Source: http://www.google.com/patents/US20040255154?dq=6,590,872
Timestamp: 2016-06-30 16:28:30
Document Index: 739491656

Matched Legal Cases: ['art 300', 'art 300', 'art 300', 'art 300', 'art 400', 'art 400', 'art 400', 'art 500', 'art 500', 'art 500', 'art 500']

Patent US20040255154 - Multiple tiered network security system, method and apparatus - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsA multiple key, multiple tiered network security system, method and apparatus provides at least three levels of security. The first level of security includes physical MAC address authentication of a device being attached to the network, such as a device being attached to a port of a network switch....http://www.google.com/patents/US20040255154?utm_source=gb-gplus-sharePatent US20040255154 - Multiple tiered network security system, method and apparatusAdvanced Patent SearchPublication numberUS20040255154 A1Publication typeApplicationApplication numberUS 10/458,628Publication dateDec 16, 2004Filing dateJun 11, 2003Priority dateJun 11, 2003Publication number10458628, 458628, US 2004/0255154 A1, US 2004/255154 A1, US 20040255154 A1, US 20040255154A1, US 2004255154 A1, US 2004255154A1, US-A1-20040255154, US-A1-2004255154, US2004/0255154A1, US2004/255154A1, US20040255154 A1, US20040255154A1, US2004255154 A1, US2004255154A1InventorsPhilip Kwan, Chi-Jui HoOriginal AssigneeFoundry Networks, Inc.Export CitationBiBTeX, EndNote, RefManPatent Citations (98), Referenced by (112), Classifications (4), Legal Events (6) External Links: USPTO, USPTO Assignment, EspacenetMultiple tiered network security system, method and apparatus
[0022] The features and advantages of the present invention will become more apparent from the detailed description set forth below when taken in conjunction with the drawings, in which like reference characters identify corresponding elements throughout. In the drawings, like reference numbers generally indicate identical, functionally similar, and/or structurally similar elements. The drawings in which an element first appears is indicated by the leftmost digit(s) in the corresponding reference number. DETAILED DESCRIPTION OF THE INVENTION [0023] A. Overview [0024] The present invention is directed to a multiple key, multiple tiered network security system, method and apparatus. The system, method and apparatus provides at least three levels of security. The first level comprises physical MAC address authentication of a device being attached to a network, such as a device being coupled to a port of a network switch. The second level comprises authentication of the user of the device, such as authentication in accordance with the IEEE 802.1x standard. The third level comprises dynamic assignment of the port to a particular VLAN based on the identity of the user. Failure to pass a lower security level results in a denial of access to subsequent levels of authentication. [0025] B. Multiple Tiered Security System, Method and Apparatus in [0026] Accordance with an Embodiment of the Present Invention [0027] [0027]FIG. 1 depicts the basic elements of a multiple tiered network security system 100 in accordance with an embodiment of the present invention. As shown in FIG. 1, system 100 comprises a data communications network 104, a network switch 102 and an authentication server 106 each of which is communicatively coupled to data communications network 104, and a user device 108 communicatively coupled to network switch 102. [0028] Data communications network 104 comprises a plurality of network nodes interconnected via a wired and/or wireless medium, wherein each node consists of a device capable of transmitting or receiving data over data communications network 104. In the embodiment described herein, data communications network 104 comprises a conventional local area network (“LAN”) that employs an Ethernet communication protocol in accordance with the IEEE 802.3 standard for data link and physical layer functions. However, the invention is not so limited, and data communications network 104 may comprise other types of networks, including but not limited to a wide area network (“WAN”), and other types of communication protocols, including but not limited to ATM, token ring, ARCNET, or FDDI (Fiber Distributed Data Interface) protocols. [0029] Network switch 102 is a device that comprises a plurality of ports for communicatively interconnecting network devices to each other and to data communications network 104. Network switch 102 is configured to channel data units, such as data packets or frames, between any two devices that are attached to it up to its maximum number of ports. In terms of the International Standards Organization's Open Systems Interconnection (OSI) model, network switch 102 performs layer 2, or data link layer, functions. In particular, network switch 102 examines each received data unit and, based on a destination address included therein, determines which network device the data unit is intended for and switches it out toward that device. In the embodiment described herein, the destination address comprises a physical or Media Access Control (MAC) address of a destination device. [0030] [0030]FIG. 2 depicts an exemplary high-level architecture of network switch 102 in accordance with an embodiment of the present invention. As shown in FIG. 2, network switch 102 comprises a plurality of input ports, 204 a through 204 n, that are coupled to a plurality of output ports, 206 a through 206 n, via a switching fabric 202. Network switch 102 also includes control logic 208 for controlling various aspects of switch operation and a user interface 210 to facilitate communication with control logic 208. User interface 210 provides a means for a user, such as a system administrator, to reconfigure the switch and adjust operating parameters. [0031] In operation, data units (e.g, packets or frames) are received and optionally buffered on one or more of input ports 204 a through 204 n. Control logic 208 schedules the serving of data units received by input ports 204 a through 204 n in accordance with a predetermined scheduling algorithm. Data units are then served to switching fabric 202, which routes them to the appropriate output port 206 a through 206 n based on, for example, the destination address of the data unit. Output ports 206 a through 206 n receive and optionally buffer data units from switching fabric 202, and then transmit them on to a destination device. In accordance with an embodiment of the present invention, network switch 102 may also include logic for performing routing functions (layer 3 or network layer functions in OSI). [0032] With further reference to FIG. 1, a user device 108 is shown connected to one of the ports of network switch 102. User device 108 may comprise a personal computer (PC), laptop computer, Voice Over Internet Protocol (VOIP) phone, or any other device capable of transmitting or receiving data over a data communications network, such as data communications network 104. As described in more detail herein, the security features of the present invention are particularly useful in the instance where user device 108 is highly portable, and thus may be readily moved from one point of network access to another. [0033] Authentication server 106 comprises a computer that stores application software and a database of profile information for performing a user authentication protocol that will be described in more detail herein. In an embodiment, authentication server 106 comprises a server that uses the Remote Authentication Dial-In User Service (RADIUS) as set forth in Internet Engineering Task Force (IETF) Request For Comments (RFC) 2865 for performing user authentication functions. [0034] [0034]FIG. 3 illustrates a flowchart 300 of a multiple tiered network security method in accordance with an embodiment of the present invention. The invention, however, is not limited to the description provided by the flowchart 300. Rather, it will be apparent to persons skilled in the relevant art(s) from the teachings provided herein that other functional flows are within the scope and spirit of the present invention. Flowchart 300 will be described with continued reference to example system 100 described above in reference to FIG. 1. The invention, however, is not limited to that embodiment. [0035] The method of flowchart 300 begins at step 302, in which user device 108 is coupled to a port of network switch 102. Coupling user device 108 to a port of network switch may comprise, for example, coupling user device 108 to an RJ-45 connector, which is in turn wired to a port of network switch 102. [0036] At step 304, network switch 102 performs a physical (MAC) address authentication of user device 108. As will be described in more detail herein, network switch 102 performs this step by comparing a MAC address of user device 108 with a limited number of “secure” MAC addresses that are stored by network switch 102. As shown at step 306, if packets received from user device 108 have a source MAC address that does not match any of the secure addresses, then the protocol proceeds to step 308, in which network switch 102 either drops the packets or, alternately, disables the port entirely, thereby terminating the security protocol. In a further embodiment of the present invention, network switch 102 can also re-direct the packets to a network destination other than their originally intended destination based on the detection of an invalid source MAC address. [0037] As further shown at step 306, if packets received from user device 108 have a source MAC address that does match one of the secure addresses, then the MAC address is valid and the security protocol proceeds to step 310. [0038] At step 310, network switch 102 authenticates a user of user device 108 based upon credentials provided by the user. As will be discussed in more detail herein, this step entails performing user authentication in accordance with the IEEE 802.1x standard, and involves sending the user credentials in a request message to authentication server 106 and receiving an accept or reject message in return, the accept or reject message indicating whether the user is valid. As shown at step 312, if the user is not valid, then the security protocol proceeds to step 314, in which network switch 102 blocks all traffic on the port except for the reception or transmission of 802.1x control packets on the port. However, as also shown at step 312, if the user is valid, then the security protocol proceeds to step 316. [0039] At step 316, network switch 102 determines whether or not the user is associated with a VLAN supported by the switch. As will be discussed in more detail herein, this step entails determining whether a VLAN identifier (ID) or a VLAN Name was returned as part of the accept message from authentication server 106. If the user is not associated with a VLAN supported by network switch 102, the port to which user device 108 is coupled is (or remains) assigned to a port default VLAN and all traffic on the port is blocked except for the reception or transmission of 802.1x control packets, as shown at step 318. If, however, the user is associated with a VLAN supported by network switch 102, then network switch 102 assigns the port to the specified VLAN and begins processing packets from user device 108, as shown at step 320. [0040] With reference to the exemplary switch embodiment of FIG. 2, the security functions performed by network switch 102, as described above, are performed by control logic 208. As will be appreciated by persons skilled in the art, such functions may be implemented in hardware, software or a combination thereof. [0041] C. Physical Address Authentication of User Device in Accordance with an Embodiment of the Present Invention [0042] As discussed above, network switch 102 is adapted to perform a physical (MAC) address authentication of a user device that is coupled to one of its ports. In particular, network switch 102 is adapted to store a limited number of “secure” MAC addresses for each port. A port will forward only packets with source MAC addresses that match its secure addresses. In an embodiment, the secure MAC addresses are specified manually by a system administrator. In an alternate embodiment, network switch 102 learns the secure MAC addresses automatically. If a port receives a packet having a source MAC address that is different from any of the secure learned addresses, a security violation occurs. [0043] With reference to the embodiment of network switch 102 depicted in FIG. 2, secure addresses for each input port 204 a through 204 n are stored in a local memory assigned to each port. Alternately, secure addresses are stored in a shared global memory, or in a combination of local and global memory. [0044] In an embodiment, when a security violation occurs, network switch 102 generates an entry to a system log and an SNMP (Simple Network Management Protocol) trap. In addition, network switch 102 takes one of two actions as configured by a system administrator: it either drops packets from the violating address or disables the port altogether for a specified amount of time. [0045] In a further embodiment of the present invention, a system administrator can configure network switch 102 to re-direct packets received from the violating address to a different network destination than that originally intended. Network switch 102 may achieve this by altering the packet headers. For example, network switch 102 may alter a destination address of the packet headers. Alternately, the re-direction may be achieved by generating new packets with identical data payloads but having different packet headers. As will be appreciated by persons skilled in the art, the decision to configure network switch 102 to re-direct traffic from a violating address may be premised on the resulting burden to network switch 102 in handling traffic from that address. [0046] [0046]FIG. 4 illustrates a flowchart 400 of a method for enabling physical address authentication of a device coupled to a data communications network in accordance with an embodiment of the present invention. In particular, flowchart 400 represents steps performed by a system administrator in order to configure a network switch to perform physical address authentication in accordance with an embodiment of the invention. The invention, however, is not limited to the description provided by the flowchart 400. Rather, it will be apparent to persons skilled in the relevant art(s) from the teachings provided herein that other functional flows are within the scope and spirit of the present invention. [0047] At step 402, the system administrator enables the MAC address authentication feature for one or more ports of the network switch. In an embodiment, the security feature is disabled on all ports by default, and a system administrator can enable or disable the feature globally on all ports at once or on individual ports. [0048] At step 404, the system administrator sets a maximum number of secure MAC addresses for a port. In an embodiment, the network switch utilizes a concept of local and global “resources” to determine how many MAC addresses can be secured on each port. In this context, “resource” refers to the ability to store one secure MAC address entry. For example, each interface may be allocated 64 local resources and additional global resources may be shared among all the interfaces on the switch. [0049] In an embodiment, when the MAC address authentication feature is enabled for a port, the port can store one secure MAC address by default. A system administrator can then increase the number of MAC addresses that can be secured to a maximum of 64, plus the total number of global resources available. The number of addresses can be set to a number from 0 to (64+the total number of global resources available). For example, the total number of global resources may be 2048 or 4096, depending on the size of the memory allocated. When a port has secured enough MAC addresses to reach its limit for local resources, it can secure additional MAC addresses by using global resources. Global resources are shared among all the ports on a first come, first-served basis. [0050] At step 406, the system administrator sets an age timer for the MAC address authentication feature. In an embodiment, secure MAC addresses are not flushed when a port is disabled and brought up again. Rather, based on how the switch is configured by the system administrator, the secure addresses can be kept secure permanently, or can be configured to age out, at which time they are no longer secure. For example, in an embodiment, the stored MAC addresses stay secure indefinitely by default, and the system administrator can optionally configure the device to age out secure MAC addresses after a specified amount of time. [0051] At step 408, the system administrator specifies secure MAC addresses for a port. Alternately, the switch can be configured to automatically “learn” secure MAC addresses by storing the MAC addresses of devices coupled to the port up to the maximum number of secure addresses for the port. These stored MAC addresses are then used as the secure addresses for authentication purposes. [0052] At step 410, the system administrator optionally configures the switch to automatically save the list of secure MAC addresses to a startup-configuration (“startup-config”) file at specified intervals, thus allowing addresses to be kept secure across system restarts. For example, learned secure MAC addresses can be automatically saved every twenty minutes. The startup-config file is stored in switch memory. In an embodiment, by default, secure MAC addresses are not automatically saved to a startup-config file. [0053] At step 412, the system administrator specifies the action taken when a security violation occurs. In the case where the system administrator has specified the secure MAC addresses for the port, a security violation occurs when the port receives a packet with a source MAC address that is different than any of the secure MAC addresses. In the case where the port is configured to “learn” secure MAC addresses, a security violation occurs when the maximum number of secure MAC addresses has already been reached, and the port receives a packet with a source MAC address that is different than any of the secure MAC addresses. In an embodiment, the system administrator configures the switch to take one of two actions when a security violation occurs: either drop packets from the violating address or disable the port altogether for a specified amount of time. [0054] D. User Authentication and Dynamic VLAN Assignment in Accordance with an Embodiment of the Present Invention [0055] As discussed above, network switch 102 is further adapted to perform user authentication if user device 108 has a valid physical (MAC) address. In an embodiment, user authentication is performed in accordance with the IEEE 802.1x standard. As will be appreciated by persons skilled in the art, the 802.1x standard utilizes the Extensible Authentication Protocol (EAP) for message exchange during the authentication process. [0056] In accordance with 802.1x, a user (known as the supplicant) requests access to a network access point (known as the authenticator). The access point forces the user's client software into an unauthorized state that allows the client to send only an EAP start message. The access point returns an EAP message requesting the user's identity. The client returns the identity, which is then forwarded by the access point to an authentication server, which uses an algorithm to authenticate the user and then returns an accept or reject message back to the access point. Assuming an accept message was received, the access point changes the client's state to authorized and normal communication can take place. [0057] In accordance with the embodiment of the invention described in reference to FIG. 1, and with reference to the 802.1x protocol described above, the user of user device 108 is the supplicant, network switch 102 is the authenticator, and authentication server 106 is the authentication server. In an embodiment, authentication server 106 comprises a server that uses the Remote Authentication Dial-In User Service (RADIUS) as described in RFC 2865, and may therefore be referred to as a RADIUS server. [0058] In further accordance with an embodiment of the present invention, authentication server 106 provides a VLAN identifier (ID) and associated information to network switch 102 as part of the message granting authorization to a particular user. The VLAN ID is included in an access profile for the user, which is configured by a network administrator and maintained in a database by authentication server 106. Network switch 102 is adapted to determine if the VLAN associated with the VLAN ID is available on the switch, and, if so, to dynamically assign the port to which user device 108 is coupled to that particular VLAN. [0059] [0059]FIG. 5 illustrates a flowchart 500 of a method for performing user authentication and dynamic VLAN assignment in accordance with an embodiment of the present invention. The invention, however, is not limited to the description provided by the flowchart 500. Rather, it will be apparent to persons skilled in the relevant art(s) from the teachings provided herein that other functional flows are within the scope and spirit of the present invention. Flowchart 500 will be described with continued reference to example system 100 described above in reference to FIG. 1. The invention, however, is not limited to that embodiment. [0060] The method of flowchart 500 begins at step 502, in which user device 108 attempts to access data communications network 104 via network switch 102. In response, network switch 102 places 802.1x client software on user device 108 into an unauthorized state that permits the client software to send only an EAP start message, as shown at step 504. Network switch 102 also returns an EAP message to user device 108 requesting the identity of the user, as shown at step 506. [0061] At step 508, the user of user device 108 inputs identity information or credentials, such as a user name and password, into user device 108 that are returned to network switch 102. Network switch 102 then generates an authentication call which forwards the user credentials to authentication server 106, as shown at step 510, and authentication server 106 performs an algorithm to authenticate the user based on the user credentials, as shown at step 512. [0062] At step 514, authentication server 106 returns either an accept or reject message back to network switch 102. As shown at step 516, if authentication server 106 sends a reject message back to network switch 102, the protocol proceeds to step 518. At step 518, network switch 102 blocks all traffic on the port except for the reception or transmission of 802.1x control packets (e.g., EAPOL packets) on the port. [0063] However, if authentication server 106 sends an accept message back to network switch 102, then the protocol proceeds to step 520. At step 520, network switch 102 parses the accept message to determine if a VLAN ID and associated information has been provided for the user. In the embodiment described herein, authentication server 106 provides three tunnel attributes as part of a RADIUS Access-Accept message for dynamic VLAN assignment. The following tunnel attributes are used: [0064] Tunnel-Type=VLAN [0065] Tunnel-Medium-Type=802 [0066] Tunnel-Private-Group-ID=VLAN ID [0067] The VLAN ID may comprise 12 bits, taking a value between one and 4094, inclusive. The VLAN ID is included in an access profile for the user, which is configured by a network administrator and maintained in a database by authentication server 106. In an alternate embodiment, a VLAN Name, which comprises a text field, is used instead of a VLAN ID for associating the user with a particular VLAN. [0068] The VLAN assignment controls which nodes the user will have access to on the network (e.g., only nodes that are members of the same VLAN) and is primarily used to differentiate broadcast domains. A VLAN ID may be assigned to a user based on security considerations. For example, a user with a low security clearance may be assigned to a VLAN that has been defined to limit access to information available via data communications network 104. [0069] If a VLAN ID and associated information necessary for dynamic VLAN assignment are not provided with the accept message, network switch 102 assigns the port to a port default VLAN and then accepts packets from user device 108, as shown at step 522. [0070] However, if the appropriate information, including the VLAN ID, is provided, network switch 102 determines if the VLAN ID identifies a valid VLAN for network switch 102, as shown at step 524. In an embodiment, network switch 102 performs this step by comparing the VLAN ID from the accept message with a stored list of valid VLAN IDs for network switch 102. [0071] If network switch 102 does not support the VLAN identified by the VLAN ID, network switch 102 assigns the port to a port default VLAN (or the port remains assigned to the port default VLAN, if already so configured) and all traffic on the port is blocked except for the reception or transmission of 802.1x control packets, as shown at step 526. If network switch 102 does support the VLAN identified by the VLAN ID, then network switch 102 assigns the port to that VLAN and then accepts packets from user device 102 for processing, as shown at step 528. In an embodiment, once a port is assigned to a VLAN, it remains dedicated to the VLAN until such time as a system administrator reassigns the port. [0072] Performing the above-described user authentication protocol after performing physical (MAC) address authentication of user device 108 provides enhanced security when network switch 102 is operating in a mode in which secure MAC addresses can be “learned.” As discussed in Section C, above, network switch 102 can be configured to automatically “learn” secure MAC addresses by storing the MAC addresses of devices coupled to a port up to the maximum number of secure addresses for the port. By necessity, this feature exposes the port to unauthorized devices. Consequently, the subsequent performance of user authentication operates to minimize the security risk associated with this feature. [0073] E. Multiple Tiered Security System, Method and Apparatus for Multi-Host Environments in Accordance with an Embodiment of the Present Invention [0074] The multiple tiered security protocol described above may be advantageously implemented in both single host and multiple host (multi-host) environments. FIG. 1 depicts a single host environment, as only a single user device 108 is coupled to a port of network switch 102. FIG. 6 depicts an alternate embodiment of the present invention that accommodates a plurality of user devices in a multi-host configuration. In particular, FIG. 6 a multiple tiered network security system 600 that comprises a data communications network 104, a network switch 602 and an authentication server 106 each of which is communicatively coupled to data communications network 104. A central user device 604 is coupled to network switch 602 and a plurality of additional user devices 606 a through 606 n are coupled to network switch 602 via central user device 604 in a multi-host configuration. [0075] The multiple tiered security protocol described above may be advantageously implemented in system 600 in a variety of ways. For example, network switch 602 may perform physical (MAC) address authentication of central user device 604 only, and then authenticate the users of all the user devices if it determines that central user device 604 has a valid MAC address. If central user device 604 has an invalid MAC address, then the port may be closed to all user devices. Alternately, network switch 602 may perform physical (MAC) address validation of each of the user devices prior to authenticating their users. In this case, network switch 102 can selectively accept packets from user devices having valid MAC addresses while dropping packets from user devices having invalid MAC addresses. [0076] E. Conclusion [0077] While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example only, and not limitation. It will be understood by those skilled in the relevant art(s) that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. Accordingly, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents. Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4897874 *Mar 31, 1988Jan 30, 1990American Telephone And Telegraph Company At&T Bell LaboratoriesMetropolitan area network arrangement for serving virtual data networksUS5237614 *Jun 7, 1991Aug 17, 1993Security Dynamics Technologies, Inc.Integrated network security systemUS5721780 *May 31, 1995Feb 24, 1998Lucent Technologies, Inc.User-transparent security method and apparatus for authenticating user terminal access to a networkUS5757924 *Sep 18, 1995May 26, 1998Digital Secured Networks Techolognies, Inc.Network security device which performs MAC address translation without affecting the IP addressUS5774551 *Aug 7, 1995Jun 30, 1998Sun Microsystems, Inc.Pluggable account management interface with unified login and logout and multiple user authentication servicesUS5812819 *Jun 5, 1995Sep 22, 1998Shiva CorporationRemote access apparatus and method which allow dynamic internet protocol (IP) address managementUS5825890 *Jul 1, 1997Oct 20, 1998Netscape Communications CorporationSecure socket layer application program apparatus and methodUS5892903 *Sep 12, 1996Apr 6, 1999Internet Security Systems, Inc.Method and apparatus for detecting and identifying security vulnerabilities in an open network computer communication systemUS5894479 *Dec 10, 1996Apr 13, 1999Intel CorporationProviding address resolution information for self registration of clients on power-up or dial-inUS5946308 *Oct 30, 1997Aug 31, 1999Cabletron Systems, Inc.Method for establishing restricted broadcast groups in a switched networkUS5958053 *Aug 22, 1997Sep 28, 1999At&T Corp.Communications protocol with improved securityUS5974463 *Jun 9, 1997Oct 26, 1999Compaq Computer CorporationScaleable network system for remote access of a local networkUS6021495 *May 30, 1997Feb 1, 20003Com CorporationMethod and apparatus for authentication process of a star or hub network connection ports by detecting interruption in link beatUS6115376 *Oct 29, 1997Sep 5, 20003Com CorporationMedium access control address authenticationUS6212191 *Jan 30, 1998Apr 3, 2001International Business Machines CorporationMethod and system for providing security to asynchronous transfer mode emulated local-area networksUS6219790 *Jun 19, 1998Apr 17, 2001Lucent Technologies Inc.Centralized authentication, authorization and accounting server with support for multiple transport protocols and multiple client typesUS6256314 *Aug 11, 1998Jul 3, 2001Avaya Technology Corp.Apparatus and methods for routerless layer 3 forwarding in a networkUS6338089 *Mar 31, 1999Jan 8, 2002Bull Hn Information Systems Inc.Method and system for providing session pools for high performance web browser and server communicationsUS6339830 *Mar 15, 2000Jan 15, 2002Alcatel Internetworking, Inc.Deterministic user authentication service for communication networkUS6363489 *Nov 29, 1999Mar 26, 2002Forescout Technologies Inc.Method for automatic intrusion detection and deflection in a networkUS6393484 *Apr 12, 1999May 21, 2002International Business Machines Corp.System and method for controlled access to shared-medium public and semi-public internet protocol (IP) networksUS6510236 *Dec 11, 1998Jan 21, 2003International Business Machines CorporationAuthentication framework for managing authentication requests from multiple authentication devicesUS6519646 *Sep 1, 1998Feb 11, 2003Sun Microsystems, Inc.Method and apparatus for encoding content characteristicsUS6553028 *Apr 30, 1999Apr 22, 2003Cisco Technology, Inc.Method and apparatus for multicast switching using a centralized switching engineUS6615264 *Apr 9, 1999Sep 2, 2003Sun Microsystems, Inc.Method and apparatus for remotely administered authentication and access controlUS6728246 *Feb 11, 2000Apr 27, 2004Advanced Micro Devices, Inc.Arrangement for reducing layer 3 header data supplied to switching logic on a network switchUS6732270 *Oct 23, 2000May 4, 2004Motorola, Inc.Method to authenticate a network access server to an authentication serverUS6751728 *Jun 16, 1999Jun 15, 2004Microsoft CorporationSystem and method of transmitting encrypted packets through a network access pointUS6771649 *Dec 6, 1999Aug 3, 2004At&T Corp.Middle approach to asynchronous and backward-compatible detection and prevention of ARP cache poisoningUS6789118 *Feb 23, 2000Sep 7, 2004AlcatelMulti-service network switch with policy based routingUS6807179 *Apr 18, 2000Oct 19, 2004Advanced Micro Devices, Inc.Trunking arrangement in a network switchUS6853988 *Sep 20, 2000Feb 8, 2005Security First CorporationCryptographic server with provisions for interoperability between cryptographic systemsUS6874090 *Jun 21, 2001Mar 29, 2005AlcatelDeterministic user authentication service for communication networkUS6892309 *Feb 8, 2002May 10, 2005Enterasys Networks, Inc.Controlling usage of network resources by a user at the user's entry point to a communications network based on an identity of the userUS6907470 *Jun 28, 2001Jun 14, 2005Hitachi, Ltd.Communication apparatus for routing or discarding a packet sent from a user terminalUS6950628 *Aug 2, 2002Sep 27, 2005Cisco Technology, Inc.Method for grouping 802.11 stations into authorized service sets to differentiate network access and servicesUS7028098 *Jul 20, 2001Apr 11, 2006Nokia, Inc.Selective routing of data flows using a TCAMUS7032241 *May 5, 2000Apr 18, 2006Microsoft CorporationMethods and systems for accessing networks, methods and systems for accessing the internetUS7079537 *Apr 25, 2000Jul 18, 2006Advanced Micro Devices, Inc.Layer 3 switching logic architecture in an integrated network switchUS7088689 *Dec 21, 2001Aug 8, 2006Lg Electronics Inc.VLAN data switching method using ARP packetUS7092943 *Feb 28, 2003Aug 15, 2006Enterasys Networks, Inc.Location based dataUS7093280 *Sep 27, 2001Aug 15, 2006Juniper Networks, Inc.Internet security systemUS7113479 *May 31, 2002Sep 26, 2006Broadcom CorporationAggregated rate control method and systemUS7114008 *May 15, 2001Sep 26, 2006Cloudshield Technologies, Inc.Edge adapter architecture apparatus and methodUS7188364 *Jan 25, 2002Mar 6, 2007Cranite Systems, Inc.Personal virtual bridged local area networksUS7216229 *May 22, 2003May 8, 2007Huawei Technologies Co., Ltd.Method based on border gateway protocol message for controlling messages security protectionUS7234163 *Sep 16, 2002Jun 19, 2007Cisco Technology, Inc.Method and apparatus for preventing spoofing of network addressesUS7249374 *Jan 22, 2001Jul 24, 2007Cisco Technology, Inc.Method and apparatus for selectively enforcing network security policies using group identifiersUS7343441 *Sep 29, 2000Mar 11, 2008Microsoft CorporationMethod and apparatus of remote computer managementUS7360245 *Jul 18, 2001Apr 15, 2008Novell, Inc.Method and system for filtering spoofed packets in a networkUS7367046 *Dec 4, 2002Apr 29, 2008Cisco Technology, Inc.Method and apparatus for assigning network addresses to network devicesUS7483971 *Mar 28, 2002Jan 27, 2009Intel CorporationMethod and apparatus for managing communicatively coupled components using a virtual local area network (VLAN) reserved for management instructionsUS7490351 *Mar 12, 2003Feb 10, 2009Occam NetworksControlling ARP traffic to enhance network security and scalability in TCP/IP networksUS7500069 *Sep 17, 2001Mar 3, 2009Hewlett-Packard Development Company, L.P.System and method for providing secure access to network logical storage partitionsUS7523485 *Jul 31, 2003Apr 21, 2009Foundry Networks, Inc.System and method for source IP anti-spoofing securityUS7529933 *May 30, 2002May 5, 2009Microsoft CorporationTLS tunnelingUS7536464 *Sep 25, 2003May 19, 2009Cisco Technology, Inc.Methods and apparatus for performing layer 2 authentication and service selection in SSG based networksUS7562390 *Jul 14, 2009Foundry Networks, Inc.System and method for ARP anti-spoofing securityUS7567510 *Feb 13, 2003Jul 28, 2009Cisco Technology, Inc.Security groupsUS7596693 *Oct 31, 2006Sep 29, 2009Occam NetworksControlling ARP packet traffic to enhance network security and scalability in TCP/IP networksUS7735114 *Sep 4, 2003Jun 8, 2010Foundry Networks, Inc.Multiple tiered network security system, method and apparatus using dynamic user policy assignmentUS7774833 *Sep 23, 2003Aug 10, 2010Foundry Networks, Inc.System and method for protecting CPU against remote access attacksUS7979903 *Feb 25, 2009Jul 12, 2011Foundry Networks, LlcSystem and method for source IP anti-spoofing securityUS8006304 *Aug 23, 2011Foundry Networks, LlcSystem and method for ARP anti-spoofing securityUS20010012296 *Jan 17, 2001Aug 9, 2001Burgess Jon J.Multi-port network communication device with selective mac address filteringUS20020016858 *Jun 28, 2001Feb 7, 2002Sunao SawadaCommunication apparatus for routing or discarding a packet sent from a user terminalUS20020055980 *Aug 15, 2001May 9, 2002Steve GoddardControlled server loadingUS20020065938 *May 15, 2001May 30, 2002Jungck Peder J.Edge adapter architecture apparatus and methodUS20020146002 *Jul 24, 2001Oct 10, 2002Takayuki SatoNetwork administration apparatus, network administrating program, network administrating method and computer network systemUS20020146107 *Apr 10, 2001Oct 10, 2002Baals Kimberly A.Selective call waitingUS20030028808 *Jul 16, 2002Feb 6, 2003Nec CorporationNetwork system, authentication method and computer program product for authenticationUS20030037163 *Mar 8, 2002Feb 20, 2003Atsushi KitadaMethod and system for enabling layer 2 transmission of IP data frame between user terminal and service providerUS20030043763 *Jul 29, 1998Mar 6, 2003Paul D GraysonWireless networked message routingUS20030046391 *Apr 7, 2001Mar 6, 2003Jahanshah MorehFederated authentication serviceUS20030051041 *Aug 6, 2002Mar 13, 2003Tatara Systems, Inc.Method and apparatus for integrating billing and authentication functions in local area and wide area wireless data networksUS20030056001 *Jul 20, 2001Mar 20, 2003Ashutosh MateSelective routing of data flows using a TCAMUS20030056063 *Sep 17, 2001Mar 20, 2003Hochmuth Roland M.System and method for providing secure access to network logical storage partitionsUS20030065944 *Sep 28, 2001Apr 3, 2003Mao Yu MingMethod and apparatus for implementing a layer 3/layer 7 firewall in an L2 deviceUS20030067874 *Apr 22, 2002Apr 10, 2003See Michael B.Central policy based traffic managementUS20030105881 *Dec 3, 2001Jun 5, 2003Symons Julie AnnaMethod for detecting and preventing intrusion in a virtually-wired switching fabricUS20030142680 *Dec 30, 2002Jul 31, 2003Naoki OguchiDevice, network, and system for forwarding frames between geographically dispersed user networksUS20030167411 *Jan 24, 2003Sep 4, 2003Fujitsu LimitedCommunication monitoring apparatus and monitoring methodUS20030177350 *Mar 10, 2003Sep 18, 2003Kyung-Hee LeeMethod of controlling network access in wireless environment and recording medium thereforUS20030188003 *Mar 28, 2002Oct 2, 2003Mikael SylvestMethod and apparatus for the provision of unified systems and network management of aggregates of separate systemsUS20040003285 *Jun 28, 2002Jan 1, 2004Robert WhelanSystem and method for detecting unauthorized wireless access pointsUS20040053601 *Sep 9, 2003Mar 18, 2004Frank Ed H.Method and system for providing multiple encryption in a multi-band multi-protocol hybrid wired/wireless networkUS20040078485 *Oct 18, 2002Apr 22, 2004Nokia CorporationMethod and apparatus for providing automatic ingress filteringUS20040177276 *Oct 10, 2003Sep 9, 2004Mackinnon RichardSystem and method for providing access controlUS20040210663 *Apr 15, 2003Oct 21, 2004Paul PhillipsObject-aware transport-layer network processing engineUS20040213172 *Apr 24, 2003Oct 28, 2004Myers Robert L.Anti-spoofing system and methodUS20040213260 *Apr 28, 2003Oct 28, 2004Cisco Technology, Inc.Methods and apparatus for securing proxy Mobile IPUS20050025125 *Aug 1, 2003Feb 3, 2005Foundry Networks, Inc.System, method and apparatus for providing multiple access modes in a data communications networkUS20050055570 *Sep 4, 2003Mar 10, 2005Foundry Networks, Inc.Multiple tiered network security system, method and apparatus using dynamic user policy assignmentUS20050091313 *Aug 28, 2002Apr 28, 2005Peng ZhouSystem and implementation method of controlled multicastUS20050185626 *Apr 15, 2005Aug 25, 2005Meier Robert C.Method for grouping 802.11 stations into authorized service sets to differentiate network access and servicesUS20060028996 *Aug 9, 2004Feb 9, 2006Huegen Craig AArrangement for tracking IP address usage based on authenticated link identifierUS20060155853 *Nov 6, 2002Jul 13, 2006Peter NeszMethod and arrangement for preventing illegitimate use of ip addressesUS20070220596 *Nov 3, 2006Sep 20, 2007Keeler James DAuthorization and authentication of user access to a distributed network communication system with roaming feature* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS7516487May 20, 2004Apr 7, 2009Foundry Networks, Inc.System and method for source IP anti-spoofing securityUS7523485Jul 31, 2003Apr 21, 2009Foundry Networks, Inc.System and method for source IP anti-spoofing securityUS7555774Jun 30, 2009Cisco Technology, Inc.Inline intrusion detection using a single physical portUS7562389Jul 30, 2004Jul 14, 2009Cisco Technology, Inc.Method and system for network securityUS7562390Jul 14, 2009Foundry Networks, Inc.System and method for ARP anti-spoofing securityUS7568107 *Aug 20, 2003Jul 28, 2009Extreme Networks, Inc.Method and system for auto discovery of authenticator for network loginUS7711835Sep 30, 2004May 4, 2010Citrix Systems, Inc.Method and apparatus for reducing disclosure of proprietary data in a networked environmentUS7725938Jan 20, 2005May 25, 2010Cisco Technology, Inc.Inline intrusion detectionUS7735114 *Sep 4, 2003Jun 8, 2010Foundry Networks, Inc.Multiple tiered network security system, method and apparatus using dynamic user policy assignmentUS7748032Jun 29, 2010Citrix Systems, Inc.Method and apparatus for associating tickets in a ticket hierarchyUS7764670 *Jul 29, 2003Jul 27, 2010Level 3 Communications, LlcSystem and method for monitoring communications in a networkUS7774833Sep 23, 2003Aug 10, 2010Foundry Networks, Inc.System and method for protecting CPU against remote access attacksUS7810138Jan 23, 2006Oct 5, 2010Mcafee, Inc.Enabling dynamic authentication with different protocols on the same port for a switchUS7822982 *Oct 26, 2010Hewlett-Packard Development Company, L.P.Method and apparatus for automatic and secure distribution of a symmetric key security credential in a utility computing environmentUS7823199Mar 5, 2004Oct 26, 2010Extreme NetworksMethod and system for detecting and preventing access intrusion in a networkUS7831833May 6, 2005Nov 9, 2010Citrix Systems, Inc.System and method for key recoveryUS7831996Jul 31, 2006Nov 9, 2010Foundry Networks, LlcAuthentication techniquesUS7865603Oct 1, 2004Jan 4, 2011Citrix Systems, Inc.Method and apparatus for assigning access control levels in providing access to networked content filesUS7870294Jan 11, 2011Citrix Systems, Inc.Method and apparatus for providing policy-based document controlUS7900240May 28, 2004Mar 1, 2011Citrix Systems, Inc.Multilayer access control security systemUS7920548 *Apr 5, 2011Hong Kong Applied Science And Technology Research Institute Co. Ltd.Intelligent switching for secure and reliable voice-over-IP PBX serviceUS7958541Oct 25, 2007Jun 7, 2011Huawei Technologies Co., Ltd.Method, system and apparatus for preventing media access control address counterfeitingUS7969888 *Jun 28, 2011Futurewei Technologies, Inc.Data communications network for the management of an ethernet transport networkUS7979903Feb 25, 2009Jul 12, 2011Foundry Networks, LlcSystem and method for source IP anti-spoofing securityUS8006304Aug 23, 2011Foundry Networks, LlcSystem and method for ARP anti-spoofing securityUS8024568Sep 20, 2011Citrix Systems, Inc.Method and system for verification of an endpoint security scanUS8055800 *Jun 29, 2007Nov 8, 2011Extreme Networks, Inc.Enforcing host routing settings on a network deviceUS8065423Mar 1, 2006Nov 22, 2011Citrix Systems, Inc.Method and system for assigning access control levels in providing access to networked content filesUS8122485Oct 1, 2010Feb 21, 2012Foundry Networks, LlcAuthentication techniquesUS8140654Mar 28, 2008Mar 20, 2012Futurewei Technologies, Inc.Verifying management virtual local area network identifier provisioning consistencyUS8195819 *Jun 5, 2012Sprint Communications Company L.P.Application single sign on leveraging virtual local area network identifierUS8239929Aug 7, 2012Foundry Networks, LlcMultiple tiered network security system, method and apparatus using dynamic user policy assignmentUS8245300Aug 14, 2012Foundry Networks LlcSystem and method for ARP anti-spoofing securityUS8249096Aug 26, 2010Aug 21, 2012Foundry Networks, LlcSystem, method and apparatus for providing multiple access modes in a data communications networkUS8286230Oct 9, 2012Citrix Systems, Inc.Method and apparatus for associating tickets in a ticket hierarchyUS8312261Aug 12, 2011Nov 13, 2012Citrix Systems, Inc.Method and system for verification of an endpoint security scanUS8352606Jan 8, 2013Citrix Systems, Inc.Method and system for assigning access control levels in providing access to networked content filesUS8443429May 14, 2013Sprint Communications Company L.P.Integrated sign onUS8509106Oct 4, 2010Aug 13, 2013Foundry Networks, LlcTechniques for preventing attacks on computer systems and networksUS8520512Jul 31, 2006Aug 27, 2013Mcafee, Inc.Network appliance for customizable quarantining of a node on a networkUS8522311Jan 23, 2012Aug 27, 2013Foundry Networks, LlcAuthentication techniquesUS8522318Sep 10, 2010Aug 27, 2013Mcafee, Inc.Enabling dynamic authentication with different protocols on the same port for a switchUS8528047Aug 31, 2010Sep 3, 2013Citrix Systems, Inc.Multilayer access control security systemUS8528071Aug 24, 2004Sep 3, 2013Foundry Networks, LlcSystem and method for flexible authentication in a data communications networkUS8533823Feb 25, 2009Sep 10, 2013Foundry Networks, LlcSystem and method for source IP anti-spoofing securityUS8533846Nov 8, 2006Sep 10, 2013Citrix Systems, Inc.Method and system for dynamically associating access rights with a resourceUS8554903Oct 23, 2007Oct 8, 2013Vadarro Services Limited Liability CompanyNetwork appliance for vulnerability assessment auditing over multiple networksUS8554934 *Mar 24, 2012Oct 8, 2013Sprint Communications Company L.P.Application single sign on leveraging virtual local area network identifierUS8599860 *May 3, 2010Dec 3, 2013Futurewei Technologies, Inc.Multiple prefix connections with translated virtual local area networkUS8606940 *Feb 6, 2008Dec 10, 2013Alcatel LucentDHCP address conflict detection/enforcementUS8613048Sep 30, 2004Dec 17, 2013Citrix Systems, Inc.Method and apparatus for providing authorized remote access to application sessionsUS8681800May 1, 2012Mar 25, 2014Foundry Networks, LlcSystem, method and apparatus for providing multiple access modes in a data communications networkUS8707432Dec 20, 2007Apr 22, 2014Extreme Networks, Inc.Method and system for detecting and preventing access intrusion in a networkUS8751647Jun 30, 2001Jun 10, 2014Extreme NetworksMethod and apparatus for network login authorizationUS8885494Jul 26, 2010Nov 11, 2014Level 3 Communications, LlcSystem and method for monitoring communications in a networkUS8893256Jun 30, 2010Nov 18, 2014Brocade Communications Systems, Inc.System and method for protecting CPU against remote access attacksUS8918875Jul 18, 2011Dec 23, 2014Foundry Networks, LlcSystem and method for ARP anti-spoofing securityUS9009830May 19, 2010Apr 14, 2015Cisco Technology, Inc.Inline intrusion detectionUS9059987Apr 4, 2013Jun 16, 2015Sprint Communications Company L.P.Methods and systems of using single sign-on for identification for a web server not integrated with an enterprise networkUS9253151 *May 25, 2006Feb 2, 2016International Business Machines CorporationManaging authentication requests when accessing networksUS9300604Oct 28, 2013Mar 29, 2016Futurewei Technologies, Inc.Multiple prefix connections with translated virtual local area networkUS9306967Aug 30, 2013Apr 5, 2016Callahan Cellular L.L.C.Network appliance for vulnerability assessment auditing over multiple networksUS9311502Jan 7, 2013Apr 12, 2016Citrix Systems, Inc.Method and system for assigning access control levels in providing access to networked content filesUS20050025124 *Jul 29, 2003Feb 3, 2005Derek MitsumoriSystem and method for monitoring communications in a networkUS20050050357 *Sep 2, 2003Mar 3, 2005Su-Huei JengMethod and system for detecting unauthorized hardware devicesUS20050055570 *Sep 4, 2003Mar 10, 2005Foundry Networks, Inc.Multiple tiered network security system, method and apparatus using dynamic user policy assignmentUS20050138171 *Dec 19, 2003Jun 23, 2005Slaight Thomas M.Logical network traffic filteringUS20060023709 *Aug 2, 2004Feb 2, 2006Hall Michael LInline intrusion detection using a single physical portUS20060161983 *Jan 20, 2005Jul 20, 2006Cothrell Scott AInline intrusion detectionUS20060164199 *Jan 19, 2006Jul 27, 2006Lockdown Networks, Inc.Network appliance for securely quarantining a node on a networkUS20060168648 *Jan 23, 2006Jul 27, 2006Lockdown Networks, Inc.Enabling dynamic authentication with different protocols on the same port for a switchUS20060218221 *Mar 3, 2006Sep 28, 2006AlcatelSystem comprising aggregation equipment and remote equipmentUS20060242415 *May 6, 2005Oct 26, 2006Citrix Systems, Inc.System and method for key recoveryUS20060285693 *Jun 16, 2005Dec 21, 2006Amit RaikarMethod and apparatus for automatic and secure distribution of a symmetric key security credential in a utility computing environmentUS20070041373 *Aug 18, 2005Feb 22, 2007Hong Kong Applied Science And Technology Research Institute Co. Ltd.Intelligent switching for secure and reliable voice-over-IP PBX serviceUS20070109098 *Jul 26, 2006May 17, 2007Siemon John ASystem for providing network access securityUS20070124244 *Nov 29, 2005May 31, 2007Motorola, Inc.Traffic analyzer and security methodsUS20070230457 *Aug 15, 2006Oct 4, 2007Fujitsu LimitedAuthentication VLAN management apparatusUS20070237088 *Apr 5, 2006Oct 11, 2007Honeywell International. IncApparatus and method for providing network securityUS20070277228 *May 25, 2006Nov 29, 2007International Business Machines CorporationSystem, method and program for accessing networksUS20080028445 *Jul 7, 2007Jan 31, 2008Fortinet, Inc.Use of authentication information to make routing decisionsUS20080060076 *Oct 23, 2007Mar 6, 2008Lockdown Networks, Inc.Network appliance for vulnerability assessment auditing over multiple networksUS20080134291 *Oct 25, 2007Jun 5, 2008Huawei Technologies Co., Ltd.Method, system and apparatus for preventing media access control address counterfeitingUS20080267072 *Mar 28, 2008Oct 30, 2008Futurewei Technologies, Inc.Data Communications Network for the Management of an Ethernet Transport NetworkUS20080267080 *Mar 27, 2008Oct 30, 2008Futurewei Technologies, Inc.Fault Verification for an Unpaired Unidirectional Switched-PathUS20080270588 *Mar 28, 2008Oct 30, 2008Futurewei Technologies, Inc.Verifying Management Virtual Local Area Network Identifier Provisioning ConsistencyUS20090150665 *Dec 3, 2008Jun 11, 2009Futurewei Technologies, Inc.Interworking 802.1 AF Devices with 802.1X AuthenticatorUS20090198800 *Feb 6, 2008Aug 6, 2009Alcatel LucentDHCP address conflict detection/enforcementUS20100077447 *Jul 31, 2006Mar 25, 2010Foundry Networks, Inc.Authentication techniquesUS20100125898 *Dec 17, 2009May 20, 2010Fortinet, Inc.Use of authentication information to make routing decisionsUS20100199343 *Aug 5, 2010Aruba Networks, Inc.Classification of wired traffic based on vlanUS20100223654 *Sep 2, 2010Brocade Communications Systems, Inc.Multiple tiered network security system, method and apparatus using dynamic user policy assignmentUS20100290474 *May 3, 2010Nov 18, 2010Futurewei Technologies, Inc.Multiple Prefix Connections with Translated Virtual Local Area NetworkUS20100296408 *Jul 26, 2010Nov 25, 2010Derek MitsumoriSystem and method for monitoring communications in a networkUS20100325700 *Aug 26, 2010Dec 23, 2010Brocade Communications Systems, Inc.System, method and apparatus for providing multiple access modes in a data communications networkUS20100333176 *Sep 10, 2010Dec 30, 2010Mcafee, Inc., A Delaware CorporationEnabling Dynamic Authentication With Different Protocols on the Same Port for a SwitchUS20110107399 *Oct 1, 2010May 5, 2011Foundry Networks, LlcAuthentication techniquesUS20110113490 *May 12, 2011Foundry Networks, LlcTechniques for preventing attacks on computer systems and networksUS20110119390 *Jul 31, 2008May 19, 2011Leech Phillip ASelectively re-mapping a network topologyUS20120033670 *Feb 9, 2012Alcatel-Lucent, Usa Inc.EGRESS PROCESSING OF INGRESS VLAN ACLsUS20140223541 *Nov 19, 2013Aug 7, 2014Electronics & Telecommunications Research InstituteMethod for providing service of mobile vpnUS20140304808 *Apr 5, 2013Oct 9, 2014Phantom Technologies, Inc.Device-Specific Authentication CredentialsCN102082729A *Jan 30, 2011Jun 1, 2011瑞斯康达科技发展股份有限公司Safety control method of access layer switch port and switchCN102082729BJan 30, 2011Dec 12, 2012瑞斯康达科技发展股份有限公司Safety control method of access layer switch port and switchEP1701515A1Mar 8, 2005Sep 13, 2006AlcatelSystem and method for translation of Virtual LAN IdentifiersEP2047638A2 *Jul 30, 2007Apr 15, 2009Cisco Technologies, Inc.Apparatus and methods for supporting 802.1x in daisy chained devicesEP2618527A2 *Jan 3, 2013Jul 24, 2013General Electric CompanyDynamic virtual LANs to segregate dataWO2006081237A2 *Jan 25, 2006Aug 3, 2006Lockdown Networks, Inc.Enabling dynamic authentication with different protocols on the same port for a switchWO2006114053A1 *Apr 25, 2006Nov 2, 2006Huawei Technologies Co., Ltd.A method, system and apparatus for preventing from counterfeiting the mac addressWO2007019803A1 *Aug 17, 2006Feb 22, 2007Hong Kong Applied Science and Technology Research Institute Co. LtdAuthentic device admission scheme for a secure communication network, especially a secure ip telephony networkWO2008016589A2Jul 30, 2007Feb 7, 2008Cisco Technology, Inc.Apparatus and methods for supporting 802.1x in daisy chained devicesWO2009074108A1 *Dec 8, 2008Jun 18, 2009Huawei Technologies Co., Ltd.Interworking 802.1 af devices with 802.1x authenticator* Cited by examinerClassifications U.S. Classification726/4International ClassificationH04L29/06Cooperative ClassificationH04L63/08European ClassificationH04L63/08Legal EventsDateCodeEventDescriptionJun 11, 2003ASAssignmentOwner name: FOUNDRY NETWORKS, INC., CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KWAN, PHILIP;HO, CHI-JUI;REEL/FRAME:014171/0340Effective date: 20030604Dec 22, 2008ASAssignmentOwner name: BANK OF AMERICA, N.A. AS ADMINISTRATIVE AGENT, CALFree format text: SECURITY AGREEMENT;ASSIGNORS:BROCADE COMMUNICATIONS SYSTEMS, INC.;FOUNDRY NETWORKS, INC.;INRANGE TECHNOLOGIES CORPORATION;AND OTHERS;REEL/FRAME:022012/0204Effective date: 20081218Owner name: BANK OF AMERICA, N.A. AS ADMINISTRATIVE AGENT,CALIFree format text: SECURITY AGREEMENT;ASSIGNORS:BROCADE COMMUNICATIONS SYSTEMS, INC.;FOUNDRY NETWORKS, INC.;INRANGE TECHNOLOGIES CORPORATION;AND OTHERS;REEL/FRAME:022012/0204Effective date: 20081218Jan 20, 2010ASAssignmentOwner name: WELLS FARGO BANK, NATIONAL ASSOCIATION, AS COLLATEFree format text: SECURITY AGREEMENT;ASSIGNORS:BROCADE COMMUNICATIONS SYSTEMS, INC.;FOUNDRY NETWORKS, LLC;INRANGE TECHNOLOGIES CORPORATION;AND OTHERS;REEL/FRAME:023814/0587Effective date: 20100120Jul 21, 2010ASAssignmentOwner name: FOUNDRY NETWORKS, LLC, CALIFORNIAFree format text: CHANGE OF NAME;ASSIGNOR:FOUNDRY NETWORKS, INC.;REEL/FRAME:024733/0739Effective date: 20090511Jan 21, 2015ASAssignmentOwner name: INRANGE TECHNOLOGIES CORPORATION, CALIFORNIAFree format text: RELEASE BY SECURED PARTY;ASSIGNOR:BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT;REEL/FRAME:034792/0540Effective date: 20140114Owner name: FOUNDRY NETWORKS, LLC, CALIFORNIAFree format text: RELEASE BY SECURED PARTY;ASSIGNOR:BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT;REEL/FRAME:034792/0540Effective date: 20140114Owner name: BROCADE COMMUNICATIONS SYSTEMS, INC., CALIFORNIAFree format text: RELEASE BY SECURED PARTY;ASSIGNOR:BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT;REEL/FRAME:034792/0540Effective date: 20140114Jan 22, 2015ASAssignmentOwner name: FOUNDRY NETWORKS, LLC, CALIFORNIAFree format text: RELEASE BY SECURED PARTY;ASSIGNOR:WELLS FARGO BANK, NATIONAL ASSOCIATION, AS COLLATERAL AGENT;REEL/FRAME:034804/0793Effective date: 20150114Owner name: BROCADE COMMUNICATIONS SYSTEMS, INC., CALIFORNIAFree format text: RELEASE BY SECURED PARTY;ASSIGNOR:WELLS FARGO BANK, NATIONAL ASSOCIATION, AS COLLATERAL AGENT;REEL/FRAME:034804/0793Effective date: 20150114RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services