Patent ID: 8166554

Claim:
A computer implemented method comprising: by a network device, separating a packet stream between one or more network hosts and one or more network resources configured to execute a plurality of applications into a plurality of individual data streams based at least in part on, for each of the plurality of individual data streams, to which of a plurality of users the data stream belongs, the packet stream comprising a plurality of control packets and data packets, the separating further comprising identifying at least one authentication exchange packet from packets traversing on a network, extracting a first user ID and a first network address from the authentication exchange packet, and filtering packets traversing on the network that each have a network address equivalent to the first network address; identifying the users associated with the individual data streams using a directory service; and determining a network policy based at least in part on the separating and the identifying, the network policy identifying, for each of the plurality of applications, which of the plurality of users have access from the one or more network hosts to the application.