Automatic discovery of users associated with screen names

1. A computer-implemented method comprising:

intercepting a first message from a client device associated with an actual user, the first message being generated according to an instant messaging protocol, said first message being associated with a first screen name usable in conjunction with said instant messaging rogue protocol;

determining a name of the actual user, said determining comprising:

obtaining from the first message a network address of the client device;

using the network address to access user identification information stored in a registry of the client device; and

using the user identification information to request a name of the actual user from a domain controller;

storing data representing an association between the actual user name and the first screen name in computer storage;

intercepting a second message associated with the instant messaging protocol, the second message being associated with a second screen name of the actual user;

storing a second association between the actual user name and the second screen name in the computer storage; and

enforcing a policy rule based on said first and second associations, said enforcing the policy rule comprising restricting the actual user from sending or receiving a predetermined number of messages associated with the instant messaging protocol.

2. The method of claim 1 , wherein said intercepting the second message comprises intercepting the second message from a second client device associated with the actual user.

3. The computer-implemented method of claim 1 , wherein said intercepting the first and second messages is performed with a gateway module executing on a computing device.

4. The computer-implemented method of claim 1 , wherein the user identification information comprises a globally unique identifier (GUID).

5. The computer-implemented method of claim 1 , wherein said restricting comprises limiting the number of instant messages associated with any screen name of the actual user to a specified rate.

6. The computer-implemented method of claim 3 , wherein the gateway module and the client device are associated with a same enterprise network.

7. The computer-implemented method of claim 6 , wherein said accessing the registry of the client device is performed by an authorization server coupled to the enterprise network and in communication with the gateway module.

8. A system for enforcing policy rules against actual users of a computer network, the system comprising:

a gateway operative to receive first and second messages from at least one client device associated with an actual user, the first and second messages being generated according to an instant messaging protocol, said first message being associated with a first screen name and said second message being associated with a second screen name usable in conjunction with said instant messaging protocol;

an authorization server operative to determine a name of the actual user in response to receiving an identification request from the gateway, wherein the authorization server is operative to:

use a network address of the at least one client device to access user identification information stored on the at least one client device; and

use the user identification information to request an identity of the actual user; and

the gateway being further operative to:

store data representing an association between the actual user identity and the first and second screen names in computer storage, and

enforce a policy rule by restricting the actual user from sending or receiving a total number of instant messages associated with the instant messaging protocol within a given time period.

9. The system of claim 8 , wherein the gateway executes on a computing device in communication with the authorization server over a local area network (LAN).

10. The system of claim 8 , wherein the user identification information comprises a globally unique identifier (GUID).

11. The system of claim 8 , further comprising a firewall device configured to redirect at least one of the first and second messages from the at least one client device to the gateway.

12. The system of claim 8 , wherein the at least one client device comprises first and second client devices, wherein the first message is received from the first client device and the second message is received from the second client device.

13. The system of claim 11 , wherein the firewall device further comprises one or more recognition patterns for identifying the instant message protocol of the at least one of the first and second messages from a plurality of messages received from an enterprise network.

14. A system for enforcing policy rules against actual users, the system comprising:

means for intercepting first and second messages from a client device associated with an actual user, the first and second messages being generated according to an instant messaging protocol, said first and second messages being associated with, respectively, first and second screen names usable in conjunction with said instant messaging protocol, wherein said intercepting means is executed on a computing device;

means for determining a name of the actual user for each of the first and second messages, said means for determining comprising:

means for obtaining from the message a network address of the client device;

means for using the network address to access user identification information from a registry of the client device; and

means for using the user identification information to request a name of the actual user from a domain controller;

means for storing data representing an association between the actual user name and the first and second screen names in computer storage; and

means for enforcing a policy rule in response to intercepting the first and second messages by restricting the actual user from sending or receiving an additional number of messages associated with the instant messaging protocol.