Patent ID: 6986061

Claim:
A method for providing fine-grained, identity-based access control in a computer networking environment, comprising steps of: establishing a mutually-authenticated connection between a first end device and a second end device using strong cryptographic techniques, wherein the mutually-authenticated connection comprises a first mutually-authenticated network segment between the first end device and a boundary device providing network-layer protection and a second mutually-authenticated network segment between the second end device and the boundary device; extracting a first authenticated identity associated with the first end device and a second authenticated identity associated with the second end device during the step of establishing the mutually-authenticated connection; providing secure communications between a security enforcement function operating in the boundary device and an access control function; providing the extracted first and second authenticated identities, by the security enforcement function, to the access control function; determining access privileges of the first end device and the second end device, by the access control function, based upon the provided extracted identities; securely communicating packet-handling directives from the access control function to the security enforcement function, based upon the determined access privileges; and using the packet-handling directives, by the security enforcement function, to determine whether to forward packets by the first end device on the first network segment to the second end device on the second network segment.