Cisco Technology, Inc.

Rockstar Consortium US LP

Sean Convery

David R Oran

Ralph Droms

James P Rivers

Mark Stapp

John M Schnizlein

Allan Thomson

Ashish Thusoo

Roy Liang Chua

Andrew Keith Pearce

Charles Rodney Starrett

Matthew Schott Bohmfalk Rodgers

An integrated security platform that enables a wide variety of network security elements to share security information in a comprehensive manner so as to provide automation of policy and security enforcement based on intelligence gathered by the different network security elements. The integrated security information platform provides the ability to clarify security intelligence by simplifying the collection and indexing of security information so that the information is visible and accessible to systems wanting to make use of the security information, without requiring all of the information to be co-resident with the infrastructure of the security platform or requiring the various systems to have pair-wise relationships with one another.

Integrated security platform

In some embodiments, computer systems, storage mediums, and methods are provided for controlling a connecting device's access to a plurality of computer networks. In other embodiments, the provided computer systems, storage mediums, and methods may provide for authentication, authorization, and accounting of connecting devices connecting to a plurality of computer networks. In other embodiments, the provided computer systems, storage mediums, and methods may provide for the distribution of authentication routing data and authorization policies among a plurality of computer networks. In yet other embodiments, the provided computer systems, storage mediums, and methods may provide for the distribution of accounting among a plurality of computer networks.

Distributed authentication, authorization and accounting

Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Role aware network security enforcement

Growing community of inventors

Mountain View, CA, United States of America

Sean Convery