Source: http://www.google.com/patents/US7876772?dq=5958006
Timestamp: 2015-05-04 22:09:47
Document Index: 442843435

Matched Legal Cases: ['art 400', 'art 400', 'art 400', 'art 400', 'arts 500', 'arts 500', 'arts 500']

Patent US7876772 - System, method and apparatus for providing multiple access modes in a data ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsA system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the...http://www.google.com/patents/US7876772?utm_source=gb-gplus-sharePatent US7876772 - System, method and apparatus for providing multiple access modes in a data communications networkAdvanced Patent SearchPublication numberUS7876772 B2Publication typeGrantApplication numberUS 10/631,898Publication dateJan 25, 2011Filing dateAug 1, 2003Publication number10631898, 631898, US 7876772 B2, US 7876772B2, US-B2-7876772, US7876772 B2, US7876772B2InventorsPhilip KwanOriginal AssigneeFoundry Networks, LlcExport CitationBiBTeX, EndNote, RefManNon-Patent Citations (56), Referenced by (10), Classifications (5) External Links: USPTO, USPTO Assignment, EspacenetSystem, method and apparatus for providing multiple access modes in a data communications network
US 7876772 B2Abstract
A system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports. Control logic within the network access device is adapted to determine whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network. If the user authentication protocol is not supported, then the input port to which the network access device is coupled is placed in a semi-authorized access state that limits access to a pre-configured network accessible via the host network.
The present invention is directed to a network access system, method and apparatus that substantially obviates one or more of the problems and disadvantages of the related art.
The present invention is directed to a system, method and apparatus for providing multiple access modes in a data communications network. The system, method and apparatus provides at least three levels of network access. The particular level of access depends on whether a user device is configured to support an authentication protocol used by the host network. In conventional network access devices, the inability to communicate with the host network using a particular user authentication protocol, such as the IEEE 802.1x protocol, results in a denial of access to subsequent levels of authentication, and termination of the network connection.
B. System, Method and Apparatus for Providing Multiple Access Modes in Accordance with an Embodiment of the Present Invention
FIG. 1 depicts the basic elements of data communications network 100 that provides multiple network access modes in accordance with an embodiment of the present invention. As shown in FIG. 1, data communications network 100 comprises a host network 104, a network access device 102 and an authentication server 106 each of which is communicatively coupled to host network 104, and a user device 108 that is communicatively coupled to network access device 102.
C. System, Method and Apparatus for Providing Multiple Access Modes Based on User Device Type in Accordance with an Embodiment of the Present Invention
FIG. 4 illustrates a flowchart 400 of an alternate method for providing multiple access modes in a data communications network in accordance with an embodiment of the present invention. In particular, flowchart 400 describes an embodiment of the present invention wherein the default-public access mode comprises a plurality of pre-configured semi-authorized access states. Each of these states provide limited network access to a corresponding one of a plurality of low security VLANs as configured by a network administrator. If user device 108 does not support a user authentication protocol used by host network 104, the input port to which user device 108 is coupled is selectively placed into one of the plurality of pre-configured semi-authorized access states depending on the type of user device 108 (e.g., VoIP telephone or portable computing device). The invention, however, is not limited to the description provided by flowchart 400. Rather, it will be apparent to persons skilled in the relevant art(s) from the teachings provided herein that other functional flows are within the scope and spirit of the present invention. Flowchart 400 will also be described with continued reference to data communications network 100 and network access device 102 described above in reference to FIGS. 1 and 2. The invention, however, is not limited to those embodiments.
D. Method for Providing Additional Levels of Security in a Data Communications Network that Provides Multiple Access Modes in Accordance with an Embodiment of the Present Invention
FIGS. 5A and 5B depict flowcharts 500A and 500B of a method for providing additional levels of security in a data communications network that provides multiple access modes in accordance with the present invention. The additional levels of security may comprise validation of a media access control (MAC) address, or physical address, of a user device coupled to a port of a network access device, as well as dynamic VLAN assignment of the user device. The invention, however, is not limited to the description provided by flowcharts 500A and 500B. Rather, it will be apparent to persons skilled in the relevant art(s) from the teachings provided herein that other functional flows are within the scope and spirit of the present invention. Flowcharts 500A and 500B will also be described with continued reference to data communications network 100 and network access device 102 described above in reference to FIGS. 1 and 2. The invention, however, is not limited to those embodiments.
E. Physical Address Authentication of User Device in Accordance with an Embodiment of the Present Invention
As discussed above, in accordance with an embodiment of the present invention, network access device 102 is adapted to perform a physical (MAC) address authentication of a user device that is coupled to one of its ports. In particular, network access device 102 is adapted to store a limited number of �secure� MAC addresses for each port. A port will forward only packets with source MAC addresses that match its secure addresses. In an embodiment, the secure MAC addresses are specified manually by a system administrator via user interface 210. In an alternate embodiment, network access device 102 learns the secure MAC addresses automatically. If a port receives a packet having a source MAC address that is different from any of the secure learned addresses, a security violation occurs.
F. Multiple Access Mode System, Method and Apparatus for Multi-Host Environments in Accordance with an Embodiment of the Present Invention
The multiple access mode protocols and methods described above may be advantageously implemented in both single host and multiple host (multi-host) environments. FIG. 1 depicts a single host environment, as only a single user device 108 is coupled to a port of network access device 102. FIG. 7 depicts an alternate embodiment of the present invention that accommodates a plurality of user devices 108 a-108 n in a multi-host configuration. In particular, system 700 of FIG. 7 comprises a host network 104, which is communicatively coupled to a network access device 102, and an authentication server 106. A central user device 704 is coupled to network access device 102 and a plurality of additional user devices 108 a through 108 n are coupled to network access device 102 via central user device 704 in a multi-host configuration.
Non-Patent CitationsReference1Alcatel Internetworking, Inc., "Authenticated VLANs: Secure Network Access at Layer 2," An Alcatel White Paper, Nov. 2002, pp. 1-14.2Cisco Systems, Inc., Ch. 20, "Configuring Port-Based Traffic Control," Catalyst 3550 Multilayer Switch SW Config. Guide, Cisco IOS Rel. 12.3 (13) EA1, Mar. 2003, pp. 1-14.3Cisco Systems, Inc., Ch. 27, "Configuring Network Security with ACLs," Catalyst 3550 Multilayer Switch SW Config. Guide, Cisco IOS Rel. 12.3 (13) EA1, Mar. 2003, pp. 1-48.4Cisco Systems, Inc., Ch. 9, "Configuring 802.1X Port-Based Authentication," Catalyst 3550 Multilayer Switch SW Config. Guide, Cisco IOS Rel. 12.3 (13) EA1, Mar. 2003, pp. 1-18.5Cisco Systems, Inc., Chapter 20, "Configuring Port-Based Traffic Control", Catalyst 3550 Multilayer Switch Software Configuration Guide, Cisco IOS Release 12.1(13) EA1, Mar. 2003, pp. 1-14.6Cisco Systems, Inc., Chapter 27, "Configuring Network Security with ACLs", Catalyst 3550 Multilayer Switch Software Configuration Guide, Cisco IOS Release 12.1(13) EA1, Mar. 2003, pp. 1-48.7Cisco Systems, Inc., Chapter 9, Configuring 802.1X Port-Based Authentication, Catalyst 3550 Multilayer Switch Software Configuration Guide, Cisco IOS Release 12.1(13) EA1, Mar. 2003, pp. 1-18.8Congdon, P. et al., "IEEE 802.1X Remote Authentication Dial in User Service (RADIUS) Usage Guidelines," The Internet Society, 2003, 30 pages, obtained from http://www.faqs.org/ftp/rfc/pdf/rfc3580.txt.pdf.9Copending U.S. Appl. No. 10/458,628, filed Jun. 11, 2003, entitled: "Multiple Tiered Network Security System, Method and Apparatus".10Copending U.S. Appl. No. 10/654,417, filed Sep. 4, 2003, entitled: "Multiple Tiered Network Security System, Method and Apparatus Using Dynamic User Policy Assignment".11Hayes et al., Authenticated VLANs: Secure Network Access at Layer 2, Alcatel Telecommunications Review, pp. 28-286, 2002.12Hayes et al., Authenticated VLANs; Secure Network Access at Layer 2, Alcatel Telecommunications Review, pp. 280-286 (2002).13http://www.anml.iu.edu/PDF/Automatic�Spoof�Detector.pdf, entitled "Automatic Spoof Detector (aka Spoofwatch)," dated Jan. 28, 2002, printed Jul. 23, 2003, 2 pages in length.14http://www.cert.org/incident�notes/IN-2000-04.html, entitled "CERT� Incident Note IN-2000-04 (Denial of Service Attacks Using Nameservers)," printed Jul. 23, 2003, 3 pages in length.15http://www.cisco.com/en/US/products/hw/switches/ps574/products�configuration�guide�chapter09186a008007ef90. html#x tocid3 (PDF & web pages), entitled "Cisco Catalyst 1900 Series Switches," printed Jul. 29, 2003, 13 pages in length.16http://www.cisco.com/en/US/products/sw/iosswrel/;s1839/products�feature�guide09186a00801543c8.html#1027177 (PDF & web pages), entitled "Cisco IOS Software Releases 12.2T," printed Jul. 29, 2003, 12 pages in length.17http://www.cisco.com/en/US/tech/tk86/tk803/technologies�tech�note09186a00800a7828.shtml (PDF & web pages), entitled "Cisco-Cable Source-Verify and IP Address Security," printed Jul. 23, 2003, 25 pages in length.18http://www.extremenetworks.com/libraries/prodpdfs/products/ex�ware�tech�brief.pdf (Extreme Networks PDF), entitled "Tech Brief ExtremeWare 6.2," printed Jul. 29, 2003, 8 pages in length.19http://www.extremenetworks.com/libraries/prodpdfs/products/UnifiedWireless.asp (Extreme Networks PDF & web pages), entitled: Unified Access Architecture for Wired and Wireless Networks, printed Jul. 29, 2003, 10 pages in length.20http://www.legions.org/kv/kv7.txt, entitled "Keen Veracity Legions of the Underground Issue #[7],:" printed Jun. 24, 2003, pp. 1-41.21http://www.linuxgazette.com/issue63/sharma.html, entitled "IP Spoofing," printed Jul. 23, 2003, e pages in length.22http://www.networkcommand.com/docs/ipspoof.txt, entitled "[IP-spoofing Demystified] (Trust-Relationship Exploitation)," Jun. 1996, printed May 18, 2003, pp. 1-9.23http://www.sans.org/rr/threats/spoofed.php (PDF and web pages), entitled Spoofed IP Address Distributed Denial of Service Attacks: Defense-in-Depth, printed Jul. 23, 2003, 7 pages in length.24http:www.cisco.com/en/US/tech/tk648/tk361/technologies�tech�note09186a0080094adb.shtml (PDF & web pages), entitled "IP Addressing Services," printed Jul. 29, 2003, 10 pages in length.25Michele Wright, "Using Policies for Effective Network Management", International Journal of Network Management, pp. 1-8, John Wiley & Sons, Ltd., 1999.26Microsoft, "Recommendations for IEEE 801.11 Access Points," Apr. 2, 2002, pp. 1-12, obtained from http://www.microsoft.com/whdc/device/network/802x/AccessPts.mspx.27Most recent Office Action issued by USPTO in copending U.S. Appl. No. 10/458,628 dated Jun. 1, 2007.28Most recent Office Action issued by USPTO in copending U.S. Appl. No. 10/654,417 dated Jun. 18, 2007.29Notice of Allowance from U.S. Appl. No. 10/654,417, dated Apr. 22, 2010.30Office Action dated Dec. 31, 2007 for U.S. Appl. No. 10/654,417.31Office Action dated Nov. 30, 2007 for U.S. Appl. No. 10/458,628.32Office Action in U.S. Appl. No. 10/458,628, mailed Aug. 2, 2010.33Office Action in U.S. Appl. No. 10/458,628, mailed Nov. 16, 2010.34Office Action in U.S. Appl. No. 10/925,155, mailed Oct. 6, 2010.35Office Action issued in U.S. Appl. No. 10/458,628, dated Mar. 24, 2010.36Office Action issued in U.S. Appl. No. 10/654,417, dated Mar. 24, 2010.37Office Action issued in USPTO in copending U.S. Appl. No. 10/458,628 dated Aug. 15, 2008.38Office Action issued in USPTO in copending U.S. Appl. No. 10/458,628 dated Feb. 26, 2009.39Office Action issued in USPTO in copending U.S. Appl. No. 10/458,628 dated Nov. 30, 2007.40Office Action issued in USPTO in copending U.S. Appl. No. 10/458,628 dated Oct. 8, 2009.41Office Action issued in USPTO in copending U.S. Appl. No. 10/654,417 dated Dec. 15, 2006.42Office Action issued in USPTO in copending U.S. Appl. No. 10/654,417 dated Dec. 31, 2007.43Office Action issued in USPTO in copending U.S. Appl. No. 10/654,417 dated Feb. 27, 2009.44Office Action issued in USPTO in copending U.S. Appl. No. 10/654,417 dated Jul. 29, 2008.45Office Action issued in USPTO in copending U.S. Appl. No. 10/654,417 dated Jun. 18, 2007.46Office Action issued in USPTO in copending U.S. Appl. No. 10/654,417 dated Sep. 4, 2009.47Office Action issued in USPTO in copending U.S. Appl. No. 10/925,155 dated Apr. 14, 2009.48Office Action issued in USPTO in copending U.S. Appl. No. 10/925,155 dated Jan. 11, 2010.49Office Action issued in USPTO in copending U.S. Appl. No. 10/925,155 dated Mar. 20, 2008.50Office Action issued in USPTO in copending U.S. Appl. No. 10/925,155 dated Oct. 27, 2008.51Peter J. Welcher, "Switching: MultiLayer Switching", pp. 1-9, 1999.52S. Schmid et al., "An Access Control Architecture for Microcellular Wireless IPv6 Networks," Proceeding of 26th Annual IEEE Conference on Local Computer Networks, 2001, pp. 454-463.53The Institute of Electrical and Electronics Engineers, Inc., "Port-Based Network Access Control", 2001, pp. 1-134.54U.S. Appl. No. 10/925,155, filed Aug. 24, 2004.55U.S. Appl. No. 12/769,626, filed Apr. 28, 2010.56U.S. Appl. No. 12/869,602, filed Aug. 26, 2010.Referenced byCiting PatentFiling datePublication dateApplicantTitleUS8239929Apr 28, 2010Aug 7, 2012Foundry Networks, LlcMultiple tiered network security system, method and apparatus using dynamic user policy assignmentUS8245300Jun 4, 2009Aug 14, 2012Foundry Networks LlcSystem and method for ARP anti-spoofing securityUS8249096Aug 26, 2010Aug 21, 2012Foundry Networks, LlcSystem, method and apparatus for providing multiple access modes in a data communications networkUS8422400 *Oct 30, 2009Apr 16, 2013Cisco Technology, Inc.Method and apparatus for discovering devices in a networkUS8528071Aug 24, 2004Sep 3, 2013Foundry Networks, LlcSystem and method for flexible authentication in a data communications networkUS8533823Feb 25, 2009Sep 10, 2013Foundry Networks, LlcSystem and method for source IP anti-spoofing securityUS8681800May 1, 2012Mar 25, 2014Foundry Networks, LlcSystem, method and apparatus for providing multiple access modes in a data communications networkUS8893256Jun 30, 2010Nov 18, 2014Brocade Communications Systems, Inc.System and method for protecting CPU against remote access attacksUS8918875Jul 18, 2011Dec 23, 2014Foundry Networks, LlcSystem and method for ARP anti-spoofing securityUS20110103257 *Oct 30, 2009May 5, 2011Cisco Technology, Inc.Method and apparatus for discovering devices in a network* Cited by examinerClassifications U.S. Classification370/449, 709/216, 726/4, 726/27International ClassificationH04L12/42RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services