Embodiments of the invention relate to network access. More particularly, embodiments of the invention relate to providing network access control with device aware and user specific provisioning.
The communication of data over networks has become an important, if not essential, way for many organizations and individuals to communicate. The Internet is a global network connecting millions of computers using a client-server architecture in which any computer connected to the Internet can potentially receive data from and send data to any other computer connected to the Internet. The Internet provides a variety of methods in which to communicate data, one of the most ubiquitous of which is the World Wide Web. Other methods for communicating data over the Internet include e-mail, usenet newsgroups, telnet and FTP.
Users typically access the Internet either through a computer connected to an Internet Service Provider (“ISP”) or computer connected to a local area network (“LAN”) provided by an organization, which is in turn, connected to the ISP. The ISP provides a point of presence to interface with the Internet backbone. Routers and switches in the backbone direct data traffic between the various ISPs.
To access a LAN and, in turn, the Internet, many prior art access control systems require a user to connect his or her computer to a wired network (e.g., through an Ethernet port) and enter a user name and password. If the user name and password match a user name and password in an authentication database, the user will be provided access to the network. These systems typically assume that a user is tied to a particular physical port, such as a port in the user's office. Based on this assumption, provisioning of bandwidth to the user occurs by physically provisioning the port to which the user is connected. If the user moves to a different port, the user will typically be provided with the bandwidth provisioned to the new port. Thus, provisioning of bandwidth is done on a per port rather than a per user basis.
General internet access provided via broadband technology (e.g., Digital Subscriber Line, DOCSIS or analog cable modem, or similar technologies) may be capable of provisioning bandwidth to a computer premise equipment (CPE) device. CPE provisioning can be dynamic and remotely administered. However, broadband technology adoption is not a single-user and, hence, is not user-specific provisioning.
An increasing number of organizations (e.g., businesses, governmental organizations) wish to provide access to LANs and the Internet to various classes of users (internal users, contractors, customers, visitors). For example, many cafés have public wireless networks to allow patrons to access the Internet, receive email and perform other network activities. While users may be asked to authenticate to use the network, bandwidth is provisioned to the wireless routers, not the individual users. This means that one user connected to a particular router can consume a majority of the bandwidth (e.g., downloading pictures from the Internet), slowing down the wireless network for other users connected to that router.
An additional problem with many current networks, particularly wireless networks, is roaming between subnets. A subnet is a portion of a LAN that has a common address component. One subnet, for example, can cover a particular floor of a building, while another subnet covers another floor. Each subnet can potentially have its own set of internet protocol (“IP”) addresses that may or may not overlap with the IP addresses of other subnets. When a user moves from one subnet to another, even if both subnets are part of the same LAN, the user must typically reauthenticate with the network. This can make physically roaming between subnets frustrating because open network sessions will often be dropped.
Embodiments of the invention provide a system and method of providing network access that eliminates, or at least substantially reduces, the shortcomings of prior art network access systems and methods. More particularly, one embodiment of the invention provides a system of providing network access comprising a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions stored on the storage media, executable by the processor. In one embodiment of the invention, the computer instructions can be executable to receive a network communication over the first network interface from a user using a user device and determine if the network communication is associated with an authenticated user. If the network communication is not associated with an authenticated user, the computer instructions can be executable to direct the user to an authentication interface. The computer instructions can be further executable to receive credentials from the user and authenticate the user based on the credentials. If the user is authenticated, the computer instructions can receive a user profile.
Another embodiment of the invention can include a system for providing access to a network that comprises a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions stored on the storage media. The computer instructions can be executable by the processor to receive a user profile and provision a user with access to a network based on the user profile.
Another embodiment of the invention includes a set of computer instructions stored on a storage media, executable by a processor to receive a network communication over a first network interface from a user using a user device, determine if the network communication is associated with an authenticated user, if the network communication is not associated with an authenticated user, direct the user to an authentication interface, receive credentials from the user, authenticate the user based on the credentials. If the user is authenticated, the computer instructions can be executed to receive a user profile.
Yet another embodiment of the invention includes a set of computer instructions stored on the storage media, executable by the processor to receive a user profile and provision a user with access to a network based on the user profile.
Another embodiment of the invention includes a method comprising receiving a user profile and provisioning a user with access to a network based on the user profile.
Another embodiment of the invention includes a method comprising receiving a network communication over a first network interface from a user using a user device, determining if the network communication is associated with an authenticated user, if the network communication is not associated with an authenticated user, directing the user to an authentication interface, receiving credentials from the user, authenticating the user based on the credentials, and receiving a user profile if the user is authenticated.
Embodiments of the invention provide an advantage over current systems and methods of providing access to a network by being able to authenticate a user sending network communications in any number of protocols.
Embodiments of the invention provide another advantage over current systems and methods of providing access to a network by not requiring propriety client software to authenticate.
Embodiments of the invention provide yet another advantage over current systems and methods of providing network access by provisioning network access on a per user rather than per port basis.
Embodiments of the invention provide yet another advantage over current systems and methods of providing network access by supporting the ability of a user to physically roam without requiring reauthentication on different subnets.
A more complete understanding of the invention and the advantages thereof may be acquired by referring to the following description, taken in conjunction with the accompanying drawings in which like reference numbers indicate like features and wherein:
Preferred embodiments of the invention are illustrated in the FIGURES, like numerals being used to refer to like and corresponding parts of the various drawings.
Embodiments of the invention provide a system and method of network access control. According to one embodiment of the invention, a control device can sit between a network (e.g., an Internet, a LAN or other network known in the art) and users. The users themselves may be located on a network or subnet or may connect directly to the control device. When a particular user attempts to access the network behind the control device (i.e., the controlled network), the control device can determine if the user has already been authenticated to use the controlled network. If the user has not been authenticated, the control device can direct the user to an authentication interface, such as a web page, and receive a set of credentials from the user. If the user is authorized to use the controlled network, based on the credentials, the control device can provision the user with access to the controlled network based on user specific settings.
According to one embodiment of the invention, user device 14 can comprise any computing device known in the art (e.g., desktop, laptop, PDA, mobile phone or any other device capable of network communication) and can be connected to control device 20 in any manner known in the art (e.g., by LAN, wireless network, direct connection or other manner known in the art). In the example of
User 12 can send the network communication using a network application running on user device 14 destined for a device on network 18. The network application can be any publicly available network application (e.g., a web browser, email program, etc.) or proprietary application. For example, user 12 can use an internet browser, such as Netscape Navigator or Microsoft Internet Explorer, to send a request for a web page available over Internet 18. As would be understood by those of ordinary skill in the art, the web page request is transmitted as an HTTP request in one or more internet protocol (“IP”) packets.
Control device 20 can monitor network 16 for network communications originating on network 16 (e.g., for example for IP packets originating on LAN 16) using any network monitoring technique known in the art. Control device 20 can read the IP packet headers to extract information on the originating user device. As an example, control device 20 can read the packet headers corresponding to the web page request to determine the IP address and MAC address associated with laptop 14.
Based on the MAC address, IP address or other information that can be extracted from the network communication, control device 20 can determine if user 12 has been authenticated. This can be done, for example, by comparing the MAC address and IP address of user device 14 to MAC addresses and IP addresses for users that have been authenticated. If the user has not authenticated, control device 20 can direct user 12 to an authentication interface by, for example, redirecting the HTTP request to a login web page that requests user credentials, such as user name and password.
Control device 20 can receive the user credentials and send the credentials to authentication system 22. Authentication system 22 can compare the credentials to credentials in authentication database 24 to determine if user 12 is permitted access to network 18 and the extent of the user's access. If the credentials are authenticated, authentication system 22 can pass a user profile associated with user 12 to control device 20.
The user profile can include parameters that determine the extent of a user's access to network 18 and/or services available to that user. For example, the user profile can indicate that a user is permitted certain upload and download data transfer rates, that the user is not permitted to visit particular web sites, or that the user qualifies for virus scanning. In one embodiment of the invention, the constraints indicated in the user profile can be implemented through one or more applications at control device 20.
When control device 20 receives a user profile from authentication system 22 (or self authenticates the user), control device 20 can establish a control session for the user, indicating that the user is currently active. Additionally, control device 20 can establish provisioning rules based on the user profile. The provisioning rules can include, for example, firewall rules and traffic constraints that govern the user's access to network 18. In one embodiment of the invention, the sessions and provisioning rules can be indexed to a particular user. This can be done, for example, by associating the control session and rules to a key based on the MAC address and/or IP address of laptop and/or user credentials. The use of user credentials as part of an indexing key allows multiple sessions by the same user using different devices (e.g., a user accessing network 18 through a laptop and PDA) to be tied together for, for example, billing purposes.
It should be noted that
The control device can determine, at step 34, if a user associated with the network communication has been authenticated. In one embodiment of the invention, this can be done by comparing an identifier(s) with identifiers previously associated with authenticated users. Any identifier or combination of identifiers known in the art can be used to identify the origins of a network communication. By way of example, but not limitation, the control device can read the headers of IP packets carrying the network communication to extract an originating MAC address and/or an originating IP address associated with the originating user device. The control device can compare the identifier(s) extracted from the IP packet to identifiers for previously authenticated users. If the extracted identifier matches an authenticated user, the control device can control the user's network access as described in conjunction with the example of
If a user has not authenticated, the control device, at step 36, can capture the user's network application session until the user authenticates. For applications that are latency or session sensitive, such as HTTP or HTTPS communications, the session may be cached or suspended in a manner that does cause the destination application (e.g., web page) to drop the session. For example, if the user enters into a stateful network application session, the control device can detect this, based on information in the IP packets, and maintain the session on behalf of the user until the user has authenticated.
At step 38, the control device can redirect the user to an authentication interface. By way of example but not limitation, if the network communication is an HTTP request, control device 20 can redirect the HTTP request to an authentication web page hosted by the control device using any HTTP redirection technique known in the art. If the network communication is in another form, such as an email message, the control device can detect, from the IP packets, the protocol (e.g., POP, SMTP or other protocol known in the art) used by the network application (e.g., a mail user agent) and send a message back to the network application with, for example, an embedded link to the authentication interface. In other embodiments of the invention, the control device can send a protocol-specific message, such as an error message, indicating the authentication state and providing information about further actions necessary on part of the user to authenticate. As an example, if an unauthenticated user initiates a telnet session, the control device can return a telnet error indicating a failed authentication and providing directions to the application interface. Thus, the control device, rather than simply returning “Connect Failed” could return “Connect Failed: Authenticate at http://www.Rocksteady1.com/login//.” In this case, http://www.Rocksteady1.com/login// can be hosted by the control device.
In response to the authentication interface, the user can provide credentials and, at step 40, the control device can receive them. The credentials can be any credentials known in the art including, but not limited to, user name, password, biometric data (e.g., fingerprint, retina pattern or other biometric information known in the art), smart card credentials, certificates and/or other user or hardware based credentials. In one embodiment of the invention, the credentials can be received by HTTP Post from a web page based form.
At step 42, the control device can authenticate the user by initiating a comparison between the received credentials and the credentials for authorized users. This can be done at the control device, or the control device can authenticate the user by sending the credentials to a backend authentication system (e.g., using HTTP Post). The credentials, in one embodiment of the invention, can be compared against an authentication database of authorized users to determine if the credentials match credentials in the authentication database. Example authentication technologies include LDAP, RADIUS, Microsoft Active Directory Service, Tivoli Access Manager, and Cisco TACACS/TACACS+.
If the credentials are not authenticated, control can pass to step 52. If, on the other hand, the credentials are authenticated, the control device, at step 44, can receive a user profile from the authentication system or internal data storage (e.g., a database, file or other data storage format known in the art) that contains attributes that govern provisioning of user access to the network. For example, the user profile can contain indicators of the upload and download bandwidth to which the user is entitled, session time limit, whether the control device will perform virus scanning for the user of incoming and/or outgoing IP packets, or other services known in the art. The user profile can also point to additional information that can be used to control network access. For example, the user profile can point to a list of web sites that the particular user is not permitted to visit. In one embodiment of the invention, the user profile can be received in a canonical format as an HTTP Post from the authentication system to the control device.
According to one embodiment of the invention, each user profile can have a predefined set of attributes. In some cases, the backend authentication system may not provide values for each of these attributes. Therefore, the control device can determine, at step 46, if the received user profile is complete, and, if it is not complete can, at step 48, fill in the missing attribute values with default values, which can be part of the control device's local configuration or may be retrieved by the control device during, for example, its initialization or startup phase. At step 50, the control device can initiate a control session for the authenticated user. The control session can have a specified time limit, a time out limit and/or other session features known in the art. While the control session is active, the control device can govern a user's access to a network according to the user profile associated with that user and defaults. The control session can be tracked by credentials, IP address, MAC address and/or other identifier. In one embodiment of the invention, the control session can be tracked based on a combination of user device MAC address and IP address and user provided credentials.
Thus, the control device can determine if the user seeking to use a network is authorized to use the network (step 42). According to one embodiment of the invention, if the user is authenticated, the control device receives a user profile (step 44), fills in any missing parameters in the user profile with defaults (steps 46 and 48) and initiates a control session for the user (step 50).
If, however, at step 42, the user is not authenticated, the control device, at step 52, can direct the user to a setup interface, such as an account setup web page. At the setup interface, the user can specify credentials, network access and levels of service, payment options and/or other account information. Based on this information, a user profile can be generated and stored in the authentication database. Profiles can also be entered into the authentication database by a systems administrator or in any other manner known in the art.
The control device can, thus, authenticate a user based on a network communication from a network application such as a web browser, ftp client, telnet client, mail user agent or other publicly available or proprietary network application. By supporting publicly available network applications, such as web browsers, embodiments of the invention allow authentication without requiring that a user install a proprietary network application on the user's user device. If a user can authenticate, the control device can control a user's access to a controlled network based on a user profile and/or default values. If the user can not authenticate, the user can be given an opportunity to establish a user profile. According to one embodiment of the invention, steps 30-54 can be optionally repeated (step 54) for each new network communication or IP packet detected.
At step 60, the control device can establish user specific rules and conditions based on attributes in the user profile. According to one embodiment of the invention, the control device can map the attributes to any arbitrary rule or traffic condition. By way of example, but not limitation, a user profile can contain attributes to specify upload and download bandwidth allocations for a user, firewall settings, whether the user can use transient VPNs, whether the user can use streaming services or voice over IP services, whether the user should be permitted to perform video teleconferencing, whether the control device should perform virus scanning or worm detection for the user, whether the user can utilize print services, surcharges for services or other settings. On example of supporting transient VPN is described in U.S. Provisional Patent Application No. 60/496,629, entitled “System and Method for Providing a Secure Connection Between Networked Computers,” to Eric White, et al., filed Aug. 20, 2003, which is hereby fully incorporated by reference.
In one embodiment of the invention, rules can be represented in an IP table. As would be understood by those of ordinary skill in the art, IP tables are essentially tables of rules that can be accessed by applications, such as a firewall, to execute the rules. Rules in the IP table can be associated to a user through any arbitrary identifier. Using the example of
An IP table rule can reference other rules or parameters for providing user specific provisioning. As an example, the IP table rule can reference websites that a user is not permitted to visit. A firewall application can access the rule to prevent the user from visiting these sites. As another example, the IP table rule for user 12 can reference a traffic rule that dictates that the bandwidth allocated to user 12 is 128 kbps up and 512 kbps down. A traffic control application, such as the Linux based Traffic Control module, can access the traffic control rule through the IP table and enforce the bandwidth allocation.
It should be noted that a user specific rule in an IP table can reference rules or parameters usable by any number of applications or process, such as firewalls, traffic control modules, virus scan applications or other applications known in the art. For example, a virus scan application can access the IP table rule for a particular user and us parameters referenced by the rule to provide user specific virus scanning. It should be further noted that the use of IP tables to establish user specific rules for user specific provisioning of bandwidth and access control is provided by way of example only, and user specific rules can be implemented in any suitable manner, as would be understood by those of ordinary skill in the art
Authentication module 62 can read the header 64 of IP packet 63 to determine an identifier for the originating user device such as, for example, an originating MAC address and/or IP address. For the sake of example, the MAC address is 08:00:69:02:01:FF and the IP address is 100.100.100. Authentication module 62 can then determine if the IP packet originated at a user device for which a control session is active by comparing information extracted from the header to a list 66 of active control sessions. The active control sessions can be indexed by, for example, MAC address, IP address, a combination of addresses or other identifier(s) associated with the originating user device or user. If a control session is active for the originating user device, the IP packet and header information can be passed to provisioning module 68. If the IP packet originated at a user device not associated with an active control session, control device 20 can authenticate the user.
According to one embodiment of the invention, to authenticate the user, control device 20 can redirect the user to an authentication interface, such as authentication web page 70, by sending a redirect message 72. Redirect message 72 can be a web page redirect, an error message, an email message with an embedded link to web page 70 or other indication that a user should access the authentication interface.
A user can provide credentials 74 to control device 20 and control device 20 can pass the credentials 74 to an authentication system as, for example, an HTTP Post. If the credentials are authenticated by the authentication system, authentication module 62 can receive a user profile 76 that contains attributes that can govern provisioning of access control for the user. In one embodiment of the invention, if the user profile is incomplete, authentication module 62 can add default attributes to the profile. Furthermore, if the user is authenticated by the authentication system, session monitor 78 can initiate a new control session if the credentials are authenticated and update the list 66 of active control sessions. It should be noted that in another embodiment of the invention, authentication can occur internally to control device 20.
According to one embodiment of the invention, provisioning module 68 can build a set of IP tables to govern provisioning by firewall module 82 and traffic conditioning module 84. In the example of
Each rule can optionally point to additional rules and parameters. For example, user specific rule 92 can point to traffic control rule 94 to govern bandwidth provisioning, firewall parameters 96 to govern firewall settings and file 98 that contains web sites that user 12 is not permitted to access. User specific rule 92 and the associated rules and parameters can be based on user profile 76. As an example, user profile 76 can specify that user 12 is entitled to 128 kbps up and 512 kbps down. Provisioning module 68 can establish traffic control rule 94, accessible by traffic conditioning module 84, that contains these limitations. Similarly, provisioning module 68 can establish firewall parameters 96 and file 98 based on attributes in user profile 76.
In the example of
At client discrimination stage 102, firewall module 82 can read the packet header of packet 80 to extract information to associate packet 80 with a user. Continuing with the previous example, if firewall module 82 extracts MAC address 08:00:69:02:01:FF and the IP address 100.100.100, firewall module 82 can associate packet 80 with user specific rule 92. At user specific rule stage 104, firewall module 82 can access user specific rule 92 based, for example, on the extracted MAC address and IP address. Based on user specific rule 92, firewall module 82 can access firewall parameters 94 and restricted web site list 96 and can process packet 80 accordingly. It should be noted that firewall parameters 94 can include any arbitrary set of parameters that can be used by a firewall to control traffic flow. For example, firewall parameters 94 can specify whether the associated user (e.g., user 12 of
In one embodiment of the invention, traffic conditioning module 84 can also access user specific IP table 90 and locate user specific rule 92, based for example, on the originating MAC address and IP address. From user specific rule 92, traffic conditioning module 84 can locate traffic control rule 94 that specifies a maximum upload bandwidth of 128 kbps. If the user exceeds this bandwidth limitation, traffic conditioning module 84 can queue or drop packet 80.
Packet flow in the reverse direction can be processed in an analogous manner. For example, a packet arriving from the Internet destined for a user device (e.g., laptop 14 of
In addition to authentication and provisioning, authentication and control program 61 can provide session monitoring. Session monitoring can be performed in any manner known in the art. Session monitor 78 can monitor a control session for session characteristics such as session time, time out, bandwidth utilization and other session characteristics known in the art. In one embodiment of the invention, session monitor 78 can determine if a user's session is still active by for example, performing port scans and ARP pings, as would be understood by those of skill in the art. If session monitor 78 determines that a control session is timed out (e.g., has been inactive for a predetermined period of time), session monitor can remove the control session from the list of active sessions, returning the user to an unauthenticated state, and delete the user specific rules for the associated user from IP table 90. Session monitor 78 can also generate records, such as accounting records and session records that can optionally be transmitted to other systems for further processing.
As would understood by those of ordinary skill in the art, authentication and control program 61 can also provide any arbitrary services known in the art, including, but not limited to, web server functions, DHCP client for negotiation with ISPs, DHCP server to assign IP addresses to user computers, kernel based packet filtering and stateful inspection, IP sharing, NATplus, port redirection, information and attack logging, automatic updating, VPN masquerade, remote support an configuration, name server configuration and/or web content filtering.
Interface master queue 108 can control the flow of network traffic over a particular interface. It can be configured to send out data at whatever rate is appropriate for the corresponding network connection. Interface master queue 108 can be feed data by user specific conditioners 112, each of which can have its own queue to hold packets the conditioner has accepted, but interface master queue 108 is not ready to accept.
For a particular network interface, each user can have an inward (i.e., download) and outward (i.e., upload) bandwidth allowance, based on attributes in the user's user profile. A bandwidth limit is the maximum rate at which a user is permitted to transmit or receive network traffic over a particular interface. User specific traffic conditioners 112 ensure that, if a user exceeds his or her bandwidth allowance, further network traffic in that direction on the network will be queued or dropped until the average data rate fall back within the bandwidth allowance. Thus, traffic conditioning module 84 can regulate bandwidth on a per user basis. In one embodiment, the control device can also dynamically control bandwidth on a per user basis. One embodiment of dynamic bandwidth shaping is discussed in U.S. Provisional Patent Application No. 60/418,968, entitled “System and Method for Dynamic Bandwidth Shaping,” to Kerry Clendenning, et al., filed Oct. 16, 2002, which is hereby fully incorporated by reference.
It should be noted that the architectures of
Embodiments of the invention provide advantages over prior art systems and methods of providing access control. One advantage is that embodiments of the control device can detect network communications across a variety of protocols and direct a user to an authentication interface. Another advantage provided by embodiments of the invention is that provisioning can be done based on a user profile rather than based on a particular port. In other words provisioning of bandwidth and services can be done on a per user rather than per port basis. Additionally, as will be described in conjunction with
In operation, user 134 using user device 135 (e.g., a laptop or other computing device known in the art) can authenticate with control device 130 at point 136 in subnet 124. Because user 134 is in subnet 124 at point 136, user device 135 can be assigned a first IP address, for example 100.100.100. For the sake example, user device can also be associated with MAC address 08:00:69:02:01:FF. The user's active session can be indexed based on the first IP address, the MAC address and the user's credentials. User 134 can then roam outside of subnet 124, by for example, leaving the range of the wireless routers of subnet 124. Control device 130 can determine if user 134 is still active on subnet 124 by, for example, ARP pining and/or performing port scans on user device 135 at predetermined intervals.
If control device 130 can not locate user device on subnet 124, control device 130 can begin a time out timer. If the time out timer reaches a predetermined limit, control device 130 can close the control session, returning user 134 to his or her preauthenticated state. If, however, user 134 returns to subnet 124, as, for example, determined by the ARP pings and/or port scans, within the time limit, control device 130 can reset the time out timer and keep the control session open. Assume, for the sake of example, that user 134 returns to point 138 in subnet 124 before the session is timed out, so his or her control session remains open. Thus, control device 130 can maintain user 134 in an authenticated state even though user 134 roamed outside of subnet 124.
User 134 can then roam from point 138 to point 140 with laptop 135. When user 134 leaves subnet 124, control device 130 can begin a time out timer for the user's control session. When user 134 enters subnet 122, laptop 135 can be assigned a new IP address for that subnet, say 101.100.100. If user 134 initiates a network communication destined for network 126 (e.g., a web page request), control device 128 can receive the communication and determine if IP address 101.100.100 and MAC address 08:00:69:02:01:FF correspond to an active control session. In this case, because user 134 authenticated with control device 130, IP address 101.100.100 and MAC address 08:00:69:02:01:FF will not correspond to an active session on control device 128. In one embodiment of the invention, control device 128 can simply initiate a new authentication process.
In another embodiment of the invention, control device 128 can query other control devices with which it is federated to determine if a user has an active control session. For example, because control device 128 and control device 130 are in federation 132, control device 128 can query control device 130 to determine if user 134 has an active session. This can be done based, for example, on the MAC address of laptop 135 as laptop 135 will typically retain the same MAC address across subnets.
According to one embodiment of the invention, control device 128 can send an SNMP message to control device 130 to determine if there is an active session corresponding to the MAC address 08:00:69:02:01:FF. In this case, if the user's control session at control device 130 has not yet timed out, control device 130 can reply to control device 128 with session information and the user profile for user 134. Control device 128 can establish user based provisioning based on the user profile as if user 134 had authenticated at control device 128. Thus, user 134 can communicate to network 126 through control device 128 without reauthenticating.
In other embodiments of the invention, active session information for each control device can be maintained at a centralized system. Control device 128 can, in this embodiment of the invention, query the centralized system as to whether there are any active session(s) corresponding to MAC address 08:00:69:02:01:FF. In yet another embodiment of the invention, control device 128 can receive the user profile for user 134 from an authentication system rather than from another control device.
Thus, embodiments of the invention allow a user to physically roam, either in a wired or wireless environment, by, for example permitting mobile, transient behavior through the use of network access timeouts; and/or coordinating authentications between control devices.
As can be understood from the foregoing, physically moving from one location to another can cause a user device to become disconnected from the network or subnet (e.g., subnet 122 or subnet 124) for a short period of time. The length of the time the user is not connected can be a function of physically moving from one location to another. Embodiments of the invention permit a configurable timeout period that allows an authenticated user to become disconnected from a network and then reappear without losing the user's authentication status. In one embodiment of the invention, this timeout period can be part of the policy of the network service provider (e.g., the entity controlling subnet 122 and subnet 124) and, as such, is a configurable item in the control devices. The control devices can monitor user network device connection states actively, employing ARP ping techniques and non-obtrusive polling of network application ports to check the connection status of all authenticated users' devices.
A second aspect of physical roaming is when a user not only becomes disconnected from the network, but leaves a subnet arbitrated or monitored by a control device. In this case, once the user attempts any network access by way of a network access port (wired or wireless) at another control device, that control device can solicit feedback from any federation of control devices with which it has joined to determine if this particular user has an active session and should be granted a new session, without the requirement to authenticate. In some embodiments of the invention, the new control device can dynamically remap the network connections and configuration of a roaming user's user device, in the event that the new control device is configured differently or controls a different subnet. For example, the new control device can remap the IP address of the user device according any IP mapping scheme known in the art.
Control devices can participate in federations, in one embodiment of the invention, via loosely-coupled SNMP dialogs. In this embodiment of the invention there is no permanent federation configuration and, instead, control devices can broadcast their authorization status requests dynamically.
Another aspect of roaming can be service roaming. Service roaming can be a function of negotiated usage agreements between internet service providers, resulting in cross-indexed user authentication database and, potentially, resulting surcharges for accessing network resources via service providers other than the primary service provider associated with a user; i.e., assuming network service is funded by an individual, there may be surcharges to access network services via control devices not owned by that service provider.
The main processor 144 communicates with the other components by way of the main bus 142. This main processor 144 can be a general purpose processor, a limited processor such as an ASIC or microcontroller, or any other instruction execution machine. The primary storage 146 can provide transient memory or storage space for use by programs executing on the main processor 144. The main processor 144 communicates with the primary storage in any manner known in the art.
The secondary storage controller 148 connects a storage media 150 such as a hard drive, CD-ROM, floppy, tape drive, optical storage medium, memory or other storage device to the main processor 144 by way of the main bus 142. The main processor 144 communicates with the secondary storage controller 148 by way of the main bus 142, and the secondary storage controller 148 is used to read and/or write the storage media 150 on behalf of the main processor 144.
Control device 141 may communicate with other computing devices (e.g., user devices, network servers, etc.) by way of networks using network interfaces (e.g., user side network interface 152 and controlled network network interface 154 or other network interface). Computer instructions running on the main processor may then access other computers across the network in any of the conventional ways, e.g. by executing “protocols” which affect the transmission and reception of protocol data units, packages, etc. over the data transmission network.
In one embodiment of the invention, storage media 150 can store a set of computer instructions 156 that are executable by processor 144. During execution, portions of computer instructions 156 and data can be stored in primary storage 146, as would be understood by those of ordinary skill in the art. Processor 144 can execute computer instructions 156 to authenticate users and/or provide provisioning to users on a per user basis. Computer instructions 156 may be implemented in any programming language known in the art and can be implemented using any suitable architecture.
Additionally, in one embodiment of the invention, storage media 150 can include a database of user profiles an authentication credentials. In this embodiment of the invention, instructions 156 can be executable to authenticate the user at control device 141 and receive the user profile from storage media 150.
Although shown as a standalone device in
While the invention has been described with reference to particular embodiments, it should be understood that the embodiments are illustrative and that the scope of the invention is not limited to these embodiments. Many variations, modifications, additions and improvements to the embodiments described above are possible. It is contemplated that these variations, modifications, additions and improvements fall within the scope of the invention as detailed in the following claims.
This is a continuation of, and claims a benefit of priority under 35 U.S.C. 120 of the filing date of U.S. patent application Ser. No. 10/683,317, filed Oct. 10, 2003, now U.S. Pat. No. 8,117,639, issued on Feb. 14, 2012, entitled “SYSTEM AND METHOD FOR PROVIDING ACCESS CONTROL,” which claims priority from U.S. Provisional Application No. 60/417,674, filed Oct. 10, 2002, entitled “ACCESS CONTROLLED NETWORK SHARING,” which is fully incorporated by reference herein.
Number | Name | Date | Kind |
---|---|---|---|
5623601 | Vu | Apr 1997 | A |
5673393 | Marshall et al. | Sep 1997 | A |
5706427 | Tabuki | Jan 1998 | A |
5748901 | Afek et al. | May 1998 | A |
5835727 | Wong et al. | Nov 1998 | A |
5878231 | Baehr et al. | Mar 1999 | A |
5896499 | McKelvey | Apr 1999 | A |
5901148 | Bowen et al. | May 1999 | A |
5936542 | Kleinrock et al. | Aug 1999 | A |
5953506 | Kalra et al. | Sep 1999 | A |
5987134 | Shin et al. | Nov 1999 | A |
5996013 | Delp et al. | Nov 1999 | A |
6085241 | Otis | Jul 2000 | A |
6088451 | He et al. | Jul 2000 | A |
6092200 | Muniyappa et al. | Jul 2000 | A |
6108782 | Fletcher et al. | Aug 2000 | A |
6130892 | Short et al. | Oct 2000 | A |
6131116 | Riggins et al. | Oct 2000 | A |
6157953 | Chang et al. | Dec 2000 | A |
6173331 | Shimonishi | Jan 2001 | B1 |
6176883 | Holloway et al. | Jan 2001 | B1 |
6185567 | Ratnaraj et al. | Feb 2001 | B1 |
6194992 | Short et al. | Feb 2001 | B1 |
6199113 | Alegre et al. | Mar 2001 | B1 |
6205552 | Fudge | Mar 2001 | B1 |
6212558 | Antur et al. | Apr 2001 | B1 |
6219706 | Fan et al. | Apr 2001 | B1 |
6226752 | Gupta et al. | May 2001 | B1 |
6233607 | Taylor et al. | May 2001 | B1 |
6243815 | Antur et al. | Jun 2001 | B1 |
6266774 | Sampath et al. | Jul 2001 | B1 |
6275693 | Lin et al. | Aug 2001 | B1 |
6279030 | Britton et al. | Aug 2001 | B1 |
6295294 | Odlyzko | Sep 2001 | B1 |
6321339 | French et al. | Nov 2001 | B1 |
6324648 | Grantges, Jr. | Nov 2001 | B1 |
6336133 | Morris et al. | Jan 2002 | B1 |
6404743 | Meandzija | Jun 2002 | B1 |
6421319 | Iwasaki | Jul 2002 | B1 |
6463474 | Fuh et al. | Oct 2002 | B1 |
6473793 | Dillon et al. | Oct 2002 | B1 |
6473801 | Basel | Oct 2002 | B1 |
6477143 | Ginossar | Nov 2002 | B1 |
6484261 | Wiegel | Nov 2002 | B1 |
6502131 | Vaid et al. | Dec 2002 | B1 |
6502135 | Munger et al. | Dec 2002 | B1 |
6516417 | Pegrum et al. | Feb 2003 | B1 |
6535879 | Behera | Mar 2003 | B1 |
6539431 | Sitaraman et al. | Mar 2003 | B1 |
6631416 | Bendinelli et al. | Oct 2003 | B2 |
6636894 | Short et al. | Oct 2003 | B1 |
6643260 | Kloth et al. | Nov 2003 | B1 |
6678733 | Brown et al. | Jan 2004 | B1 |
6708212 | Porras et al. | Mar 2004 | B2 |
6732179 | Brown et al. | May 2004 | B1 |
6735691 | Capps et al. | May 2004 | B1 |
6757740 | Parekh et al. | Jun 2004 | B1 |
6763468 | Gupta et al. | Jul 2004 | B2 |
6785252 | Zimmerman et al. | Aug 2004 | B1 |
6789110 | Short et al. | Sep 2004 | B1 |
6789118 | Rao | Sep 2004 | B1 |
6798746 | Kloth et al. | Sep 2004 | B1 |
6804783 | Wesinger et al. | Oct 2004 | B1 |
6816903 | Rakoshitz et al. | Nov 2004 | B1 |
6823385 | McKinnon et al. | Nov 2004 | B2 |
6834341 | Bahl et al. | Dec 2004 | B1 |
6839759 | Larson et al. | Jan 2005 | B2 |
6876668 | Chawla et al. | Apr 2005 | B1 |
6907530 | Wang | Jun 2005 | B2 |
6917622 | McKinnon et al. | Jul 2005 | B2 |
6976089 | Na et al. | Dec 2005 | B2 |
6996625 | Kaplan et al. | Feb 2006 | B2 |
7013331 | Das | Mar 2006 | B2 |
7085385 | Frantz et al. | Aug 2006 | B2 |
7085854 | Keane et al. | Aug 2006 | B2 |
7092727 | Li et al. | Aug 2006 | B1 |
7120934 | Ishikawa | Oct 2006 | B2 |
7143283 | Chen et al. | Nov 2006 | B1 |
7143435 | Droms et al. | Nov 2006 | B1 |
7146639 | Bartal et al. | Dec 2006 | B2 |
7181017 | Nagel et al. | Feb 2007 | B1 |
7181532 | Chan | Feb 2007 | B1 |
7181542 | Tuomenoksa et al. | Feb 2007 | B2 |
7181766 | Bendinelli et al. | Feb 2007 | B2 |
7185073 | Gai et al. | Feb 2007 | B1 |
7185358 | Schreiber et al. | Feb 2007 | B1 |
7185368 | Copeland, III | Feb 2007 | B2 |
7188180 | Larson et al. | Mar 2007 | B2 |
7194554 | Short et al. | Mar 2007 | B1 |
7216173 | Clayton et al. | May 2007 | B2 |
7257833 | Parekh et al. | Aug 2007 | B1 |
7266754 | Shah | Sep 2007 | B2 |
7272646 | Cooper et al. | Sep 2007 | B2 |
7290288 | Gregg et al. | Oct 2007 | B2 |
7310613 | Briel et al. | Dec 2007 | B2 |
7316029 | Parker et al. | Jan 2008 | B1 |
7324551 | Stammers | Jan 2008 | B1 |
7324947 | Jordan et al. | Jan 2008 | B2 |
7325042 | Soscia et al. | Jan 2008 | B1 |
7386888 | Liang et al. | Jun 2008 | B2 |
7406530 | Brown et al. | Jul 2008 | B2 |
7418504 | Larson et al. | Aug 2008 | B2 |
7420956 | Karaoguz et al. | Sep 2008 | B2 |
7444669 | Bahl et al. | Oct 2008 | B1 |
7448075 | Morand et al. | Nov 2008 | B2 |
7454792 | Cantrell et al. | Nov 2008 | B2 |
7490151 | Munger et al. | Feb 2009 | B2 |
7509625 | Johnston et al. | Mar 2009 | B2 |
7562393 | Buddhikot et al. | Jul 2009 | B2 |
7587512 | Ta et al. | Sep 2009 | B2 |
7590728 | Tonnesen et al. | Sep 2009 | B2 |
7610621 | Turley et al. | Oct 2009 | B2 |
7624438 | White | Nov 2009 | B2 |
7634805 | Aroya | Dec 2009 | B2 |
7665130 | Johnston et al. | Feb 2010 | B2 |
8032933 | Turley et al. | Oct 2011 | B2 |
8108915 | White et al. | Jan 2012 | B2 |
8117639 | MacKinnon et al. | Feb 2012 | B2 |
8224983 | Ta et al. | Jul 2012 | B2 |
8332914 | Buddhikot et al. | Dec 2012 | B2 |
20010038639 | McKinnon et al. | Nov 2001 | A1 |
20010038640 | McKinnon et al. | Nov 2001 | A1 |
20010038645 | McKinnon et al. | Nov 2001 | A1 |
20010039576 | Kanada | Nov 2001 | A1 |
20010039582 | McKinnon et al. | Nov 2001 | A1 |
20020013844 | Garrett et al. | Jan 2002 | A1 |
20020021665 | Bhagavath et al. | Feb 2002 | A1 |
20020023160 | Garrett et al. | Feb 2002 | A1 |
20020023210 | Tuomenoksa et al. | Feb 2002 | A1 |
20020026503 | Bendinelli et al. | Feb 2002 | A1 |
20020026531 | Keane et al. | Feb 2002 | A1 |
20020029260 | Dobbins et al. | Mar 2002 | A1 |
20020029276 | Bendinelli et al. | Mar 2002 | A1 |
20020035699 | Crosbie | Mar 2002 | A1 |
20020042883 | Roux et al. | Apr 2002 | A1 |
20020046264 | Dillon et al. | Apr 2002 | A1 |
20020052941 | Patterson | May 2002 | A1 |
20020052950 | Pillai et al. | May 2002 | A1 |
20020053031 | Bendinelli et al. | May 2002 | A1 |
20020055968 | Wishoff et al. | May 2002 | A1 |
20020056008 | Keane et al. | May 2002 | A1 |
20020059408 | Pattabhiraman et al. | May 2002 | A1 |
20020075844 | Hagen | Jun 2002 | A1 |
20020085719 | Crosbie | Jul 2002 | A1 |
20020087713 | Cunningham | Jul 2002 | A1 |
20020090089 | Branigan | Jul 2002 | A1 |
20020091859 | Tuomenoksa et al. | Jul 2002 | A1 |
20020091944 | Anderson et al. | Jul 2002 | A1 |
20020099829 | Richards et al. | Jul 2002 | A1 |
20020112183 | Baird, III et al. | Aug 2002 | A1 |
20020112186 | Ford et al. | Aug 2002 | A1 |
20020120741 | Webb et al. | Aug 2002 | A1 |
20020123335 | Luna et al. | Sep 2002 | A1 |
20020124078 | Conrad | Sep 2002 | A1 |
20020124103 | Maruyama et al. | Sep 2002 | A1 |
20020129143 | McKinnon, III et al. | Sep 2002 | A1 |
20020131404 | Mehta et al. | Sep 2002 | A1 |
20020133581 | Schwartz et al. | Sep 2002 | A1 |
20020133586 | Shanklin et al. | Sep 2002 | A1 |
20020133589 | Gubbi et al. | Sep 2002 | A1 |
20020136226 | Christoffel et al. | Sep 2002 | A1 |
20020138631 | Friedel et al. | Sep 2002 | A1 |
20020138762 | Horne | Sep 2002 | A1 |
20020138763 | Delany et al. | Sep 2002 | A1 |
20020143914 | Cihula | Oct 2002 | A1 |
20020143964 | Guo et al. | Oct 2002 | A1 |
20020152284 | Cambray et al. | Oct 2002 | A1 |
20020162030 | Brezak et al. | Oct 2002 | A1 |
20020164952 | Singhal et al. | Nov 2002 | A1 |
20020165949 | Na et al. | Nov 2002 | A1 |
20020165990 | Singhal et al. | Nov 2002 | A1 |
20020169867 | Mann et al. | Nov 2002 | A1 |
20020174227 | Hartsell et al. | Nov 2002 | A1 |
20020178282 | Mysore et al. | Nov 2002 | A1 |
20020199007 | Clayton et al. | Dec 2002 | A1 |
20030041104 | Wingard et al. | Feb 2003 | A1 |
20030043846 | Purpura et al. | Mar 2003 | A1 |
20030046370 | Courtney | Mar 2003 | A1 |
20030055994 | Herrmann et al. | Mar 2003 | A1 |
20030059038 | Meyerson et al. | Mar 2003 | A1 |
20030061506 | Cooper | Mar 2003 | A1 |
20030069955 | Gieseke et al. | Apr 2003 | A1 |
20030069956 | Gieske et al. | Apr 2003 | A1 |
20030070170 | Lennon | Apr 2003 | A1 |
20030078784 | Jordan et al. | Apr 2003 | A1 |
20030087629 | Juitt et al. | May 2003 | A1 |
20030110073 | Briel et al. | Jun 2003 | A1 |
20030115247 | Simpson et al. | Jun 2003 | A1 |
20030123442 | Drucker et al. | Jul 2003 | A1 |
20030126608 | Safadi et al. | Jul 2003 | A1 |
20030135753 | Batra et al. | Jul 2003 | A1 |
20030149751 | Bellinger et al. | Aug 2003 | A1 |
20030154399 | Zuk | Aug 2003 | A1 |
20030159072 | Bellinger et al. | Aug 2003 | A1 |
20030163603 | Fry et al. | Aug 2003 | A1 |
20030172167 | Judge et al. | Sep 2003 | A1 |
20030177477 | Fuchs | Sep 2003 | A1 |
20030182420 | Jones et al. | Sep 2003 | A1 |
20030212800 | Jones et al. | Nov 2003 | A1 |
20030212900 | Liu et al. | Nov 2003 | A1 |
20030217126 | Polcha et al. | Nov 2003 | A1 |
20040015719 | Lee | Jan 2004 | A1 |
20040047356 | Bauer | Mar 2004 | A1 |
20040049586 | Ocepek et al. | Mar 2004 | A1 |
20040064351 | Mikurak | Apr 2004 | A1 |
20040064560 | Zhang et al. | Apr 2004 | A1 |
20040064836 | Ludvig et al. | Apr 2004 | A1 |
20040073941 | Ludvig et al. | Apr 2004 | A1 |
20040083295 | Amara et al. | Apr 2004 | A1 |
20040085906 | Ohtani | May 2004 | A1 |
20040093513 | Cantrell | May 2004 | A1 |
20040103426 | Ludvig et al. | May 2004 | A1 |
20040107290 | Kaplan et al. | Jun 2004 | A1 |
20040122956 | Myers et al. | Jun 2004 | A1 |
20040172557 | Nakae et al. | Sep 2004 | A1 |
20040177276 | MacKinnon et al. | Sep 2004 | A1 |
20040179822 | Tsumagari et al. | Sep 2004 | A1 |
20040181816 | Kim et al. | Sep 2004 | A1 |
20040199635 | Ta et al. | Oct 2004 | A1 |
20040210633 | Brown et al. | Oct 2004 | A1 |
20040215957 | Moineau et al. | Oct 2004 | A1 |
20040268149 | Aaron | Dec 2004 | A1 |
20040268234 | Sampathkumar et al. | Dec 2004 | A1 |
20050021686 | Jai et al. | Jan 2005 | A1 |
20050021975 | Liu | Jan 2005 | A1 |
20050044350 | White et al. | Feb 2005 | A1 |
20050044422 | Cantrell | Feb 2005 | A1 |
20050066200 | Bahl et al. | Mar 2005 | A1 |
20050091303 | Suzuki | Apr 2005 | A1 |
20050102529 | Buddhikot et al. | May 2005 | A1 |
20050138358 | Bahl et al. | Jun 2005 | A1 |
20050138416 | Qian et al. | Jun 2005 | A1 |
20050149721 | Lu | Jul 2005 | A1 |
20050193103 | Drabik | Sep 2005 | A1 |
20050195854 | Agmon et al. | Sep 2005 | A1 |
20050204022 | Johnston et al. | Sep 2005 | A1 |
20050204031 | Johnston et al. | Sep 2005 | A1 |
20050204050 | Turley | Sep 2005 | A1 |
20050204168 | Johnston et al. | Sep 2005 | A1 |
20050204169 | Tonnesen | Sep 2005 | A1 |
20050204402 | Turley et al. | Sep 2005 | A1 |
20060036723 | Yip et al. | Feb 2006 | A1 |
20060101262 | Haney | May 2006 | A1 |
20060168229 | Shim et al. | Jul 2006 | A1 |
20060168454 | Venkatachary et al. | Jul 2006 | A1 |
20060173992 | Weber et al. | Aug 2006 | A1 |
20060184618 | Kurup et al. | Aug 2006 | A1 |
20070073718 | Ramer et al. | Mar 2007 | A1 |
20070186113 | Cuberson et al. | Aug 2007 | A1 |
20070208864 | Flynn et al. | Sep 2007 | A1 |
20070208936 | Ramos Robles | Sep 2007 | A1 |
20070268878 | Clements | Nov 2007 | A1 |
20080066096 | Wollmershauser et al. | Mar 2008 | A1 |
20080098464 | Mizrah | Apr 2008 | A1 |
20080120661 | Ludvig et al. | May 2008 | A1 |
20080147840 | Roelens et al. | Jun 2008 | A1 |
20080276305 | Chan et al. | Nov 2008 | A1 |
20090279567 | Ta et al. | Nov 2009 | A1 |
20100064356 | Johnston et al. | Mar 2010 | A1 |
20100192213 | Ta et al. | Jul 2010 | A1 |
20100309878 | Stolyar et al. | Dec 2010 | A1 |
20100325697 | Terzis et al. | Dec 2010 | A1 |
20110007705 | Buddhikot et al. | Jan 2011 | A1 |
20110219444 | Turley et al. | Sep 2011 | A1 |
20110258687 | White et al. | Oct 2011 | A1 |
20120096517 | White et al. | Apr 2012 | A1 |
Number | Date | Country |
---|---|---|
0 587 522 | Mar 1994 | EP |
WO 0177787 | Oct 2001 | WO |
WO 0209458 | Jan 2002 | WO |
WO 0223825 | Mar 2002 | WO |
WO 0241587 | May 2002 | WO |
WO 02077820 | Oct 2002 | WO |
WO 03021890 | Mar 2003 | WO |
WO 03098461 | Nov 2003 | WO |
WO 2004034229 | Apr 2004 | WO |
WO 2004036371 | Apr 2004 | WO |
WO 2005020035 | Mar 2005 | WO |
Entry |
---|
Lingblom, Marie, Bluesocket's New Gateway Based on Open Standards—WGX-4000 Switch Wireless Gateway, CRN, Burlington, MA, found at www.crn.channelsupersearch.com, Apr. 21, 2003, 2 pgs. |
“Boingo Wireless Service Installed at LaGuardia Airport,” Jun. 17, 2003, Copyright 2003 M2Communications Ltd., found at www.findarticles.com, Dec. 8, 2003, 1 pg. |
“West Point Unwired: the Military Academy at West Point Continues to Lead the Way in High-Tech Curriculum with Wireless Classroom Networking,” Communication News, Jun. 2003, Copyright 2003 M2 Communications Ltd., found at www.findarticles.com, 5 pgs., printed Dec. 8, 2003. |
Molta, Dave, “Wireless Hotspots Heat Up,” Mobile & Wireless Technology, pp. 1-8, May 15, 2003, Copyright 2003 M2Communications Ltd., found at www.networkcomputing.com, printed Dec. 8, 2003, 8 pgs. |
Jackson, William, “Wireless at West Point: Officers of the Future Use IT in Class Now, in the Field Later (Technology Report),” Apr. 21, 2003, GCN, pp. 1-3, www.gcn.com. |
Lingblom, Marie, Cranite Develops SMB Strategy, CRN, San Jose, CA, Jun. 23, 2003, 2 pgs. |
Dornan, Andy “Wireless LANs: Freedom vs. Security?” Network Magazine, Jul. 2003, pp. 36-39, www.networkmagazine.com. |
O'Shea, Dan, “PCTEL looks past patent suit toward fusion of Wi-Fi, PC” Telephony.online, Jun. 2, 2003, pp. 1-2, found at www.telephonyonline.com, Primedia Business Magazines and Media, printed Dec. 8, 2003. |
O'Shea, Dan, “Boingo to Launch Initiative Aimed at Carrier Market” Telephony.online, Mar. 10, 2003, 1 pg., found at www.telephonyonline.com, Primedia Business Magazines and Media, printed Dec. 8, 2003. |
International Search Report for International Patent Application No. PCT/US03/32912, completed Mar. 22, 2004, mailed Apr. 8, 2004, 6 pgs. |
International Search Report for International Patent Application No. PCT/US03/32268, completed Oct. 17, 2004, mailed Oct. 29, 2004, 6 pgs. |
Fan, Chen, et al, “Distributed Real Time Intrusion Detection System for 3G,” Proceedings of ICCC2004, 2004, pp. 1566-1570. |
Yu, Zhao-xu et al., “Fuzzy Logic Based Adaptive Congestion Control Scheme for High-Speed Network,” vol. 33, No. 4, Information and Control, Aug. 2004, pp. 389-393 (with English abstract). |
Hamano, Takafumi et al., “A Redirection-Based Defense Mechanism Against Flood-Type Attacks in Large Scale ISP Networks,” 10th Asia-Pacific Conf. on Comm. and 5th Int'l Symposium on Multi-Dimensional Mobile Comm., 2004, pp. 543-547, IEEE #07803-8601-09/04. |
Sarolahti, Pasi, “Congestion Control on Spurious TCP Retransmssion Timeouts,” Globecom 2003, pp. 682-686, IEEE #0-7803-7974-8. |
Estevez-Tapiador, Juan M., et al., “Measuring Normality in HTTP Traffic for Anomaly-Based Intrusion Detection,” Computer Networks 45 (2004), pp. 175-193, available at www.sciencedirect.com, El Sevier 2004 #13891286. |
Xing, Xu-Jia, et al., “A Survey of Computer Vulnerability Assessment,” Chinese Journal of Computers, vol. 27, No. 1, Jan. 2004, pp. 1-11 (with English abstract). |
Wen et al. “Development of a Snort-Based Security Network Management and Real-Time Intrusion Detection System,” Journal of Beijing Normal Univ. (Natural Science), vol. 40, No. 1, Feb. 2004, pp. 40-43 (with English abstract). |
Thottethodi, Methune, et al., “Exploiting Global Knowledge to Achieve Self-Tuned Congestion Control for k-Ary n-Cube Networks,” IEEE Transactions on Parallel and Distributed Systems, vol. 15, No. 3, Mar. 2004, pp. 257-272, IEEE #1045-9219/04. |
Trabelsi, Zouheir, et al., “Malicious Sniffing Systems Detection Platform,” 2004 IEEE, pp. 201-207, IEEE #0-7695-2068-5/04. |
Guangzhi, Qu, et al., “A Framework for Network Vulnerability Analysis,” Proceedings of the IASTED Int'l Conf., Comm., Internet & Information Tech., Nov. 18-20, 2004, St. Thomas, US Virgin Islands, pp. 289-294. |
Albuquerque, Celio, et al., “Network Border Patrol: Preventing Congestion Collapse and Promoting Fairness in the Internet,” IEEE/ACM Transactions on Networking, vol. 12, No. 1, Feb. 2004, pp. 173-186, IEEE #1063-6692/04. |
Wirbel, Loring, “Security Stampede Could Flatten IPSec,” Network Magazine, Jan. 2004, p. 12, available at www.networkmagazine.com. |
MacLeod, Calum, “Freeing the Shackles with Secure Remote Working,” Comtec, Oct. 2003, pp. 66-67. |
Fisher, Dennis, “SSL Simplifies VPN Security,” IT Week, Nov. 10, 2003, p. 40, available at www.eweek.com/security. |
Conry-Murray, Andrew, “SSL VPNs: Remote Access for the Masses,” Network Magazine, Oct. 2003, pp. 26-32, available at www.networkmagazine.com. |
“Permeo Supports Microsoft Network Access Protection for Simplified Secure Remote Access; Permeo's Base5 Support of Microsoft Technology Provides “Zero Touch” Policy Enforcement”, Apr. 25, 2005, 2 pgs., Newswire, found at www.nerac.com. #NDN-121-0552-8254-9. |
Permeo Drives Out Operational Costs, Simplifies Secure Remote Access, Mar. 25, 2005, 2 pgs., Newswire, found at www.nerac.com. #NDN-121-0549-5967-5. |
“Netilla Lauches SSL VPN for Citrix. (Industry Briefs) (Virtual Private Networks) (Brief Article),” Sep. 20, 2004, 2 pgs., Computer Reseller News, found at www.nerac.com. #NDN-218-0991-7652-9. |
“Netilla Lauches Secure Gateway Appliance Family of Application-Specific SSL VPN Products; Initial SGA-C Model Provides Secure Remote Access to Citrix MetaFrame Presentation Server Installations . . . ” Sep. 13, 2004, 3 pgs., PR Newswire, found at www.nerac.com. #NDN-218-0987-0667-2. |
“Secure Remote Access.(Network Security) (VPN Gateway 4400 Series) (Brief Article),” Mar. 1, 2004, 2 pgs., Communication News, vol. 41, found at www.nerac.com. #NDN-218-0925-2711-6. |
“Fortinet and Aventail Deliver Joint Solution for Clientless Remote Access with High-Performance Antivirus Protection; Integrated SSL VPN and Antivirus Offering Provides Clientless Remote Access with Complete Content Security”, Jan. 5, 2004, 3 pgs., PR Newswire, found at www.nerac.com. #NDN-218-0845-8319-2. |
Hamblen, Matt, “Cisco Targets SSL VPN Vendors, Adds Support for Clientless Security Protocol: Installed Base of VPN Devices May Give it an Edge, Despite Late Entry,” Nov. 17, 2003, 3 pgs., Computerworld, vol. 37, No. 46, found at www.nerac.com. #NDN-218-0841-5076-0. |
Hamzeh, K., et al., “Point-to-Point Tunneling Protocol—PPTP RFC 2637” Network Working Groups, Jul. 1999, pp. 1-54, Microsoft Corporation. |
International Search Report and Written Opinion for International Application No. PCT/US04/29249, completed Nov. 28, 2005, mailed Dec. 15, 2005, 10 pgs. |
Pfleeger, Charles P., Computer Network Security, Security in Computing, 1989, pp. 364-415, Ch. 10, PTR Prentice-Hall, Inc., Englewood Cliffs, NJ. |
Office Action for U.S. Appl. No. 10/922,041, mailed Jul. 13, 2007, 20 pgs. |
Stone, David, “Securing Wireless LANs with VPN”, Intel Information Technology White Paper, Intel Corp., May 2006, 8 pgs. Order N#313185-001US. |
Office Action for U.S. Appl. No. 10/683,317, mailed Oct. 9, 2007, 20 pgs. |
Office Action for U.S. Appl. No. 10/687,002, mailed Oct. 18, 2007, 10 pgs. |
Office Action for U.S. Appl. No. 11/078,223, mailed Oct. 31, 2007, 8 pgs. |
Office Action for U.S. Appl. No. 11/076,652, mailed Jan. 25, 2008, 9 pgs. |
Office Action for U.S. Appl. No. 10/687,002, mailed Apr. 17, 2008, 12 pgs. |
Office Action for U.S. Appl. No. 10/683,317, mailed Jun. 9, 2008, 15 pgs. |
Office Action for U.S. Appl. No. 11/076,672, mailed Jul. 9, 2008, 12 pgs. |
Office Action for U.S. Appl. No. 11/076,652, mailed Jul. 22, 2008, 8 pgs. |
Office Action for U.S. Appl. No. 11/076,591, mailed Aug. 13, 2008, 10 pgs. |
Office Action for U.S. Appl. No. 11/076,719, mailed Sep. 4, 2008, 7 pgs. |
SBC Technology Resources, Inc., XNMP-XML Network Management Protocol and Interface, Jul. 19, 2002, pp. 1-9, http://www.ietf.org/proceedings/02jul/slides. |
Shim, Choon B., “XNMP for IP Telephony Management,” Enterprise Networks & Servers, Jun. 2, 2006, 7 pgs. |
Office Action for U.S. Appl. No. 11/076,652, mailed Dec. 11, 2008, 8 pgs. |
Office Action for U.S. Appl. No. 10/687,002, mailed Jan. 7, 2009, 14 pgs. |
Office Action for U.S. Appl. No. 11/076,672, mailed Feb. 3, 2009, 10 pgs. |
Oh, et al., “Interaction Translation Methods for XML/SNMP Gateway,” Jul. 11, 2003, retrieved from http://web-archive.org/web/20030711162412/http://dpnm.postech.ac.kr/papers/DSOM/02/xml-snmp-gateway/xml-snmp-gateway. pdf, pp. 1-12. |
Office Action for U.S. Appl. No. 10/683,317, mailed Feb. 11, 2009, 17 pgs. |
Office Action for U.S. Appl. No. 11/076,591, mailed Feb. 13, 2009, 26 pgs. |
International Preliminary Report on Patentability for International Patent Application No. PCT/US03/032268 completed Jan. 4, 2005, 3 pgs. |
International Preliminary Report on Patentability for International Patent Application No. PCT/US03/032912 completed Jun. 28, 2004, 3 pgs. |
International Preliminary Report on Patentability (Ch. I) of the International Searching Authority for International Patent Application No. PCT/US04/029249 issued Feb. 21, 2006, 6 pgs. |
Office Action for U.S. Appl. No. 11/076,719, mailed Mar. 17, 2009, 8 pgs. |
Office Action for U.S. Appl. No. 10/922,041, mailed Dec. 6, 2005, 10 pgs. |
Office Action for U.S. Appl. No. 10/922,041, mailed Mar. 30, 2006, 18 pgs. |
Office Action for U.S. Appl. No. 10/922,041, mailed Aug. 11, 2006, 19 pgs. |
Office Action for U.S. Appl. No. 10/922,041, mailed Jan. 30, 2007, 20 pgs. |
Office Action for U.S. Appl. No. 10/683,317, mailed Apr. 5, 2007, 6 pgs. |
Office Action for U.S. Appl. No. 10/687,002, mailed May 2, 2007, 10 pgs. |
Office Action for U.S. Appl. No. 10/922,041, mailed May 8, 2009, 13 pgs. |
Office Action for U.S. Appl. No. 11/076,672, mailed Jul. 21, 2009, 11 pgs. |
Notice of Allowability for U.S. Appl. No. 11/076,646, mailed Jul. 24, 2009, 7 pgs. |
Crandell et al., “A Secure and Transparent Firewall Web Proxy,” Oct. 2003, USENIX, Retrieved from the internet on Jul. 15, 2009: <URL: http://www.usenix.org/event/lisa03/tech/full—papers/crandell/crandell.pdf>. |
Sommerlad, “Reverse Proxy Patterns,” 2003 Retrieved from the Internet on Jul. 15, 2009, 27 pages; <URL: http://www.modsecurity.org/archive/ReverseProxy-book-1.pdf>. |
Office Action for U.S. Appl. No. 11/076,591, mailed Aug. 6, 2009, 29 pgs. |
Office Action for U.S. Appl. No. 10/683,317, mailed Aug. 18, 2009, 17 pgs. |
Rashti et al, “A Multi-Dimensional Packet Classifier for NP-Based Firewalls,” Proceedings of the 2004 Int'l Symposium on Applications and the Internet, Jan. 2004, 5 pages, from the internet, printed Aug. 12, 2009: <URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1266123&isnumber=28312>. |
Office Action for U.S. Appl. No. 11/076,672, mailed Jan. 7, 2010, 9 pgs. |
Office Action for U.S. Appl. No. 11/076,591, mailed Feb. 2, 2010, 34 pgs. |
Office Action for U.S. Appl. No. 11/076,591, mailed Jul. 20, 2010, 33 pgs. |
Office Action for U.S. Appl. No. 10/683,317, mailed Jul. 23, 2010, 9 pgs. |
Office Action for U.S. Appl. No. 12/506,140, mailed Sep. 1, 2010, 11 pgs. |
Office Action for U.S. Appl. No. 12/579,566, mailed Oct. 6, 2010, 7 pgs. |
Web site pg. entitled “Our Products,” downloaded from http://web.archive.org/web/20010815034246/rocksteady.com/product.html and printed Nov. 2, 2010, 1 pg. |
Web site pg. entitled “About RockNET,” downloaded from http://web.archive.org/web/20010824234659/rocksteady.com/rocknet.html and printed Nov. 2, 2010, 2 pgs. |
Web site pg. entitled “About RockNOC,” downloaded from http://web.archive.org/web/20010825000449/rocksteady.com/rocknoc.html and printed Nov. 2, 2010, 1 pg. |
Web site pg. entitled “Our RockBOX,” downloaded from http://web.archive.org/web/20010824233630/rocksteady.com/rockbox.html and printed Nov. 2, 2010, 2 pgs. |
Web site pg. entitled “About RockSteady,” downloaded from http://web.archive.org/web/20010825001007/rocksteady.com/techdetails.html and printed Nov. 2, 2010, 2 pgs. |
Web site pg. entitled “Your RockSteady Network,” downloaded from http://web.archive.org/web/20010723202022/rocksteady.com/popup.html and printed Nov. 2, 2010, 1 pg. |
“Discussion of Conceptual Difference Between Cisco IOS Classic and Zone-Based Firewalls,” Oct. 2007, Cisco Systems, Inc., San Jose, CA, 4 pgs. |
Cisco IOS Firewall Zone-Based Policy Firewall, Release 12.4(6)T, Technical Discussion, Feb. 2006, 77 pgs., Cisco Systems, Inc., San Jose, CA. |
Zone-Based Policy Firewall Design and Application Guide, Document ID: 98628, Sep. 13, 2007, 49 pgs., Cisco Systems, Inc., San Jose, CA. |
SP Maj, W Makairanondh, D Veal, “An Evaluation of Firewall Configuration Methods,” IJSCSNS International Journal of Computer Science and Network Security, vol. 10, No. 8, Aug. 2010, 7 pgs. |
Using VPN with Zone-Based Policy Firewall, May 2009, Cisco Systems, Inc., San Jose, CA, 10 pgs. |
Cisco IOS Firewall Classic and Zone-Based Virtual Firewall Application Configuration Example, Document ID: 100595, Feb. 12, 2008, 20 pgs., Cisco Systems, Inc., San Jose, CA. |
Class-Based Policy Provisioning: Introducing Class-Based Policy Language (CPL), Aug. 2008, 36 pgs., Cisco Systems, Inc., San Jose, CA. |
Cisco IOS Zone Based Firewall Example, at http://www.linickx.com/archives/2945/cisco-ios-zon . . . , printed Dec. 7, 2010, 6 pgs., LINICKX.com. |
Zone-Based Policy Firewall, Published Feb. 22, 2006, Updated Jun. 19, 2006, 46 pgs., Cisco Systems, Inc., San Jose, CA. |
Applying Zone-based Firewall Policies in Cisco Security Manager, Published Mar. 2009, Revised Sep. 2009, Cisco Systems, Inc., San Jose, CA. |
“FreeBSD Handbook, Chapter 30 Firewalls,” 2003, found at www.freebsd.org/doc/handbook/firewalls-ipfw.html, printed Dec. 27, 2010, 13 pgs. |
Watters, Paul, “Solaris 8 Administrator's Guide, Chapter 4, Network Configuration,” O'Reilly & Associates, Inc., Jan. 2002, 17 pgs. |
Spitzner, Lance, “Configuring network interface cards; getting your interfaces to talk,” Mar. 23, 2004, 4 pgs. |
Gite, Vivek, “Redhat/CentOS/Fedora Linux Open Port,” Sep. 13, 2007, found at www.cyberciti.biz/faq/howto-rhel-linux-open-port-using-iptables/ printed Jan. 3, 2011, 7 pgs. |
Office Action for U.S. Appl. No. 10/683,317, mailed Jan. 3, 2011, 12 pgs. |
Office Action for U.S. Appl. No. 12/617,211, mailed Feb. 3, 2011, 14 pgs. |
“Managing Firewall Services,” User Guide for Cisco Security Manager 3.3.1, Oct. 2009, Ch. 11, 90 pgs., Cisco Systems, Inc., San Jose, CA. |
“Cisco Common Classification Policy Language,” Cisco Router and Security Device Manager 2.4 User's Guide, Ch. 34, 2007, 32 pgs., Cisco Systems, Inc., San Jose, CA. |
Guide to User Documentation for Cisco Security Manager 4.0, Jun. 18, 2010, Cisco Systems, Inc., San Jose, CA. |
Cisco Configuration Professional: Zone-Based Firewall Blocking Peer to Peer Traffic Configuration Example, Document ID: 112237, Updated Dec. 3, 2010, 25 pgs., Cisco Systems, Inc., San Jose, CA. |
Tuning Cisco IOS Classic and Zone-Based Policy Firewall Denial-of-Service Protection, 2006, 10 pgs., Cisco Systems, Inc., San Jose, CA. |
Holuska, Marty, Using Cisco IOS Firewalls to Implement a Network Security Policy, Fort Hays State University/INT 490, printed Dec. 6, 2010, 5 pgs., http://quasarint.com/Capstone/zb—policy.php. |
Cisco Feature Navigator, Cisco Systems, Inc., San Jose, CA, printed on Dec. 2, 2010, 4 pgs., at http://tools.cisco.com/ITDIT/CFN/Dispatch. |
Office Action for U.S. Appl. No. 12/506,140, mailed Feb. 18, 2011, 13 pgs. |
Notice of Allowance for U.S. Appl. No. 12/579,566, mailed Mar. 23, 2011, 12 pgs. |
Notice of Allowance for U.S. Appl. No. 12/579,566, mailed May 13, 2011, 8 pgs. |
Office Action for U.S. Appl. No. 10/683,317, mailed Jun. 8, 2011, 15 pgs. |
Office Action for U.S. Appl. No. 12/617,211, mailed Jul. 19, 2011, 18 pgs. |
Office Action for U.S. Appl. No. 12/506,140, mailed Aug. 4, 2011, 18 pgs. |
Notice of Allowance for U.S. Appl. No. 12/579,566, mailed Aug. 30, 2011, 9 pgs. |
Notice of Allowance for U.S. Appl. No. 12/617,211, mailed Nov. 10, 2011, 8 pgs. |
Notice of Allowance for U.S. Appl. No. 10/683,317, mailed Nov. 28, 2011, 11 pgs. |
Office Action for U.S. Appl. No. 12/753,390, mailed Dec. 8, 2011, 19 pgs. |
Notice of Allowance for U.S. Appl. No. 12/617,211, mailed Dec. 12, 2011, 8 pgs. |
Alshamsi, Abdelnasir, et al., “A Technical Comparison of IPSec and SSL,” Tokyo University of Technology, Jul. 8, 2004, 10 pgs. |
Fisher, Dennis, “NetScreen to Acquire Neoteris,” IT Security & Network Security News, Oct. 6, 2003, 1 pg. |
Demaria, Mike, “Faster Than a Speeding VPN—Super Remote Access With Neoteris IVE,” Network Computing, Sep. 9, 2002, printed Nov. 9, 2011 from http://www.networkcomputing.com/data-protection/2296249, 3 pgs. |
Snyder, Joel, “SSL VPN Gateways,” Networkworld, Jan. 12, 2004, printed Nov. 9, 2011 from http://www.networkworld.com/reviews/2004/0112revmain.html, 10 pages. |
“NetExtender for SSL-VPN,” SonicWALL SSL-VPN NetExtender, Apr. 27, 2006, 30 pgs. |
“IPSec vs. SSL VPN: Transition Criteria and Methodology,” 2007 Sonicwall, 13 pgs. |
Fisher, Dennis, “Symantec Acquires SSL VPN Vendor,” IT Security & Network Security News, Oct. 20, 2003, printed Nov. 9, 2011 from http://www.eweek.com/index2.php?option=content& task=v . . . 1 page. |
Notice of Allowance for U.S. Appl. No. 12/753,390, mailed Mar. 16, 2012, 5 pages. |
Snyder, Joel, “What can NAC do for you now?,” Network World, Apr. 19, 2007 at http://www.networkworld.com/reviews/2007/041907-nac-intro.html, 4 pgs. |
Snyder, Joel, “Ultimate guide to network access control products,” Network World, Jun. 21, 2010 at http://www.networkworld.com/reviews/2010/062110-network-access-control-test.html, 2 pgs. |
Snyder, Joel, “NAC: What went wrong?,” Network World, May 24, 2010 at http://www.networkworld.com/reviews/2010/052410-network-access-control-test.html, 6 pgs. |
Andress, Mandy, “NAC alternatives hit the mark,” Network World, Jul. 30, 2007 at http://www.networkworld.com/reviews/2007/073007-test-nac-main.html, 5 pgs. |
Office Action for U.S. Appl. No. 12/619,560, mailed May 9, 2012, 7 pgs. |
Bauer, Mick, Designing and Using DMZ Networks to Protect Internet Servers, Linux Journal, Mar. 1, 2001, 6 pgs. at http://linuxjournal.com/article/4415, printed Mar. 22, 2012. |
Office Action for U.S. Appl. No. 13/092,488, mailed Jun. 11, 2012, 7 pgs. |
Office Action for U.S. Appl. No. 13/173,764, mailed Jul. 17, 2012, 15 pgs. |
Number | Date | Country | |
---|---|---|---|
20120117615 A1 | May 2012 | US |
Number | Date | Country | |
---|---|---|---|
60417674 | Oct 2002 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 10683317 | Oct 2003 | US |
Child | 13346139 | US |