Patent ID: 8156325

Claim:
A data processing apparatus comprising: a network interface that is configured to couple to a network for receiving one or more packet flows therefrom; one or more processors; a non-transitory computer readable medium having stored thereon one or more sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform: receiving and storing bindings that associate source addresses to respective roles of users that access the network; receiving packets; determining if the stored bindings comprise an existing binding associated with a source address in a first packet of the packets; responsive to a determination that the stored bindings do not comprise the existing binding associated with the source address in the first packet of the packets, transmitting, on a path between the data processing apparatus and a first device, a request for the existing binding associated with the source address, wherein the source address is assigned to the first device; wherein the transmitting causes the request to be intercepted, on the path between the data processing apparatus and the first device, by a second device that stores the existing binding; wherein the determining and transmitting are performed without identifying the second device storing the existing binding on the path between the data processing apparatus and the first device; receiving and storing the existing binding provided by the second device, wherein the existing binding associates the source address to one or more roles of users that access the network; and processing the first packet in accordance with the one or more roles bound to the source address in the first packet.