System and method to associate a private user identity with a public user identity

A system, comprising:

• a host;
• a network comprising a gateway;
• an application, wherein an access session for a user is established between the application and the network via the gateway, wherein the gateway creates an application session record for the application session, wherein the application session record comprises a user identity for the user used for accessing the network through the host, a host identity for the host, and an application session time;
• and
• an identity server, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time,
• wherein the gateway queries the identity server by sending the host identity and the application session time in the application session record,
• wherein the identity server compares the host identity in the application session record with the second host identity in the access session record, and compares the access session time with the application session time,
• wherein the identity server returns the second user identity in the access session record to the gateway, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time,
• wherein the gateway stores the second user identity as the user identity used for accessing the network in the application session record.

A computer program product comprising a non-transitory computer readable storage medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

• recognize an application session between a network and an application via a security gateway;
• and
• create an application session record for the application session, wherein the application session record comprises the user identity used for accessing the network through a host, a host identity for the host, and an application session time, wherein the create comprises:
• query an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time;
• compare by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time;
• return by the identity server the second user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time;
• and
• store the second user identity as the user identity used for accessing the network in the application session record.

A computer program product comprising a non-transitory computer readable storage medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

• recognize an application session between a network and a public application via a gateway, wherein the public application resides externally to the network;
• and
• create an application session record for the application session, wherein the application session record comprises the public user identity used to access the public application, the private user identity used for accessing the network through a host, a host identity for the host, and an application session time, wherein the create comprises:
• query an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second private user identity, a second host identity for the second host, and an access session time;
• compare by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time;
• return by the identity server the second private user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time;
• and
• store the second private user identity as the private user identity in the application session record.