Patent ID: 8266327

Claim:
A data processing apparatus, comprising: a plurality of network interfaces that are coupled to a data network for receiving one or more packets therefrom and sending one or more packets thereto; one or more processors; a switching system coupled to the one or more processors and packet forwarding logic, wherein the switching system and packet forwarding logic are configured to receive packets on a first network interface, determine a second network interface on which to send the packets, and to send the packets on the second network interface; logic comprising one or more stored instructions which when executed by the one or more processors causes: receiving over the network, from a message sender, an application-layer message comprising one or more of the packets; receiving, from a user, a user-defined message identity policy that defines first identity information in a transport-layer protocol header of the application-layer message and that defines whether to extract: the first identity information from the transport-layer protocol header second identity information from an application-layer protocol header of the application-layer message and third identity information from a message body of the application-layer message; extracting the first identity information, the second identity information and the third identity information as specified in the message identity policy; determining one or more authentication operations to authenticate the first identity information, the second identity information and the third identity information; performing the one or more authentication operations, and in response, receiving one or more message sender identity attributes; performing a sign-on operation to a destination server of the message sender using the one or more message sender identity attributes; performing a responsive operation using the received application-layer message and the one or more message sender identity attributes; binding the one or more message sender identity attributes to a previously created outbound application-layer message.