Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
2000-03-15
2002-01-15
Iqbal, Nadeem (Department: 2184)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C380S001000
Reexamination Certificate
active
06339830
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates to regulating connectivity to and communicability within communication networks. More specifically, the present invention relates to authenticating and establishing personalized network communicability for local users of institutional communication networks.
BACKGROUND OF THE INVENTION
Institutions are relying increasingly on their data communication network infrastructures for efficient communication and data transfer. With this increasing reliance on network computing has arisen a significant need for mechanisms to regulate connectivity to and communicability within such networks. This need has been partially filled by internet protocol (IP) firewalls. IP firewalls typically restrict access to fixed sets of network resources by applying a set of protocol level filters on a packet-by-packet basis or by requiring prospective users to become authenticated before gaining access to the resources. Authentication has generally required users to supply certain signature information, such as a password. While this requirement of signature information has reduced the risk of unauthorized access to firewall-protected resources, firewalls have proven an imperfect and inflexible regulatory solution. Because firewalls are protocol-specific, firewalls have not provided a means for regulating network connectivity in a multi-protocol environment. Moreover, because firewalls regulate access to particular network resources, they have failed to provide a means for regulating access to sets of network resources which can vary as a function of user identity.
Protocol-independent mechanisms have also been deployed for authenticating users of the resources of institutional networks. However, such authentication mechanisms are only known to have been deployed to challenge remote users attempting to log-in over dial-up phone lines. Such mechanisms are not known to regulate the network access of local users logging-in over a LAN interfaces, such as Ethernet or Token Ring interfaces. Moreover, such mechanisms have, like firewalls, provided an inflexible solution which is unable to regulate access to customized or personalized sets of resources within the network based on user identity.
The flexibility limitations of the foregoing log-in challenge mechanisms have been partially overcome by independently implementing virtual local area networks (VLANs) within institutional networks. VLANs are sub-networks which typically include a plurality of network devices, such as servers, workstations and PCs, that together form a logical work group within a larger network. Because VLAN membership is assigned based on policies rather than physical location in the network, network bandwidth has been conserved and network security enhanced by assigning VLAN membership based on considerations of efficiency and need and restricting the flow of network traffic across VLAN boundaries.
While significant security and efficiency gains have been realized by policy-based VLANs, the solution they have offered is far from complete. VLAN membership has generally been assigned to end systems without reference to the identity of the users of such systems. In the current technology, for instance, VLAN membership is typically assigned by comparing network traffic with a configured set of rules which classify the traffic, and by inference the system which originated the traffic, into one or more VLANs. The identity of the user who sent the traffic is not considered in the assignment process. The failure to consider user identity leaves some network security issues unaddressed. Particularly, a person not authorized to use the resources of a VLAN may be able to gain access to its resources by transmitting data packets which the configured rules will classify into the VLAN, either by communicating over a member end system or by spoofing the required identifiers. Known VLAN assignment methods have also failed to contemplate providing conditional access to users based on the day of the week, the time of day, the length of access or a combination of such factors. Furthermore, current networking equipment and policy-based VLANs in particular have not offered collateral functionality, such as the ability to dynamically track where local users are connected to the network. Such a tracking mechanism would greatly simplify tasks such as network troubleshooting by allowing the network location of a user requesting technical support to be easily determined.
Accordingly, there is a need for comprehensive services for regulating communicability in institutional networks which are not subject to the inflexibility of conventional user log-in mechanisms or the lack of consideration for user identity of conventional VLAN assignment techniques. There is also a need for services which authenticate local users of institutional networks before establishing network communicability. There is a further need for user authentication services which provide collateral functionality, such as the ability to dynamically track the whereabouts of network users.
SUMMARY OF THE INVENTION
In accordance with its basic feature, the present invention combines the user-specific advantages of log-in challenges and the flexibility of VLANs into a deterministic user-based authentication and tracking service for local users of institutional communication networks.
It is therefore one object of the present invention to provide a service which authenticates local users before establishing network communicability.
It is another object of the present invention to provide a service which assigns and regulates user access to personalized sets of network resources.
It is another object of the present invention to provide a service which grants user access to personalized sets of network resources upon verifying signature information.
It is another object of the present invention to provide a service which conditions user access to personalized sets of network resources on one or more time-dependent variables.
It is another object of the present invention to provide a service which tracks user identity and network location.
These and other objects of the present invention are accomplished by a service which requires that local users be authenticated before gaining access to personalized sets of network resources. User identification information, time restrictions and authorized lists of resources for particular users are entered and stored in the network. Prior to authentication, packets from an end system being used by a prospective user of network resources are transmitted to an authentication agent operative on an intelligent edge device associated with the system. The agent relays log-in responses received from the system to a basic authentication server in the network for verification of the user. Verification is made by comparing log-in responses with the user identification information stored in the network and determining whether time restrictions associated with the user identification information are applicable. If the basic authentication server is able to verify from the log-in response that the user is an authorized user of network resources, and that the user is authorized to use the network resources at the time of the log-in attempt, the basic authentication server transmits to the agent the list of network resources for which the user is authorized, along with any time restrictions. The agent forwards the list of authorized network resources and time restrictions for storage and use on the edge device. The edge device uses the authorized list of resources and time restrictions to establish network communicability rules for the user. Preferably, the authorized list of network resources is a list of one or more VLANs.
If the basic authentication server is unable to verify from the log-in response that the user is an authorized user of network resources and authorized to use network resources at the time of the log-in attempt, the basic authentication server communicates that information to the agent. Packets from the us
Bailey John W.
Panza Charles L.
Pikover Yuri
See Michael E.
Stone Geoffrey C.
Alcatel Internetworking, Inc.
Iqbal Nadeem
Reader, Esq. Scot A.
LandOfFree
Deterministic user authentication service for communication... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Deterministic user authentication service for communication..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Deterministic user authentication service for communication... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2857133