Patent ID: 8613056

Claim:
A data processing apparatus, comprising: a plurality of network interfaces that are coupled to a data network for receiving one or more packets therefrom and sending one or more packets thereto; one or more processors; a switching system coupled to the one or more processors and packet forwarding logic, wherein the switching system and packet forwarding logic are configured to receive packets on a first network interface, determine a second network interface on which to send the packets, and to send the packets on the second network interface; a non-transitory computer-readable storage medium having stored thereon a plurality of authentication methods and a policy that associates the authentication methods with respective message types, and a plurality of user credential location definitions that specify locations of user credentials for various types of application messages; authentication and authorization logic comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform: receiving, by the data processing apparatus, one or more packets containing an application message of OSI layer 5 or above, wherein the application message comprises one or more user credential elements and wherein the one or more packets containing the application message are addressed to an endpoint device other than the data processing apparatus; determining a particular type of the application message; identifying one or more user credential elements in the application message; selecting, based on the policy and the particular type of the application message, a particular authentication method, and validating the application message using the one or more user credential elements and the particular authentication method; wherein identifying the one or more user credential elements includes selecting a particular user credential location definition and performing the identifying based on the particular user credential location definition; wherein the data processing apparatus is a router forwarding data packets below OSI layer 5.