in interface  289  is based on Java applets technology. 
         [0042]    Security console  280  sends identity  274  to resolver  210  over plug-in interface  289 . 
         [0043]    Security console  280  receives result  279  from resolver  210  over plug-in interface  289 . In one embodiment, identity  274  is a first host identity. In one embodiment, result  279  includes a first user identity that corresponds to the first host identity. In one embodiment, result  279  includes a first access session record. In another embodiment, identity  274  is a second user identity. In one embodiment, result  279  includes a second host identity that corresponds to the second user identity. In one embodiment, result  279  includes a second access session record. 
         [0044]    In one embodiment, security console  280  formats and displays result  279  on the display screen. In one embodiment, security console  280  displays result  279  in a dialog box next to identity  274  in the displayed security information  284 . In one embodiment, security console  280  reformats and displays security information  284  by including result  279  as part of security information  284 . 
         [0045]      FIG. 2   c  illustrates an identity resolution process. 
         [0046]    Resolver  210  receives identity  274  from security console  280  as illustrated in  FIG. 2   b.  Resolver  210  resolves identity  274  in conjunction with an identity server  260 . 
         [0047]    Identity server  260  stores a plurality of access session records. The plurality of access session records includes access session record  278 . 
         [0048]    Resolver  210  connects to identity server  260 . In one embodiment, resolver  210  connects to identity server  260  over a data network. In one embodiment, the data network is an IP network. In one embodiment, the data network is secure network. 
         [0049]    In one embodiment, resolver  210  connects to identity server  260  using Hypertext Transfer Protocol (HTTP). In one embodiment, resolver  210  connects to identity server  260  using Simple Object Access Protocol (SOAP), Simple Network Management Protocol (SNMP), Remote Method Invocation (RMI), Remote Procedure Call (RPC), or Light Weight Directory Access Protocol (LDAP). In one embodiment, resolver  210  connects to identity server  260  using a database connectivity API such as Open Database Connectivity (ODBC) API or Java Database Connectivity (JDBC) API. In one embodiment, resolver  210  connects to identity server  260  using a proprietary protocol. 
         [0050]    Resolver  210  sends identity  274  to identity server  260 . In one embodiment, identity  274  is host identity  273 . Identity server  260  selects access session record  278  with matching host identity  273 . Identity server  260  extracts user identity  272  from access session record  278 , and includes user identity  272  in response  269 . In one embodiment, identity server  260  includes access session record  278  in response  269 . 
         [0051]    In another embodiment, identity  274  is user identity  272 . Identity server  260  selects access session record  278  with matching user identity  272 . Identity server  260  extracts host identity  273  from access session record  278 , and includes host identity  273  in response  269 . In one embodiment, identity server  260  includes access session record  278  in response  269 . 
         [0052]    Identity server  260  sends response  269  to resolver  210 , completing the resolution process. 
         [0053]    In one embodiment, resolver  210  sends response  269  to security console  280  as result  279  as illustrated in  FIG. 2   b.    
         [0054]      FIG. 2   d  illustrates identity resolution choices. 
         [0055]    Security console  280  presents resolution choices to operator  290  based on identity  274 . 
         [0056]    In one embodiment, security console  280  recognizes that identity  274  is a user identity. Security console  280  presents to operator  290  a plurality of user identity resolution choices  240 . In one embodiment, user identity resolution choices  240  include host identity, access session record, or access history. In one embodiment, security console  280  presents user identity resolution choices  240  in a drop-down selection menu on the display screen. 
         [0057]    Operator  290  uses input module  285  to select from user identity resolution choices  240 . In one embodiment, operator  290  selects the access session record choice. Security console  280  sends identity  274  to resolver  210  over plug-in interface  289 , requesting resolution from user identity to access session record. 
         [0058]    In a similar fashion, security console  280  recognizes that security  274  is a host identity. Security console  280  presents to operator  290  a plurality of host identity resolution choices  241 . In one embodiment, host identity resolution choices  241  include user identity, access session record, or access history. 
         [0059]    In one embodiment, operator  290  uses input module to point to a character in security information  284  displayed on security console  280 . In one embodiment, operator  290  uses the mouse to point to the character. In one embodiment, operator  290  uses a stylus to point to the character. Identity recognizer  283  recognizes an identity  274  in a sequence of characters that includes the character. In one embodiment, the sequence of characters is delimited by a pair of white-space characters, such as character return, line-feed, or space characters. In one embodiment, the sequence of characters includes multiple words. In one embodiment, the sequence of characters is delimited by a pair of matching tags, such as Extended Markup Language (XML) tags or Hypertext Markup Language (HTTP) tags. 
         [0060]    In one embodiment, security console  280  automatically recognizes an identity  274  in security information  284 . In one embodiment, identity recognizer  283  automatically scans security information  284  to recognize identity  274 . Security console  280  sends the identity  274  to resolver  210 . In one embodiment, identity recognizer  283  matched the recognized identity  274  against a list of identities. Security console  280  sends the matched identity  274  to resolver  210 . 
         [0061]    In one embodiment, identity recognizer  283  automatically recognizes a plurality of identities. Security console  280  sends the plurality of identities to resolver  210 . 
         [0062]    In one embodiment, resolver  210  includes identity recognizer  283 . Security console  280  sends character sequence to resolver  210  over plug-in interface  289 . Resolver  210  invokes identity recognizer  283  to recognize identity  274  in character sequence  281 . In one embodiment, resolver  210  indicates to security console  280  the recognition of a user identity in character sequence  281  ; security console  280  presents user identity resolution choices  240  to operator. In a similar fashion, resolver  210  indicates to security console  280  the recognition of a host identity in character sequence  281 ; security console  280  presents host identity resolution choices  241  to operator  290 . 
         [0063]    In one embodiment, the resolution is based on time. Resolver  210  sends time information to identity server  260  together with identity  274 . Identity server  260  selects an access session record  278  with access time matching the time information. 
         [0064]    In one embodiment, after operator  290  selects identity  274 , security console  280  prompts operator  290  to enter time information. Security console  280  obtains time information from operator  290 . In one embodiment, security console  280  obtains time information from a clock that indicates time of day. Security console  280  sends time information together with identity  274  to resolver  210 . 
         [0065]    In one embodiment, access session record  278  includes additional user information, such as office or cubicle number or location, building number or location, telephone number, department name or email address. In one embodiment, host identity resolution choices  241  include additional user information choice. In one embodiment, access session record includes additional host information, such as host device type, host device location, network access point identity, or device owner information. In one embodiment, user identity resolution choices  240  include additional host information choice. 
         [0066]    In one embodiment, security console stores result in a document. In one embodiment, security console stores result in response to operator input. 
         [0067]    Foregoing described embodiments of the invention are provided as illustrations and descriptions. They are not intended to limit the invention to precise form described. In particular, it is contemplated that functional implementation of invention described herein may be implemented equivalently in hardware, software, firmware, and/or other available functional components or building blocks, and that networks may be wired, wireless, or a combination of wired and wireless. Other variations and embodiments are possible in light of above teachings, and it is thus intended that the scope of invention not be limited by this Detailed Description, but rather by Claims following.