Patent ID: 7814311

Claim:
An apparatus comprising: a network interface that is configured to be coupled to a network for receiving one or more packet flows therefrom; a processor; and memory storing executable instructions which, when executed by the processor, cause the processor to carry out the steps of: generating a first binding between a first source address and one or more roles of a user accessing the network via a device coupled to the network, wherein the first source address is currently assigned to the device for a lease time of a dynamic host configuration protocol (DHCP) lease, wherein the first binding comprises a timeout value that is based on the lease time; distributing the first binding associated with the first source address to a filter node; before the first binding expires, receiving a request to release the DHCP lease; preventing the DHCP release from resulting in a first DHCP reassignment of the first source address before the first binding expires and for a time determined based, at least in part, on the timeout value; determining that the same user is associated with a new source address; responsive to the determining that the same user is associated with the new source address, generating a new binding to associate the new source address with the same one or more roles of the same user; distributing the new binding to the filter node; and preventing a second DHCP reassignment of the new source address before the new binding expires; wherein the first source address is a first Internet Protocol (IP) address and the new source address is a new IP address.