公开(公告)号：US07552126B2

公开(公告)日：2009-06-23

申请号：US11446028

申请日：2006-06-02

申请人： Lee Chen ,  John Chiong ,  Phillip Kwan

发明人： Lee Chen ,  John Chiong ,  Phillip Kwan

IPC分类号： G06F17/30

CPC分类号： H04L63/10 ,  H04L63/1425

摘要： Systems and methods of managing access records of user access to a secure data network include an access record gateway and an access record datastore; the access record gateway being in communication with an access server of the secure data network; and the access record datastore being in communication with the access record gateway. The access record gateway acquires user access information, such as time information; records the user access information in at least one access record; and stores the at least one access record in the access record datastore. The access record gateway also acquires user access activity information, such as user access termination information, and updates previously recorded user access information with the user access activity information. The at least one access record includes a plurality of sub-records, selected from a list including a user information sub-record, a network information sub-record, and a time information sub-record. The system may include a security application in communication with the access record gateway to query for an access record satisfying the security query parameter(s).

摘要翻译： 管理对安全数据网络的用户访问的访问记录的系统和方法包括访问记录网关和访问记录数据存储; 所述接入记录网关与所述安全数据网络的接入服务器通信; 并且访问记录数据存储与访问记录网关通信。 接入记录网关获取用户接入信息，如时间信息; 将用户访问信息记录在至少一个访问记录中; 并将至少一个访问记录存储在访问记录数据存储中。 访问记录网关还获取诸如用户访问终止信息的用户访问活动信息，并且用用户访问活动信息更新先前记录的用户访问信息。 所述至少一个访问记录包括从包括用户信息子记录，网络信息子记录和时间信息子记录的列表中选择的多个子记录。 系统可以包括与访问记录网关通信的安全应用，以查询满足安全查询参数的访问记录。

公开(公告)号：US20070282855A1

公开(公告)日：2007-12-06

申请号：US11446028

申请日：2006-06-02

申请人： Lee Chen ,  John Chiong ,  Phillip Kwan

发明人： Lee Chen ,  John Chiong ,  Phillip Kwan

IPC分类号： G06F17/30

CPC分类号： H04L63/10 ,  H04L63/1425

摘要： Systems and methods of managing access records of user access to a secure data network include an access record gateway and an access record datastore; the access record gateway being in communication with an access server of the secure data network; and the access record datastore being in communication with the access record gateway. The access record gateway acquires user access information, such as time information; records the user access information in at least one access record; and stores the at least one access record in the access record datastore. The access record gateway also acquires user access activity information, such as user access termination information, and updates previously recorded user access information with the user access activity information. The at least one access record includes a plurality of sub-records, selected from a list including a user information sub-record, a network information sub-record, and a time information sub-record. The system may include a security application in communication with the access record gateway to query for an access record satisfying the security query parameter(s).

摘要翻译： 管理对安全数据网络的用户访问的访问记录的系统和方法包括访问记录网关和访问记录数据存储; 所述接入记录网关与所述安全数据网络的接入服务器通信; 并且访问记录数据存储与访问记录网关通信。 接入记录网关获取用户接入信息，如时间信息; 将用户访问信息记录在至少一个访问记录中; 并将至少一个访问记录存储在访问记录数据存储中。 访问记录网关还获取诸如用户访问终止信息的用户访问活动信息，并且用用户访问活动信息更新先前记录的用户访问信息。 所述至少一个访问记录包括从包括用户信息子记录，网络信息子记录和时间信息子记录的列表中选择的多个子记录。 系统可以包括与访问记录网关通信的安全应用，以查询满足安全查询参数的访问记录。

公开(公告)号：US20100217819A1

公开(公告)日：2010-08-26

申请号：US12771491

申请日：2010-04-30

申请人： Lee Chen ,  John Chiong ,  Xin Wang

发明人： Lee Chen ,  John Chiong ,  Xin Wang

IPC分类号： G06F15/16

CPC分类号： H04L63/102 ,  H04L12/66 ,  H04L29/06 ,  H04L61/6022 ,  H04L61/6068 ,  H04L63/02 ,  H04L63/0281 ,  H04L63/04 ,  H04L63/08 ,  H04L63/0853 ,  H04L63/10 ,  H04L63/30 ,  H04L63/308 ,  H04L65/1003 ,  H04L65/1006 ,  H04L65/1069 ,  H04L65/4007 ,  H04L67/14 ,  H04L67/141 ,  H04L67/146

摘要： The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user's public user identity used to access the public application, the user's private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record. If they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

摘要翻译： 本发明的系统包括主机，包括安全网关的网络和公共应用。 建立在网络和主机之间的访问会话以及公共应用程序和网络之间的应用程序会话。 为应用会话创建应用会话记录，并且包括用于访问公共应用的用户的公共用户标识，用于访问网络的用户的私有用户标识，主机标识和应用会话时间。 为了确定应用程序会话的私有用户身份，安全网关发送具有主机标识和应用程序会话时间的查询。 这些与访问会话记录中的主机身份和访问会话时间进行比较。 如果匹配，则返回访问会话记录中的私有用户身份，并将其作为私有用户身份存储在应用程序会话记录中。

公开(公告)号：US07716378B2

公开(公告)日：2010-05-11

申请号：US11582613

申请日：2006-10-17

申请人： Lee Chen ,  John Chiong ,  Xin Wang

发明人： Lee Chen ,  John Chiong ,  Xin Wang

IPC分类号： G06F15/16 ,  G06F15/173 ,  H04W4/00

CPC分类号： H04L63/102 ,  H04L12/66 ,  H04L29/06 ,  H04L61/6022 ,  H04L61/6068 ,  H04L63/02 ,  H04L63/0281 ,  H04L63/04 ,  H04L63/08 ,  H04L63/0853 ,  H04L63/10 ,  H04L63/30 ,  H04L63/308 ,  H04L65/1003 ,  H04L65/1006 ,  H04L65/1069 ,  H04L65/4007 ,  H04L67/14 ,  H04L67/141 ,  H04L67/146

摘要： The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user's public user identity used to access the public application, the user's private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record. If they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

摘要翻译： 本发明的系统包括主机，包括安全网关的网络和公共应用。 建立在网络和主机之间的访问会话以及公共应用程序和网络之间的应用程序会话。 为应用会话创建应用会话记录，并且包括用于访问公共应用的用户的公共用户标识，用于访问网络的用户的私有用户标识，主机标识和应用会话时间。 为了确定应用程序会话的私有用户身份，安全网关发送具有主机标识和应用程序会话时间的查询。 这些与访问会话记录中的主机身份和访问会话时间进行比较。 如果匹配，则返回访问会话记录中的私有用户身份，并将其作为私有用户身份存储在应用程序会话记录中。

公开(公告)号：US20070271598A1

公开(公告)日：2007-11-22

申请号：US11435043

申请日：2006-05-16

申请人： Lee Chen ,  John Chiong ,  Yang Yu

发明人： Lee Chen ,  John Chiong ,  Yang Yu

IPC分类号： H04L9/32 ,  G06F15/16 ,  G06F12/14 ,  H04L9/00 ,  H04K1/00 ,  G06K9/00 ,  G06F17/00 ,  G06F17/30 ,  G06F9/00 ,  G06F12/00 ,  G06F13/00 ,  G06F7/04 ,  G06F7/58 ,  G06K19/00 ,  G11C7/00

CPC分类号： H04L63/08 ,  G11C7/24 ,  H04L63/107 ,  H04W12/06 ,  H04W12/08

摘要： Systems and methods of authenticating user access based on an access point to a secure data network include a secure data network having a plurality of a network access points serving as entry points for a user to access the secure data network using a user device. The user is associated with a user identity, each network access point with a network access point identity. The user uses a user device to send an access request, requesting access to the secure data network, to the network access point, which then sends an authentication request to an identity server. The identity server processes the authentication request, by validating the combination of the user identity and the network access point identity, and responds with an authentication response, granting or denying access, as communicated to the user device via an access response. The secure data network may comprise an application level secure data network, in which the user uses the user device to request access to a network application. Furthermore, the identity server may validate the combined user identity and network access point identity data in conjunction with time information, access allowance data, and/or traffic volume data.

摘要翻译： 基于对安全数据网络的接入点认证用户接入的系统和方法包括具有多个网络接入点的安全数据网络，该网络接入点用作用户使用用户设备访问安全数据网络的入口点。 用户与用户身份相关联，每个网络接入点具有网络接入点身份。 用户使用用户设备向网络接入点发送访问安全数据网络的访问请求，网络接入点然后向认证服务器发送认证请求。 身份服务器通过验证用户身份和网络接入点身份的组合来处理身份验证请求，并通过访问响应传达给用户设备的认证响应，授予或拒绝访问进行响应。 安全数据网络可以包括应用级安全数据网络，其中用户使用用户设备来请求对网络应用的访问。 此外，身份服务器可以结合时间信息，访问允许数据和/或业务量数据来验证组合的用户身份和网络接入点身份数据。

公开(公告)号：US20070180101A1

公开(公告)日：2007-08-02

申请号：US11328823

申请日：2006-01-10

申请人： Lee Chen ,  Rishi Sampat ,  John Chiong ,  Dennis Oshiba

发明人： Lee Chen ,  Rishi Sampat ,  John Chiong ,  Dennis Oshiba

IPC分类号： G06F17/00 ,  G06F15/173

CPC分类号： H04L67/22 ,  H04L63/0227

摘要： A system and method are disclosed that may include receiving a first event log for a data network user; identifying the user that is the subject of the first event log; updating a user activity record, within stored user activity records, with activity information included in the first event log, the activity information being represented in a first format in the first event log; and repeating the steps of receiving, identifying, and updating for at least one additional event log having activity information stored therein in at least one format other than the first format.

摘要翻译： 公开了一种可以包括接收数据网络用户的第一事件日志的系统和方法; 识别作为第一事件日志主题的用户; 在所存储的用户活动记录中，使用包括在所述第一事件日志中的活动信息来更新用户活动记录，所述活动信息以所述第一事件日志中的第一格式表示; 并且以除了第一格式之外的至少一种格式重复对存储有活动信息的至少一个附加事件日志进行接收，识别和更新的步骤。

公开(公告)号：US08826372B1

公开(公告)日：2014-09-02

申请号：US14061722

申请日：2013-10-23

申请人： Lee Chen ,  John Chiong ,  Dennis I. Oshiba

发明人： Lee Chen ,  John Chiong ,  Dennis I. Oshiba

IPC分类号： H04L29/06 ,  H04L29/08 ,  H04W12/00

CPC分类号： H04L63/20 ,  G06F21/00 ,  H04L45/308 ,  H04L51/04 ,  H04L61/20 ,  H04L61/2596 ,  H04L61/3065 ,  H04L63/02 ,  H04L63/0227 ,  H04L63/0236 ,  H04L63/029 ,  H04L63/0407 ,  H04L63/08 ,  H04L63/0892 ,  H04L65/1026 ,  H04L67/02 ,  H04L67/06 ,  H04L67/10 ,  H04L67/14 ,  H04L67/22 ,  H04L67/306 ,  H04L67/42 ,  H04L69/22 ,  H04M1/72547 ,  H04W12/00

摘要： A security gateway includes packet routing policies, each including a host network address, an application network address, and a forwarding interface. In routing data packets of an application session, the security gateway: recognizes the application session between a network and an application; determines a user identity from an application session record for the application session; determines packet routing policies applicable to the application session based on the user identity; receives a data packet for the application session, including a source network address and a destination network address; compares the source network address with the host network address, and the destination network address with the application network address; and in response to finding a match between the source network address and the host network address, and between the destination network address and the application network address, processes the data packet using the forwarding interface of the packet routing policy.

摘要翻译： 安全网关包括分组路由策略，每个路由策略包括主机网络地址，应用网络地址和转发接口。 在路由应用会话的数据包时，安全网关：识别网络和应用之间的应用会话; 从应用会话的应用会话记录中确定用户身份; 基于用户身份确定适用于应用会话的分组路由策略; 接收应用会话的数据包，包括源网络地址和目的网络地址; 将源网络地址与主机网络地址进行比较，将目的网络地址与应用网络地址进行比较; 并且响应于找到源网络地址和主机网络地址之间以及目的地网络地址和应用网络地址之间的匹配，使用分组路由策略的转发接口处理数据分组。

公开(公告)号：US08813180B1

公开(公告)日：2014-08-19

申请号：US14061720

申请日：2013-10-23

申请人： Lee Chen ,  John Chiong ,  Dennis I. Oshiba

发明人： Lee Chen ,  John Chiong ,  Dennis I. Oshiba

IPC分类号： H04L29/06 ,  H04L29/08 ,  H04W12/00

CPC分类号： H04L63/0263 ,  G06F21/00 ,  G06F21/44 ,  H04L12/66 ,  H04L51/04 ,  H04L63/02 ,  H04L63/0227 ,  H04L63/0236 ,  H04L63/0245 ,  H04L63/0254 ,  H04L63/029 ,  H04L63/0407 ,  H04L63/08 ,  H04L63/10 ,  H04L63/102 ,  H04L63/105 ,  H04L63/164 ,  H04L63/168 ,  H04L63/20 ,  H04L63/30 ,  H04L65/1026 ,  H04L67/10 ,  H04L67/1004 ,  H04L67/104 ,  H04L67/141 ,  H04L67/22 ,  H04L67/306 ,  H04L67/42 ,  H04L69/28 ,  H04L69/329 ,  H04M1/72547 ,  H04W12/00

摘要： Applying a security policy to an application session, includes: recognizing the application session between a network and an application via a security gateway; determining by the security gateway a user identity of the application session using information about the application session; obtaining by the security gateway the security policy comprising network parameters mapped to the user identity; and applying the security policy to the application session by the security gateway. The user identity may be a network user identity or an application user identity recognized from packets of the application session. The security policy may comprise a network traffic policy mapped and/or a document access policy mapped to the user identity, where the network traffic policy is applied to the application session. The security gateway may further generate a security report concerning the application of the security policy to the application session.

摘要翻译： 将安全策略应用于应用程序会话包括：通过安全网关识别网络和应用程序之间的应用程序会话; 使用关于应用会话的信息由安全网关确定应用会话的用户身份; 由安全网关获取包括映射到用户身份的网络参数的安全策略; 并将安全策略应用于安全网关的应用会话。 用户身份可以是从应用会话的分组识别的网络用户身份或应用用户身份。 安全策略可以包括被映射的网络流量策略和/或映射到用户身份的文档访问策略，其中将网络流量策略应用于应用会话。 安全网关还可以生成关于安全策略应用于应用会话的安全报告。

公开(公告)号：US20110093522A1

公开(公告)日：2011-04-21

申请号：US12603471

申请日：2009-10-21

申请人： Lee Chen ,  John Chiong

发明人： Lee Chen ,  John Chiong

IPC分类号： G06F15/16

CPC分类号： H04L41/12 ,  H04L29/12066 ,  H04L61/1511 ,  H04L67/1002 ,  H04L67/1021 ,  H04L67/1036

摘要： A method and system to determine a web server based on geo-location information is disclosed. The system includes: a local DNS server coupled to a web client; a plurality of web servers; and a global load balancer coupled to the local DNS server. The global load balancer: receives a request for a web service sent by the web client, the request comprising local DNS server information; determines a geographic location for the local DNS server based on the local DNS server information; determines a web server from the plurality of web servers based on the requested web service; determines a geographic location for the determined web server; determines that the geographic location for the local DNS server matches the geographic location for the determined web server; selects the determined web server; and sends a response comprising information on the selected web server to the local DNS server.

摘要翻译： 公开了一种基于地理位置信息确定Web服务器的方法和系统。 该系统包括：耦合到web客户端的本地DNS服务器; 多个web服务器; 以及耦合到本地DNS服务器的全局负载平衡器。 全局负载平衡器：接收由Web客户端发送的Web服务的请求，该请求包括本地DNS服务器信息; 基于本地DNS服务器信息确定本地DNS服务器的地理位置; 基于所请求的web服务从多个web服务器确定web服务器; 确定所确定的web服务器的地理位置; 确定本地DNS服务器的地理位置与确定的Web服务器的地理位置相匹配; 选择确定的Web服务器; 并将包含所选web服务器上的信息的响应发送到本地DNS服务器。

公开(公告)号：US20080148357A1

公开(公告)日：2008-06-19

申请号：US11582613

申请日：2006-10-17

申请人： Lee Chen ,  John Chiong ,  Xin Wang

发明人： Lee Chen ,  John Chiong ,  Xin Wang

IPC分类号： H04L9/32 ,  G06F21/00

CPC分类号： H04L63/102 ,  H04L12/66 ,  H04L29/06 ,  H04L61/6022 ,  H04L61/6068 ,  H04L63/02 ,  H04L63/0281 ,  H04L63/04 ,  H04L63/08 ,  H04L63/0853 ,  H04L63/10 ,  H04L63/30 ,  H04L63/308 ,  H04L65/1003 ,  H04L65/1006 ,  H04L65/1069 ,  H04L65/4007 ,  H04L67/14 ,  H04L67/141 ,  H04L67/146

摘要： The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user's public user identity used to access the public application, the user's private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record. If they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

摘要翻译： 本发明的系统包括主机，包括安全网关的网络和公共应用。 建立在网络和主机之间的访问会话以及公共应用程序和网络之间的应用程序会话。 为应用会话创建应用会话记录，并且包括用于访问公共应用的用户的公共用户标识，用于访问网络的用户的私有用户标识，主机标识和应用会话时间。 为了确定应用程序会话的私有用户身份，安全网关发送具有主机标识和应用程序会话时间的查询。 这些与访问会话记录中的主机身份和访问会话时间进行比较。 如果匹配，则返回访问会话记录中的私有用户身份，并将其作为私有用户身份存储在应用程序会话记录中。