Enterasys Networks, Inc.

Extreme Networks, Inc.

James P Richmond

David L Kjendal

Steven A Pettit

Brian Stanley Locke

Paula Jane Dunigan

David Scott Grieve

Christopher McClain

Steven Charles Bir

Daniel Timothy Murphy

John Roese

A user is enabled to edit a table defining a view of a network object database, for example, a MIB. The user can select from among a plurality of network object types and select from among a plurality of columns of the table. At least one column of the table is specified by the user and edited to represent a network object type specified by the user. The view definition can be extracted from the application and transported to another device where it can be edited and/or viewed using a suitable application. Such portable view definition may be defined as part of a document, for example, a document formatted in accordance with a markup language, such as XML. Such document may include information for requesting objects to populate the view, which may be used to construct requests (e.g., SNMP requests) to retrieve objects from one or more network devices.

Editing a portable, dynamic and abstract view definition of a network object database

The present invention provides a method and system for controlling usage of network resources on a communications network. The method comprising acts of: (a) creating one or more packet rules for analyzing packets received at one or more devices of the communications network, each rule including a condition and action to be taken if a packet received at a device satisfies the condition; and (b) creating one or more service abstractions associated with a user of the communication network, each service abstraction representing a named set of one or more of the packet rules. In some embodiments one or more role abstractions may be created, each role abstraction representing a role of a user with respect to the communications network, and each role abstraction including a set of one or more packet rules, and possibly one or more service abstractions.

Creating, modifying and storing service abstractions and role abstractions representing one or more packet rules

A user interface enables a user to concurrently select a plurality of network objects of a network object database (e.g., a MIB) from a same network device or different network devices and specify a value, only once, to which to set the selected objects. The user can initiate setting of the selected objects on the one or more devices by specifying only once that the objects on such devices be set to the specified value. The user interface, which may include a GUI, may be configured to enable the user to specify a value for a cell of a first table ('editing table'), in response to which a plurality of cells of a second table ('primary table') are set equal to the specified value. The primary table may represent a view of a network object database, each column of the view representing an object type of the network object database.

User interface for editing objects of a network object database

Controlling a user's usage of network resources, after the user has been authenticated, without using any network resources beyond the user's entry point to the network. A plurality of users may be connected to an entry point of a network of a network device by a shared transmission medium. Each users' usage of network resources is controlled, after such user has been authenticated, without using any network resources beyond such user's entry point to the network. For each one or more users, packet rules may be provisioned to the user's entry point to the network, where such entry point may be shared with other users. The packet rules may be applied to each packet received from the user before any network resources beyond the entry point are used. These packet rules may be associated with an identity of the user and then provisioned to the user's entry point in response to the user being authenticated. If a plurality of users are connected to an entry point by a shared transmission medium, packet rules associated with the users may be provisioned to the entry point and applied to packets received from the users before any network resources beyond the entry point are used. Such packet rules may be provisioned to a number of network entry devices and may serve as a distributed firewall for users of a network, as opposed to a centralized firewall. An entry port module of a network entry device may be configured based on an identity of one or more users as a result of the authentication of the one or more users, respectively, and each packet received from each user may be examined to control usage of network resources by the user.

Controlling concurrent usage of network resources by multiple users at an entry point to a communications network based on identities of the users

A user's usage of network resources is controlled, after the user has been authenticated, without using any network resources beyond the user's entry point to the network. Packet rules may be provisioned to the user's entry point to the network, and the packet rules may be applied to each packet received from the user before any network resources beyond the entry point are used. These packet rules may be associated with an identity of the user and then provisioned to the user's entry point in response to the user being authenticated. Usage of network resources of a communications network by a user beyond a network device of the communications network that serves as the user's entry point to the communications network is controlled. The port module of the network device is configured with one or more packet rules corresponding to an identity of the user. A packet is received from a device used by the user at the port module, and, before using any of the network resources beyond the network device, the one or more packet rules are applied to the received packet. Another embodiment is provided for controlling usage of network resources of a communications network by a user. The user has an assigned role with respect to the communications network, and the assigned role is associated with one or more packet rules, each packet rule including a condition and action to be taken if a packet received at a device satisfies the condition. A packet including identification information of the user is received from a device of the user at a port module of a network device. The assigned role of the user is determined based on the identification information, and the port module is configured with the one or more packet rules associated with the assigned role of the user.

Growing community of inventors

Newfields, NH, United States of America

James P Richmond