Cisco Technology, Inc.

Digital Equipment Corporation

Aruba Networks, Inc.

Atheros Communications, Inc.

Cisco Systems Inc.

Michael Fine

Thomas James Edsall

Michael R Smith

Norman William Finn

Hon Wah Chin

Dinesh Ganapathy Dutt

Raymond Kloth

Richard J Hausman

Wilson Kok

Padmanabha Nallur

Fabio Rodolfo Maino

Silvano Gai

Keith McCloghrie

Marco Foschiano

Awais Bin Nemat

Santhosh Cheeniyil

Thomas John Nosella

Krishna Prabhakar

Irene H Kuffel

Arthur Zavalkovsky

Andrew Mackinnon Davidson

George Varghese

Kevin Neal Hayes

Richard L Szmauz

Aman Singla

Andrew J Smith

Jed Lin Lau

A method and apparatus for integrating various network access control frameworks under the control of a single policy decision point (PDP). The apparatus supports pluggable protocol terminators to interface to any number of access protocols or backend support services. The apparatus contains Trust and Identity Mediators to mediate between the protocol terminators and a canonical policy subsystem, translating attributes between framework representations, and a canonical representation using extensible data-driven dictionaries.

Method and apparatus for policy-based network access control with arbitrary network access control frameworks

A method and system for the assignment of security group information using a proxy is disclosed. The method includes receiving an address of a network device at a first network device, receiving a security group of the network device at the first network device and associating the address information and the security group information with one another at the first network device. The first network device is coupled to a second network device. The address is represented by address information, which is received from the second network device. The security group is identified using the security group information, which indicates the network device is a member of the security group. The address information and the security group information are associated with one another by storing the address information and the security group information at the first network device.

Method and system for the assignment of security group information using a proxy

A method and system for including security information with a packet is disclosed. A packet is detected as it exits a first network and enters a second network. The first network is configured to support a network security technique, and the second network is not configured to support the network security technique. Network security information associated with the network security technique is included with the packet. A network device is configured to include network security information in overhead of a packet. A method for identifying a first network device in a network is also disclosed. Identification information of the first network is communicated to a second network device.

Method and system for including security information with a packet

Various systems and method are disclosed for disseminating security server contact information in a network. For example, one method (e.g., performed by a security server) involves determining that a network device is a secure network device, in response to participating in a security exchange with the network device; and then sending a server list to the network device. The server list includes the network address of at least one security server. Another method (e.g., performed by a network device) involves initiating an authentication exchange; receiving a server list, which includes the network address of a security server, as part of the authentication exchange; and communicating with the security server by sending a packet to the network address included in the server list.

Method and apparatus for securely disseminating security server contact information in a network

A method and an apparatus are disclosed for securing authentication, authorization and accounting (AAA) protocol messages. An encryption key, a device identifier value, and verification data are received and stored at a network device. The verification data comprises in part a copy the encryption key and the device identifier value, and has been encrypted using a private key of a server. A shared secret is generated by applying a computational function to the encryption key and the device identifier value. Based on the shared secret, a first message integrity check value for a message is generated. The message, the first integrity check value, and the verification data are sent to the server. The server decrypts the verification data using the private key, extracts the encryption key and the device identifier value, and generates the same shared secret by applying the same computational function to the extracted encryption key and device identifier value. Based on this generated shared secret, a second message integrity check value is generated and compared to the received first message integrity check value.

Method and apparatus to secure AAA protocol messages

An access point in a wireless communication system can be configured to include multiple virtual LANS (VLANs) based on security levels, thereby allowing secure traffic to be isolated from insecure traffic. Configuring the access point can include assigning a security level to each VLAN and setting a security association for each station associated with the access point. Based on this security association, each station can be assigned to an appropriate VLAN.

Method for organizing virtual networks while optimizing security

The invention uses a layer 2 switch (L2 switch), or bridge, to separate user's message traffic by use of Virtual Local Area Networks (VLANs) defined within the switch. Three new types of ports are defined, 'promiscuous' ports 'isolated' ports, and &#x201c;community&#x201d; ports. Three types of VLANs internal to the switch are defined, &#x201c;primary&#x201d; VLANs, &#x201c;isolated&#x201d; VLANs and &#x201c;community&#x201d; VLANs. The promiscuous ports are connected to layer 3 or layer 4 devices. Isolated ports and community ports are connected to individual user's servers, etc., and maintain traffic for each user separate from other users. The primary VLAN connects to all promiscuous ports, to all isolated ports, and to all community ports. The primary VLAN is a one way connection from promiscuous ports to isolated or community ports. An isolated VLAN connects to all promiscuous ports and to all isolated ports. The isolated VLAN is a one way connection from an isolated port to the promiscuous ports. A community VLAN is defined as connecting to a group of community ports, and also connecting to all of the promiscuous ports. The group of community ports is referred to as a &#x201c;community&#x201d; of community ports. A community VLAN is a one way connection from a community of ports to the promiscuous ports, but allows a packet received by one community port to be transmitted out of the switch, through the other community ports connected to that community VLAN.

Private VLANs

A method and apparatus for implementing Quality of Service (QoS) policy in a data communications network. A content addressable memory (CAM) contains flow information for each active flow of packets passing through a given node of a data communications network. The CAM has associated with each entry a packet counter, a byte counter, a token bucket, and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. An access control list CAM (ACLCAM) contains masked flow information. The ACLCAM provides an index to internal token bucket counters and preconfigured contract values of an aggregate flow table which becomes affected by the packet statistics. In this way, flows are aggregated for assignment of output queues and thresholds, possible dropping, and possible modification of packets.

Method and apparatus for implementing a quality of service policy in a data communications network

A method and apparatus for implementing Quality of Service (QoS) policy in a data communications network. An active flow content addressable memory (CAM) contains entries of flow information for each active flow of packets passing through a given node of the data communications network. The CAM has associated with each entry a packet counter, a byte counter, a token bucket, and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. A token bucket algorithm is employed on each flow to determine whether packets from that flow exceed the contract value. Such packets may be dropped or optimally modified to reflect an alternate output queue and/or alternate threshold before being sent to the selected output queue for transmission from the node.

A shared spanning tree protocol (SSTP) creates a plurality of spanning trees (i.e., loop-free paths) which are shared among one or more virtual local area network (VLAN) designations for data transmission within a computer network. Each shared spanning tree includes and is defined by a primary VLAN and may be associated with one or more secondary VLANs. In order to associate VLAN designation(s) with a single shared spanning tree, network devices exchange novel shared spanning tree protocol data units (SST-PDUs). Each SST-PDU corresponds to a given primary VLAN and preferably includes one or more fields which list the secondary VLAN designations associated with the given primary VLAN. The association of VLAN designations to shared spanning trees, moreover, preferably depends on which path traffic is to follow as well as the anticipated load characteristics of the various VLANs. The association of VLAN designations to shared spanning trees thus provides a degree of load balancing within the network. Data messages tagged with a particular VLAN designation are then distributed by the devices only along the shared spanning tree to which that VLAN has been associated by SSTP.

Shared spanning tree protocol

A content addressable memory (CAM or L3 Table) contains flow information for each active flow of packets passing through a given node of a data communications network. The CAM has associated with each entry (corresponding to each active flow) a packet counter, a byte counter, a token bucket and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. A token bucket algorithm is employed on each flow to determine whether packets from that flow exceed the contract value. Such packets may be dropped or optimally modified to reflect an alternate output queue and/or alternate threshold before being sent to the selected output queue for transmission from the node. In another aspect an access control list CAM (ACLCAM) contains masked flow information. The ACLCAM provides an index to internal token bucket counters and preconfigured contract values of an aggregate flow table which becomes affected by the packet statistics. In this way flows are aggregated for assignment of output queues and thresholds, possible dropping and possible modification of packets. In another aspect the CAM contains active flow information, the ACLCAM and the aggregate flow table are combined in one system and used to produce in parallel a pair of traffic rate limiting and prioritizing decisions for each packet. The two results are then resolved to yield a single result.

Growing community of inventors

San Francisco, CA, United States of America

Michael Fine