Patent Application
20070101154
The subject matter described herein relates to methods, systems, and computer program products for associating an originator of a network packet with the network packet. More particularly, the subject matter described herein relates to methods, systems, and computer program products for associating an originator of a network packet with the network packet using biometric information.
In communications networks, network packets are sent and received by network components. Network packets may be intercepted in transit over a network for the purpose of network traffic monitoring and analysis. A network manager may utilize the network traffic analysis data for managing the network to keep network packet traffic flowing efficiently.
Network analysis equipment and software have been developed for intercepting network packets and performing monitoring, analysis and reporting functions based on the intercepted packets. An example of network analysis equipment or software that monitors and analyzes network traffic is known as a sniffer. A sniffer may capture packets, and the packets may be analyzed to detect bottlenecks and other network problems. A sniffer may be implemented in a network router. A typical network router reads every packet of data passed to it, and determines whether it is intended for a destination within the router's own network or whether it should be passed further along the network. A router with a sniffer may be able to read the data in the packet as well as the source and destination addresses.
A sniffer may display captured network data to a network manager via a graphic user interface (GUI). However, conventional sniffers may only recognize packet address information. These tools may not provide identification of the network user that is the source of the captured network packet. Further, MAC and IP address may be spoofed by an originator of network traffic. In the case of spoofing, the network manager would be unable to determine the source equipment of the network traffic. It may be advantageous for a network administrator to be able to more effectively associate network traffic with the network user that originated the network packet.
Accordingly, there exists a need for improved methods, systems, and computer program products for associating an originator of a network packet with the network packet.
According to one aspect, the subject matter described herein includes a method for associating an originator of a network packet with the network packet using biometric information. Biometric information may include human body characteristic data such as fingerprints, eye retinas and irises, facial patterns, voice patterns, hand measurements or other human body characteristics that are suitable for authenticating or identifying a network user. The method may include identifying biometric identification information for a network user. The biometric identification information may be associated with a header, trailer or other portion of a network packet originated by the network user. The network packet may be sent over a network. Network components receiving the network packet may associate the originator of the network packet with the network packet by using the identified biometric identification information.
The subject matter described herein can be implemented as a computer program product comprising computer executable instructions embodied in a computer readable medium. Exemplary computer readable media suitable for implementing the subject matter described herein include disk memory devices, chip memory devices, application specific integrated circuits, programmable logic devices, and downloadable electrical signals. In addition, a computer program product that implements the subject matter described herein may be located on a single device or computing platform. Alternatively, the subject matter described herein can be implemented on a computer program product that is distributed across multiple devices or computing platforms.
Exemplary embodiments of the subject matter will now be explained with reference to the accompanying drawings, of which:
According to one aspect, a system for associating an originator of a network packet with the network packet using biometric identification information may be implemented as hardware, software, and/or firmware components executing on one or more network components in a communications network.
Biometric reader 104 is operable to receive, measure and/or analyze biological identification information for a network user. Biological identification information may include human body characteristics such as fingerprints, eye retinas and irises, facial patterns, voice patterns, hand measurements and other suitable human body characteristics that are suitable for authentication purposes. In one example, biometric reader 104 may be a fingerprint scanner for obtaining identification data based on a fingerprint of a network user. In an alternate example, biometric reader 104 may be a retinal or iris scanner for obtaining identification data based an eye retina or iris of a network user. In still another alternate example, biometric reader 104 may be a camera and facial pattern analyzer for obtaining facial pattern data of a network user. In yet another alternate example, biometric reader 104 may be a sound recorder for obtaining data of a network user's voice patterns. In yet another alternative example, biometric reader 104 may be a hand measurement device for obtaining hand measurements of a network user. After obtaining data related to human body characteristics, the data may be converted to computer readable form and stored in local device 102.
According to one embodiment, biometric information identification function 103 may not include biometric reader 104. Biometric information identification function 103 may receive a network user's biometric identification information from another source. For example, a biometric reader may be separate from local device 102 and may be used for receiving, measuring and/or analyzing biological identification information for the network user. Alternatively, the biometric data can be pre-stored in a database that is part of local device 102 or is available to device 102 via network 100, and can be accessed by biometric information identification function 103 for identifying biometric information for a network user.
Local device 102 also includes means for associating the identified biometric identification information with a header, trailer, payload, or other portion of a network packet originated by the network user. For example, when a network user operates device 102, one or more network packets may be generated for communication on network 100. Biometric identification information may be associated with a header, trailer, payload, or other portion of a network packet in order to associate an originator of the network packet with the network packet. The originator of a network packet may be the network user operating the network component from which the network packet originated. As referred to herein, the network packet header may be a header of any non-application layers such as layer 2, 3, or 4 of the Open Systems Interconnection (OSI) communication model.
Local device 102 includes a biometricinformatic local agent (BLA) 108 including functions for associating an originator of a network packet with the network packet using biometric information. BLA 108 includes a biometric information network packet function 110 operable to associate the network user's biometric identification information with a network packet originated by the network user. In particular, when communicating with network 100, local device 102 may generate network packets for communication on network 100. The network packets may be generated while device 102 is being used by the network user. In one embodiment, function 110 may insert a biometric information identifier in a header or trailer, payload, or other portion of a network packet. The biometric information identifier may be used by network components for linking the network packet to biometric identification information for the network user originating the network packet. In an alternate embodiment, rather than inserting an identifier, function 110 may insert the network user's biometric identification information in a header, trailer, payload, or other portion of a network packet. Since biometric identification information, such as retinal scan data may be too large for inclusion in a header or trailer of a network packet, a hash function may be used to compute a unique data value based on the biometric identification information, and the unique data value may be inserted in the header or trailer of the network packet. In yet another embodiment, function 110 may insert biometric identification information in the payload of the network packet and insert a biometric information identifier in the network packet's header for indicating that the biometric identification information is in the payload.
As stated above, in one embodiment, a biometric information identifier is inserted in the packet and may be used by network components for linking the network packet to biometric identification information for the network user originating the network packet. For example, the biometric information identifier may link to a centralized biometric information database (described below) that stores biometric identification data for the network user. BLA 108 may include a biometric information identifier database 112 having entries with a biometric information identifier for linking a network packet header to biometric identification information of the originator of the network packet. Entries of database 112 may also include credentials of the network user. Examples of credentials may include a login ID and a password. Database 112 may also include contact information for the network user and associated with the biometric data so that the network user can be contacted. Contact information may include e-mail addresses, instant messaging (IM) addresses, phone numbers, and the like.
Network 100 may include an infrastructure device 114 for maintaining and storing biometric identification information and biometric information identifiers for network users. For example, device 114 may include a biometricinformatic coordinator function 116 for maintaining a centralized biometric information database 118 that stores biometric identification information and biometric information identifiers. Database 118 may also store user credentials and contact information as described above. Database 118 may include biometric identification information for the originator of network packets communicated from device 102. Further, database 118 may include a biometric information identifier associated with the biometric identification information. As stated above, the biometric information identifier may be inserted into a network packet for linking the network packet to biometric identification information for the originator of the network packet. For example, network components receiving network packets including a biometric information identifier may communicate a request including the identifier to device 114 for searching database 118 based on the identifier. A search function 120 may search database 118 for biometric identification information associated with the identifier. When biometric identification information associated with the identifier is found, the biometric identification information may be sent to the network component requesting the search. The biometric identification information may be displayed on the requesting network component so that the operator may associate the network packet with the network user originating the network packet.
Biometric information database 118 may receive biometric identification information from components of network 100 and generate links to the biometric identification information to be included in the network packets. For example, when biometric identification information is obtained at local device 102, the biometric identification information may be sent to infrastructure device 114. On receiving the biometric identification information, a biometric information identifier generator 122 may generate a unique biometric information identifier for the received biometric identification information. The biometric identification information and associated identifier may be stored in an entry in database 118. Further, the biometric information identifier may be sent to the network component that communicated the biometric identification information to device 114. The network component may receive the biometric information identifier and insert the network user identifier in network packets originated by the network user. In the example of biometric identification information being sent by local device 102 to device 114, device 114 may generate a biometric information identifier for the user of device 102 and send the biometric information identifier to device 102. Device 102 may insert the biometric information identifier in network packets sent by the network user to network 100. Network components receiving the message may read the biometric information identifier and request biometric identification information from device 114 based on the biometric information identifier.
As described above, existing protocol header fields, frame fields, and trailer fields may be used for placement of biometric identification information. To facilitate the placement of biometric identification information within existing packet formats, the following examples should provide appropriate guidance.
For example,
Local device 102 includes a means for sending network packets over a network. For example, device 102 includes a network interface card (NIC) 124 that is operable to transmit network packets over network 100. Local device 102 communicates with network 100 by sending and receiving network packets. As stated above, function 110 may insert a biometric information identifier for the originator of a network packet into the network packet. The packet including the biometric information identifier may be sent over network 100 via NIC 124.
As stated above, local device 102 may send network packets including a biometric information identifier over network 100. Network 100 includes components for intercepting a network packet including the identifier and requesting biometric identification information associated with the identifier. The biometric identification may be used to associate an originator of the network packet with the network packet. For example, an infrastructure device 126 of network 100 may include a NIC 128 connected to network 100 for intercepting network packets sent by device 102. Device 126 may include a biometricinformatic network agent (BNA) 130 for storing the data of received packets in a packet database 132. Further, BNA 130 may include a biometric information retrieve function 134 for reading a biometric information identifier from an intercepted network packet and retrieving biometric identification information based on the biometric information identifier. In particular, function 134 may communicate a request message to device 114 via network 100 for requesting biometric identification information corresponding to the biometric information identifier read from the packet. The request message may include the biometric information identifier and instructions to return biometric identification information corresponding to the biometric information identifier stored in database 118. As stated above, device 114 may include search function 120 for searching database 118 for biometric identification information based on the biometric information identifier. When the biometric identification information is retrieved from database 118, device 114may generate a response message including the biometric identification information and communicate the response to device 126. With the biometric identification information, an operator of device 126 may be able to associate the network packet with the biometric identification information of the network user that originated the network packet.
Device 126 includes a biometric information reader 136 for reading the biometric identification information contained in the response message sent by device 114. Biometric information reader 136 may be any suitable device for reading biometric identification information and presenting the biometric identification information to an operator of 102 via GUI 138. In one example, biometric identification information reader 136 may be operable to receive fingerprint data and display the data with GUI 138. In an alternate example, biometric identification information reader 136 may be operable to receive eye retina or iris data and display the data with GUI 138. In still another alternate example, biometric identification information reader 136 may be operable to receive facial pattern data and display the data with GUI 138. In yet another alternate example, biometric identification information reader 136 may be operable to receive voice pattern data and play the voice pattern data as sound with GUI 138. The operator of device 124 may be able to associate a received network packet with a network user based on the biometric identification information displayed via GUI 138.
According to one embodiment, an action may be performed in the network based on biometric identification information read from a sent packet. According to one embodiment, device 126 may send a notification, such as a message to device 102, for indicating receipt of a network packet associated with the network user. According to another embodiment, device 126 may log the biometric identification information in a log file. According to yet another embodiment, device 126 may perform packet traffic analysis based on the biometric identification information. An example of packet traffic analysis may include determining the number of packets communicated per user. In another embodiment, device 126 may establish a communication session with a network component having an address associated with the biometric identification information. The communication session with the network component may involve a call, e-mail, or IM. In another embodiment, the biometric identification information may be removed from the network packet. In yet another embodiment, a biometric information identifier in a sent packet may be removed from the sent packet. In another embodiment, biometric identification information may be removed from the network packet. In another embodiment, device 126 may set an alarm to notify a network component operator of receipt of a network packet associated with the network user. Biometric information retrieve function 134 may include functionality for performing one or more of these actions based on biometric identification information read from a sent packet.
Devices 102, 114, and 126 may each be any suitable component operating in a communications network. For example, local device 102 may be a PC, a telephone, or a personal digital assistant (PDA). Further, for example, infrastructure device 114 may be an authentication server. Infrastructure device 126 may be an intrusion detection system (IDS), a gateway, or a firewall. In addition, although devices 102, 114 and 126 are shown as separate devices in
User credentials and biometric identification information for a network user may be stored in database 112. In block 406, BLA 106 may determine whether database 112 includes an entry for the network user that includes a biometric information identifier. Database 112 may be searched based on the network user's user credentials to determine if the entry exists. If an entry exists that includes a biometric information identifier for the network user, function 110 may insert the biometric information identifier for the network user into network packets sent by device 102 onto network 100 (block 408). For example, referring to
Table 1 below shows an exemplary entry including a network user's user credentials and a biometric information identifier that may be stored in database 112.
In Table 1, user credentials for the exemplary entry includes a login ID and password. Alternatively, the user credentials may be any other suitable type of credentials that a network user may enter when operating a network device. The biometric information identifier may be a number or other suitable identifier for uniquely identifying an identifier to biometric identification information for the network user.
Referring again to block 406 of
In block 414, if it is determined that database 118 has an entry with matching network user credentials for the network user, BC 116 may communicate the biometric information identifier in the entry to BLA 108 (block 416). BLA 106 may store the biometric information identifier with the network user's user credentials in an entry in database 112 (block 418). The biometric information identifier may then be inserted into a header of network packet 410 originated by the network user (block 408).
Referring again to block 414 of
Referring to block 504, function 134 determines whether packet 410 includes a biometric information identifier. If it is determined that a network packet does not include a biometric information identifier, device 126 receives and analyzes packets (block 500). Otherwise, at block 504, if it is determined that a network packet includes a biometric information identifier, BNA 130 creates an entry in packet database 132 (block 506). The entry may include the biometric information identifier and other suitable data from the network packet. For example, the entry may include a network packet's source address, destination address, or protocol type.
Table 2 below shows an exemplary entry in database 132.
In Table 2, the exemplary entry includes the network packet's source and destination addresses. In addition, the entry includes the biometric information identifier contained in the packet.
In block 508, BNA 130 may use the biometric information identifier for retrieving the biometric identification information stored in database 118. For example, function 134 may generate a request message including the biometric identification information and communicate the request message to device 114. The request message instructions to return biometric identification information corresponding to the biometric information identifier stored in database 118. BNA 130 may receive the biometric identification information from device 114.
In block 510, BNA 130 determines whether to pass the received biometric identification information to another application for display to the operator of device 126. If it is determined to pass the received biometric identification information to another application for display, the biometric identification information can be passed to an application or function in device 126 or a network component for display to the operator (block 512). Otherwise, if it is determined not to pass the received biometric identification information to another application for display, biometric information reader 136 can read the biometric identification information and display the biometric identification information to the operator with GUI 138. In addition, GUI 138 may display network packet data such as the network packet's source address, destination address, protocol type, or any other suitable type of data associated with the network packet. By displaying the biometric identification information to the operator, the operator may be able to associate the network packet with the biometric identification information of the network user that originated the network packet.
As stated above, in one example of the subject matter described herein, biometric identification information may be inserted in the payload of a network packet. Further, a biometric information identifier may be inserted in the network packet's header for indicating that the biometric identification information is in the payload.
Device 600 may store the biometric identification information and user credentials in a biometric information database 602. A biometric information network packet function 604 may also generate a unique biometric information identifier for the network user. The biometric information identifier may be stored in database 602 with biometric identification information and user credentials. When a network packet is originated by the network user, the biometric identification information for the network user may be inserted into the network packet's payload. In addition, the biometric information identifier may be inserted in the network packet's header as an indicator that the biometric identification information is in the payload. The network packet may then be communicated onto network 100 via NIC 124.
Network 100 may include an infrastructure device 606 for receiving the network packet communicated onto network 100. Device 606 may include NIC 128 for receiving the network packet from network 100. Biometric information retrieve function 134 is operable to analyze the network packet and read the biometric information identifier from the header of the network packet. Based on the read identifier, function 134 will know that the payload of the network packet includes biometric identification information of the originator of the network packet. Function 134 may read the biometric identification information from the network packet's payload and pass the information to biometric information reader 136 or another suitable application for displaying the biometric identification information to the operator of device 606. Biometric information reader 136 may use GUI 138 for displaying the biometric identification information to the operator. Alternatively, any of the actions described above involving the biometric information may be performed.
Packet database 132 may store the biometric identification read from the packet and data from the network packet. For example, an entry in database 132 may include network packet data, such as source destination address, or protocol type, and the biometric identification information read from the packet. The operator of device 606 may then access the entry for associating the originator of the network packet with the network packet by using the biometric identification information.
As discussed above, in an alternate example of the subject matter described herein, biometric identification information may be inserted into a network packet header for associating an originator of a network packet with the network packet. For example, local device 600 may obtain biometric identification information from the network user when the network user uses GUI 106 to enter user credentials. When a network packet is originated by the network user, the biometric identification information for the network user may be inserted into the network packet's header or trailer. The network packet may then be communicated to network 100 and received by device 606. Function 134 may detect and read the biometric identification information from the network packet's header or trailer. The read information and other network packet data may be stored in database 132. The operator of device 606 may then access the entry for associating the originator of the network packet with the network packet by using the biometric identification information.
The following scenarios illustrate examples of associating an originator of a network packet with the network packet using biometric information according to embodiments of the subject matter described herein:
Scenario A: Biometric Data is Pre-stored in a Centralized Database
According to one enhancement, the subject matter described herein may be imbedded in an operating system of a device using the subject matter described herein.
In a further enhancement, the subject matter described herein may be part of a shared/network application. In this enhancement, each user logs into the shared application with a unique account and packets are tagged with biometric identification information.
In yet another enhancement, the subject matter described herein may be split for a multi-tiered architecture to accommodate legacy equipment and operating systems on devices such as firewalls, mobile telephones, etc.
In a further enhancement, the subject matter described herein may be a network device registration tool.
In another enhancement, the subject matter described herein may be part of a technique of controlling user access to network resources. For example, firewall rules may be based upon the user related biometric information rather than an IP address.
In a further enhancement, the subject matter described herein may be linked to a central database of users such as with lightweight directory access protocol (LDAP).
In yet another enhancement, the subject matter described herein may be used for usage billing.
In a further enhancement, the subject matter described herein may be used to capture other different combinations of biometric identification data, such as a digital photograph and a fingerprint scan.
In another enhancement, the subject matter described herein may relay on biometric reader systems to ensure that acceptable information is collected. This enhancement may ensure that a network user is not providing false or incomplete biometric identification information.
In a further enhancement, the biometric identification information according to the subject matter described herein may be represented by a hash or digital signature.
Network packets according to the subject matter described herein may be sent by using any suitable network protocol. Exemplary network protocols for use with the subject matter described herein include Ethernet, ATM, IP version 4 (IPv4), IP version 6 (IPv6), TCP, UDP, MPLS, etc.
There are several advantages to network users and operators for using the subject matter described herein. For example, the subject matter described herein provides an easy method that a network user or operator may identify the source of network traffic by displaying biometric identification of the network user originating the network traffic. In another example, the subject matter described herein provides network users and operators the ability to associate network traffic with an originator of the network traffic by using biometric identification information of the originator regardless of the network device being used. Further, in another example, the subject matter described herein provides the ability for a network user or operator to detect the actual person generating network traffic even if persons use the same network account login. In yet another example, the subject matter described herein provides a way to identify network users who are abusing network privileges. In another example, the subject matter described herein may detect when no biometric identification information is associated with network traffic for providing an instant indication of unauthorized network traffic. In yet another example, the subject matter described herein enables a more efficient way to locate rogue device owners. In another example, the subject matter described herein provides the capability to distinguish system device traffic from that of network users. In yet another example, the subject matter described herein provides a way to distinguish the traffic of individual users located behind a network address translation (NAT) device.
It will be understood that various details of the subject matter described herein may be changed without departing from the scope of the subject matter described herein. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation.
