Patent ID: 8700891

Claim:
A method comprising: receiving, via an ingress port of a network device, a data packet that includes a payload portion and a destination network address; determining if the data packet, as received, includes a security tag, in a first protocol format, that includes a role based authentication tag; and if the data packet, as received, includes a security tag that includes a role based authentication tag; determining whether or not a next network device, in a network path towards the destination network address, is configured to support a data packet that includes a security tag in the first protocol format, if so, generating, in the first protocol format, a first protocol-formatted security tag that includes the role based authentication tag and associating the first protocol-formatted security tag with the payload portion of the data packet if not, generating, in a second protocol format, a second protocol-formatted security tag that includes the role based authentication tag and associating the second protocol-formatted security tag with the payload portion of the data packet, and transmitting, via an egress port of the network device and without a determination of privileges associated with the role base authentication tag, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.