Claims
- 1. A system of providing network access comprising:
a processor; a first network interface coupled to the processor; a second network interface coupled to the processor; a storage media accessible by the processor; a set of computer instructions stored on the storage media, executable by the processor to:
receive a network communication over the first network interface from a user device associated with a user; determine if the network communication is associated with an authenticated user; if the network communication is not associated with an authenticated user, direct the user to an authentication interface; receive credentials from the user; authenticate the user based on the credentials, receive a user profile if the user is authenticated.
- 2. The system of claim 1, wherein the computer instructions are further operable to monitor a network connected to the first network interface for the network communication.
- 3. The system of claim 2, wherein the computer instructions are further operable to monitor the network across multiple protocols.
- 4. The system of claim 1, wherein the network communication comprises an HTTP request and wherein the computer instructions are further executable to:
receive the HTTP request; send a redirect request to the user device to redirect a web browser to the authentication interface.
- 5. The system of claim 1, wherein the network communication comprises an email and wherein the computer instructions are further executable to:
receive the email; determine a protocol for the email; send a reply email message to the user device directing the user to the authentication interface.
- 6. The system of claim 1, wherein the computer instructions are further executable to:
determine a network protocol for the network communication; send a reply to the user device according to the network protocol directing the user to the authentication interface.
- 7. The system of claim 6, wherein the network protocol is one of HTTP, SMTP, POP, telnet, UDP or FTP.
- 8. The system of claim 1, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by comparing an identifier associated with the network communication to identifiers associated with authenticated users.
- 9. The system of claim 8, wherein the identifier comprises an IP address for the user device.
- 10. The system of claim 8, wherein the identifier comprises a MAC address for the user device.
- 11. The system of claim 1, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by contacting a federated device.
- 12. The system of claim 1, wherein the computer instructions are further executable to receive the user profile from an internal source.
- 13. The system of claim 1, wherein the computer instructions are further executable to:
transmit the credentials to an authentication system; and receive the user profile from the authentication system if the user is authenticated.
- 14. The system of claim 1, wherein the computer instructions are further executable to:
provision the user with access to a network connected to the second network interface based on the user profile.
- 15. The system of claim 14, wherein the computer instructions are further executable to provision the user with access to the network by provisioning user specific bandwidth based on the user profile.
- 16. The system of claim 15, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.
- 17. The system of claim 16, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.
- 18. The system of claim 17, wherein the computer instructions are executable to:
receive a packet; determine that the traffic control rule applies to the packet based on an identifier extracted from the packet; apply the traffic control rule to the packet.
- 19. The system of claim 18, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.
- 20. The system of claim 14 wherein the computer instructions are further executable to provision the user with access to the network by establishing user specific firewall rules and enforcing the user specific firewall rules.
- 21. The system of claim 1, wherein the computer instructions are executable to monitor a control session for the user to determine if the user times out.
- 22. The system of claim 21, wherein the computer instructions are further executable to close the control session if the user times out.
- 23. A system of providing network access comprising:
a processor; a first network interface coupled to the processor; a second network interface coupled to the processor; a storage media accessible by the processor; a set of computer instructions stored on the storage media, executable by the processor to:
receive a user profile; and provision a user on a first network connected to the first network interface with access to a second network connected to the second network interface based on the user profile.
- 24. The system of claim 23, wherein the computer instructions are further executable to provision the user with access to the second network by provisioning user specific bandwidth to the user based on the user profile.
- 25. The system of claim 24, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.
- 26. The system of claim 25, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.
- 27. The system of claim 26, wherein the computer instructions are executable to:
receive a packet; determine that the traffic control rule applies to the packet based on an identifier extracted from the packet; apply the traffic control rule to the packet.
- 28. The system of claim 27, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.
- 29. The system of claim 23 wherein the computer instructions are further executable to provision the user with access to the second network by establishing user specific firewall rules and enforcing the user specific firewall rules.
- 30. The system of claim 23, wherein the user profile comprises one or more attributes that govern the provisioning of user's access to the second network.
- 31. The system of claim 23, wherein the computer instructions are further executable to authenticate the user.
- 32. A system of providing network access comprising
a set of computer instructions stored on a storage media, executable by a processor to:
receive a network communication over a first network interface from a user device associated with a user; determine if the network communication is associated with an authenticated user; if the network communication is not associated with an authenticated user, direct the user to an authentication interface; receive credentials from the user; authenticate the user based on the credentials, receive a user profile if the user is authenticated.
- 33. The system of claim 32, wherein the computer instructions are further operable to monitor a network for the network communication.
- 34. The system of claim 33, wherein the computer instructions are further operable to monitor the network across multiple protocols.
- 35. The system of claim 32, wherein the network communication comprises an HTTP request and wherein the computer instructions are further executable to:
receive the HTTP request; send a redirect request to the user device to redirect a web browser to the authentication interface.
- 36. The system of claim 32, wherein the network communication comprises an email and wherein the computer instructions are further executable to:
receive the email; determine a protocol for the email; send a reply email message to the user device directing the user to the authentication interface.
- 37. The system of claim 32, wherein the computer instructions are further executable to:
determine a network protocol for the network communication; send a reply to the user device according to the network protocol directing the user to the authentication interface.
- 38. The system of claim 37, wherein the network protocol is one of HTTP, SMTP, POP, telnet, UDP or FTP.
- 39. The system of claim 32, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by comparing an identifier associated with the network communication to identifiers associated with authenticated users.
- 40. The system of claim 39, wherein the identifier comprises an IP address for the user device.
- 41. The system of claim 39, wherein the identifier comprises a MAC address for the user device.
- 42. The system of claim 32, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by contacting a federated device.
- 43. The system of claim 32, wherein the computer instructions are further executable to receive the user profile from an internal source.
- 44. The system of claim 32, wherein the computer instructions are further executable to:
transmit the credentials to an authentication system; and receive the user profile from the authentication system if the user is authenticated.
- 45. The system of claim 32, wherein the computer instructions are further executable to:
provision the user with access to a network based on the user profile.
- 46. The system of claim 45, wherein the computer instructions are further executable to provision the user with access to the network by provisioning user specific bandwidth based on the user profile.
- 47. The system of claim 46, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.
- 48. The system of claim 47, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.
- 49. The system of claim 48, wherein the computer instructions are executable to:
receive a packet; determine that the traffic control rule applies to the packet based on an identifier extracted from the packet; apply the traffic control rule to the packet.
- 50. The system of claim 49, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.
- 51. The system of claim 45 wherein the computer instructions are further executable to provision the user with access to the network by establishing user specific firewall rules and enforcing the user specific firewall rules.
- 52. The system of claim 32, wherein the computer instructions are executable to monitor a control session for the user to determine if the user times out.
- 53. The system of claim 52, wherein the computer instructions are further executable to close the control session if the user times out.
- 54. A system of providing network access comprising:
a set of computer instructions stored on the storage media, executable by the processor to:
receive a user profile; provision a user with access to a network based on the user profile.
- 55. The system of claim 54, wherein the computer instructions are further executable to provision the user with access to the network by provisioning user specific bandwidth based on the user profile.
- 56. The system of claim 55, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.
- 57. The system of claim 56, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.
- 58. The system of claim 57, wherein the computer instructions are executable to:
receive a packet; determine that the traffic control rule applies to the packet based on an identifier extracted from the packet; apply the traffic control rule to the packet.
- 59. The system of claim 58, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.
- 60. The system of claim 54 wherein the computer instructions are further executable to provision the user with access to the network by establishing user specific firewall rules and enforcing the user specific firewall rules.
- 61. The system of claim 54, wherein the user profile comprises one or more attributes that govern the provisioning of user's access to the network.
- 62. The system of claim 54, wherein the computer instructions are further executable to authenticate the user.
- 63. A method of providing network access comprising
receiving a network communication over a first network interface from a user using a user device; determining if the network communication is associated with an authenticated user; if the network communication is not associated with an authenticated user, directing the user to an authentication interface; receiving credentials from the user; authenticating the user based on the credentials, receiving a user profile if the user is authenticated.
- 64. The method of claim 63, further comprising:
determining a network protocol for the network communication; sending a reply to the user device according to the network protocol directing the user to the authentication interface.
- 65. The method of claim 64, wherein the network protocol is one of HTTP, SMTP, POP, telnet, UDP or FTP.
- 66. The method of claim 63, further comprising determining if a network communication is associated with an authenticated user by comparing an identifier associated with the network communication to identifiers associated with authenticated users.
- 67. The method of claim 63, further comprising determining if a network communication is associated with an authenticated user by contacting a federated control device.
- 68. The method of claim 63, further comprising:
transmitting the credentials to an authentication system; receiving the user profile from the authentication system.
- 69. A method of providing network access comprising:
receiving a user profile; provisioning a user with access to a network based on the user profile.
- 70. The method of claim 69, further comprising establishing a traffic control rule based on the user profile.
- 71. The method of claim 70, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.
- 72. The method of claim 70, further comprising:
receiving a packet; determining that the traffic control rule applies to the packet based on an identifier extracted from the packet; applying the traffic control rule to the packet.
- 73. The method of claim 72, further comprising dropping the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.
- 74. The method of claim 69, further comprising establishing user specific firewall rules based on the user profile and enforcing the user specific firewall rules.
- 75. The method of claim 69, wherein the user profile comprises one or more attributes that govern the provisioning of user's access to the network.
RELATED APPLICATIONS
[0001] This application claims priority under 35 U.S.C. 119(e) to U.S. Provisional Patent Application No. 60/417,674, entitled “Access Controlled Network Sharing,” to Richard MacKinnon and Kelly Looney, filed Oct. 10, 2002, which is hereby fully incorporated by reference herein.
Provisional Applications (1)
|
Number |
Date |
Country |
|
60417674 |
Oct 2002 |
US |