Patent ID: 7877796

Claim:
A method, performed by a network node configured to execute instructions stored in a memory device of said network node, the method comprising: determining whether an association exists, at the network node, between a destination and a reserved group identifier, wherein if said association exists, information indicating said association is maintained at said network node; if said association exists, indicating a packet received at said network node can be sent to another network node, wherein said packet comprises destination information that identifies said destination as a destination of said packet, a group identifier is assigned to a security group of a plurality of security groups, said destination is a member of said security group, and said reserved group identifier is not assigned to any of said security groups; if said association does not exist, determining whether another association exists, at said network node, between said destination and said group identifier, wherein if said another association exists, information indicating said another association is maintained at said network node; and if said another association exists, performing access control processing on said packet.