Patent Application
20100242095
This invention relates to the use of Firewall and Proxy technology, heretofore Internet Control Device, to intercept a Client-Server computer transaction and associate the physical person, heretofore User, identification information stored in an LDAP or RADIUS server system, such as Microsoft Active Directory, to control access to various Internet Application resources.
The Internet includes many different servers and clients. But to operate each Client needs to access an Application Resource on a specific Server. Within the terminology of servers, Internet Control Devices are devices that intercept transactions and allow or disallow a transaction to continue based on a Policy. This control architecture is fundamental when it comes to the wide-spread and widely variable content that exists on the Internet.
Effectively controlling access in today's environments when IP addresses are delivered to Client systems without respect to the User identification, detailed information needs to be extracted and coordinated between the Internet Application resource, the Client computing environment and the User. Many environments use a RADIUS, LDAP or Microsoft® Active Directory process to authenticate Users onto the network. As used herein, the Authentication Method will relate to any process of defining an individual User to a Client, including virtual Clients, and to a specific Internet Application resource. As used herein, the Authentication Data Store will contain a list of users and the associated client systems with the result that a User's Client-to-Internet Application resource request can be controlled by policy.
Extraction of the User identity from an initial Client to Internet Application resource transaction within the Web Server environment, such as a request to www.google.com, uses a well-known Authentication request process called WWW-Authenticate Response Header and the replies back to the initiating Client system requesting User identity data. The User identification data is released from the Client via the HTTP Digest access authentication, IETF RFC 2069, process. This process commonly occurs transparently to the User when the Internet Control Device requesting the information is 1) trusted by the Client, and 2) when the application knows how to respond to the request.
This invention creates a method of determining User identification when a Client request to an Internet Application resource does not have a standardized method for responding to well-known Authentication processes.
This invention solves a problem that occurs when an Internet Application does not have the capability to respond to a standard Authentication request. Applications such as Instant Messaging, peer-to-peer traffic, streaming media services and Microsoft® Outlook commonly ignore a WWW-Authenticate Response transaction. A new method to identify a User that transparently covers both a response to the Standard Authentication and to the lack of a response was needed.
The art described is a process to use various identification methods to populate a number of different Application Data Stores each containing a database of specific User identification information associated with the originating Client computer identification, and the associated Internet Application resource.
Each Application Data Store associates an Internet Application resource, eg Peer-to-Peer and Instant Messaging are two different Internet Application types, and an associated Authentication method connected to a list of Users requesting access to that specific Internet Application resource. Unique Application Data Stores are created when differing Application Authentication Methods are required. Each Application Data Store associates a unique Authentication method to a specific User and Client system.
Each Application Data Store contains an optional Internet Application resource time-to-live value. The value is reset to a starting point when the Internet Application is accessed by the User from the Client. When the time-to-live value expires, the Users credential information and Client system information are purged from the database. This process effectively logs the Client out of that specific Internet Resource application.
An Access Data Store is used to aggregate the contents of the different Application Data Stores. The Access Data Store, in certain environments such as a Microsoft Active Directory infrastructure, has the ability to monitor Active Directory log-in and log-out events. This function allows the Access Data Store to create an entry without an associated Application Data Store entry being first created.
The Access Data Store has connection into the Active Directory log system to monitor the event log. This connection allows for the Access Data Store to create or remove Users as the event log shows Users entering and exiting the network. This is done asynchronously to the Users access request for Internet resources.
The Access Data Store is referenced by the Internet Control Device to determine a User's credentials prior to allowing access to a specific Internet resource or Application. The Internet Control Device has an existing plethora of methods to restrict access once the User is identified.
A more complete understanding of the invention may be obtained from consideration of the following description in conjunction with the drawing, in which:
Additionally, the Access Data Store (307) create a database of User IDs (308) which is the same User ID defined in the Application Data Store (304) to allow for an Internet Control Device to isolate a User to an Application. Within the Access Data Store (307) are the Application IDs (309) that specific user accesses as well as the Computer ID and User Access Time.
