Back to results
US 9,178,885 B1Granted
Using events to identify a user and enforce policies
AssigneePalo Alto Networks, Inc.
InventorsMichael Jacobsen, Song Wang, Wilson Xu
Life of this patent
Estimating the term…
Abstract
Enforcing a policy is described. A mapping between an IP address of a device and a user identity is identified, at least in part by correlating event information. A policy is applied to the device based at least in part on the user identity. One example of an event is an access to a mail server, such as an access to a Microsoft Exchange server.
Claims20
A system, comprising:
- a processor configured to:
- receive log data generated in response to a first user-provided device authenticating to an electronic mail server on a first network, wherein the generated log data includes at least a username portion of an email address of the user, wherein the first user-provided device is not authenticating to a directory service provider accessible via the first network, and wherein the first user-provided device has not authenticated to the directory service provider;
- receive, from the first user-provided device, a request for a first resource that is external to the first network, wherein the first user-provided device has an IP address;
- determine an identity of the user of the first user-provided device based at least in part on correlating at least a portion of the received log data, including the username portion of the email address, and identity information associated with the user and stored in the directory service provider;
- determine a mapping between the IP address of the first device and the identity of the first user-provided device;
- and
- apply a policy with respect to the request for the first resource based at least in part on the identity of the user of the first user-provided device;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A method, comprising:
- receiving log data generated in response to a first user-provided device authenticating to an electronic mail server on a first network, wherein the generated log data includes at least a username portion of an email address of the user, wherein the first user-provided device is not authenticating to a directory service provider accessible via the first network, and wherein the first user-provided device has not authenticated to the directory service provider;
- receiving, from the first user-provided device, a request for a first resource that is external to the first network, wherein the first user-provided device has an IP address;
- determining an identity of the user of the first user-provided device based at least in part on correlating at least a portion of the received log data, including the username portion of the email address, and identity information associated with the user and stored in the directory service provider;
- determining a mapping between the IP address of the first device and the identity of the first user-provided device;
- and
- applying a policy with respect to the request for the first resource based at least in part on the identity of the user of the first user-provided device.
3 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving log data generated in response to a first user-provided device authenticating to an electronic mail server on a first network, wherein the generated log data includes at least a username portion of an email address of the user, wherein the first user-provided device is not authenticating to a directory service provider accessible via the first network, and wherein the first user-provided device has not authenticated to the directory service provider;
- receiving, from the first user-provided device, a request for a first resource that is external to the first network, wherein the first user-provided device has an IP address;
- determining an identity of the user of the first user-provided device based at least in part on correlating at least a portion of the received log data, including the username portion of the email address, and identity information associated with the user and stored in the directory service provider;
- determining a mapping between the IP address of the first device and the identity of the first user-provided device;
- and
- applying a policy with respect to the request for the first resource based at least in part on the identity of the user of the first user-provided device.
3 more elements
Dependencies are inferred from the claim text.