System and method for providing access control

• US 20040177276A1
• Filed: 10/10/2003
• Published: 09/09/2004
• Est. Priority Date: 10/10/2002
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: RPX Corporation
• Inventors: MacKinnon, Richard, White, Eric, Looney, Kelly
• Granted Patent: US 8,117,639 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles

Abstract

More particularly, one embodiment of the present invention provides a system of providing network access comprising a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions stored on the storage media, executable by the processor. In one embodiment of the present invention, the computer instructions can be executable to receive a network communication over the first network interface from a user using a user device and determine if the network communication is associated with an authenticated user. If the network communication is not associated with an authenticated user, the computer instructions can be executable to direct the user to an authentication interface. The computer instructions can be further executable to receive credentials from the user and authenticate the user based on the credentials. Another embodiment of the present invention can include a system for providing access to a network that comprises a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions stored on the storage media. The computer instructions can be executable by the processor to receive a user profile and provision a user with access to a network based on the user profile.

Claims

1. A system of providing network access comprising:

a processor;

a first network interface coupled to the processor;

a second network interface coupled to the processor;

a storage media accessible by the processor;

a set of computer instructions stored on the storage media, executable by the processor to;

receive a network communication over the first network interface from a user device associated with a user;

determine if the network communication is associated with an authenticated user;

if the network communication is not associated with an authenticated user, direct the user to an authentication interface;

receive credentials from the user;

authenticate the user based on the credentials,

receive a user profile if the user is authenticated.

2. The system of claim 1, wherein the computer instructions are further operable to monitor a network connected to the first network interface for the network communication.

3. The system of claim 2, wherein the computer instructions are further operable to monitor the network across multiple protocols.

4. The system of claim 1, wherein the network communication comprises an HTTP request and wherein the computer instructions are further executable to:

receive the HTTP request;

send a redirect request to the user device to redirect a web browser to the authentication interface.

5. The system of claim 1, wherein the network communication comprises an email and wherein the computer instructions are further executable to:

receive the email;

determine a protocol for the email;

send a reply email message to the user device directing the user to the authentication interface.

6. The system of claim 1, wherein the computer instructions are further executable to:

determine a network protocol for the network communication;

send a reply to the user device according to the network protocol directing the user to the authentication interface.

7. The system of claim 6, wherein the network protocol is one of HTTP, SMTP, POP, telnet, UDP or FTP.

8. The system of claim 1, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by comparing an identifier associated with the network communication to identifiers associated with authenticated users.

9. The system of claim 8, wherein the identifier comprises an IP address for the user device.

10. The system of claim 8, wherein the identifier comprises a MAC address for the user device.

11. The system of claim 1, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by contacting a federated device.

12. The system of claim 1, wherein the computer instructions are further executable to receive the user profile from an internal source.

13. The system of claim 1, wherein the computer instructions are further executable to:

transmit the credentials to an authentication system; and

receive the user profile from the authentication system if the user is authenticated.

14. The system of claim 1, wherein the computer instructions are further executable to:

provision the user with access to a network connected to the second network interface based on the user profile.

15. The system of claim 14, wherein the computer instructions are further executable to provision the user with access to the network by provisioning user specific bandwidth based on the user profile.

16. The system of claim 15, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.

17. The system of claim 16, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.

18. The system of claim 17, wherein the computer instructions are executable to:

receive a packet;

determine that the traffic control rule applies to the packet based on an identifier extracted from the packet;

apply the traffic control rule to the packet.

19. The system of claim 18, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.

20. The system of claim 14 wherein the computer instructions are further executable to provision the user with access to the network by establishing user specific firewall rules and enforcing the user specific firewall rules.

21. The system of claim 1, wherein the computer instructions are executable to monitor a control session for the user to determine if the user times out.

22. The system of claim 21, wherein the computer instructions are further executable to close the control session if the user times out.

23. A system of providing network access comprising:

a processor;

a first network interface coupled to the processor;

a second network interface coupled to the processor;

a storage media accessible by the processor;

a set of computer instructions stored on the storage media, executable by the processor to;

receive a user profile; and

provision a user on a first network connected to the first network interface with access to a second network connected to the second network interface based on the user profile.

24. The system of claim 23, wherein the computer instructions are further executable to provision the user with access to the second network by provisioning user specific bandwidth to the user based on the user profile.

25. The system of claim 24, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.

26. The system of claim 25, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.

27. The system of claim 26, wherein the computer instructions are executable to:

receive a packet;

determine that the traffic control rule applies to the packet based on an identifier extracted from the packet;

apply the traffic control rule to the packet.

28. The system of claim 27, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.

29. The system of claim 23 wherein the computer instructions are further executable to provision the user with access to the second network by establishing user specific firewall rules and enforcing the user specific firewall rules.

30. The system of claim 23, wherein the user profile comprises one or more attributes that govern the provisioning of user'"'"'s access to the second network.

31. The system of claim 23, wherein the computer instructions are further executable to authenticate the user.

32. A system of providing network access comprising

a set of computer instructions stored on a storage media, executable by a processor to:

receive a network communication over a first network interface from a user device associated with a user;

determine if the network communication is associated with an authenticated user;

if the network communication is not associated with an authenticated user, direct the user to an authentication interface;

receive credentials from the user;

authenticate the user based on the credentials,

receive a user profile if the user is authenticated.

33. The system of claim 32, wherein the computer instructions are further operable to monitor a network for the network communication.

34. The system of claim 33, wherein the computer instructions are further operable to monitor the network across multiple protocols.

35. The system of claim 32, wherein the network communication comprises an HTTP request and wherein the computer instructions are further executable to:

receive the HTTP request;

send a redirect request to the user device to redirect a web browser to the authentication interface.

36. The system of claim 32, wherein the network communication comprises an email and wherein the computer instructions are further executable to:

receive the email;

determine a protocol for the email;

send a reply email message to the user device directing the user to the authentication interface.

37. The system of claim 32, wherein the computer instructions are further executable to:

determine a network protocol for the network communication;

send a reply to the user device according to the network protocol directing the user to the authentication interface.

38. The system of claim 37, wherein the network protocol is one of HTTP, SMTP, POP, telnet, UDP or FTP.

39. The system of claim 32, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by comparing an identifier associated with the network communication to identifiers associated with authenticated users.

40. The system of claim 39, wherein the identifier comprises an IP address for the user device.

41. The system of claim 39, wherein the identifier comprises a MAC address for the user device.

42. The system of claim 32, wherein the computer instructions are executable to determine if the network communication is associated with an authenticated user by contacting a federated device.

43. The system of claim 32, wherein the computer instructions are further executable to receive the user profile from an internal source.

44. The system of claim 32, wherein the computer instructions are further executable to:

transmit the credentials to an authentication system; and

receive the user profile from the authentication system if the user is authenticated.

45. The system of claim 32, wherein the computer instructions are further executable to:

provision the user with access to a network based on the user profile.

46. The system of claim 45, wherein the computer instructions are further executable to provision the user with access to the network by provisioning user specific bandwidth based on the user profile.

47. The system of claim 46, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.

48. The system of claim 47, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.

49. The system of claim 48, wherein the computer instructions are executable to:

receive a packet;

determine that the traffic control rule applies to the packet based on an identifier extracted from the packet;

apply the traffic control rule to the packet.

50. The system of claim 49, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.

51. The system of claim 45 wherein the computer instructions are further executable to provision the user with access to the network by establishing user specific firewall rules and enforcing the user specific firewall rules.

52. The system of claim 32, wherein the computer instructions are executable to monitor a control session for the user to determine if the user times out.

53. The system of claim 52, wherein the computer instructions are further executable to close the control session if the user times out.

54. A system of providing network access comprising:

a set of computer instructions stored on the storage media, executable by the processor to;

receive a user profile;

provision a user with access to a network based on the user profile.

55. The system of claim 54, wherein the computer instructions are further executable to provision the user with access to the network by provisioning user specific bandwidth based on the user profile.

56. The system of claim 55, wherein the computer instructions are further executable to provision user specific bandwidth by establishing a traffic control rule based on the user profile.

57. The system of claim 56, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.

58. The system of claim 57, wherein the computer instructions are executable to:

receive a packet;

determine that the traffic control rule applies to the packet based on an identifier extracted from the packet;

apply the traffic control rule to the packet.

59. The system of claim 58, wherein the computer instructions are further executable to drop the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.

60. The system of claim 54 wherein the computer instructions are further executable to provision the user with access to the network by establishing user specific firewall rules and enforcing the user specific firewall rules.

61. The system of claim 54, wherein the user profile comprises one or more attributes that govern the provisioning of user'"'"'s access to the network.

62. The system of claim 54, wherein the computer instructions are further executable to authenticate the user.

63. A method of providing network access comprising

receiving a network communication over a first network interface from a user using a user device;

determining if the network communication is associated with an authenticated user;

if the network communication is not associated with an authenticated user, directing the user to an authentication interface;

receiving credentials from the user;

authenticating the user based on the credentials, receiving a user profile if the user is authenticated.

64. The method of claim 63, further comprising:

determining a network protocol for the network communication;

sending a reply to the user device according to the network protocol directing the user to the authentication interface.

65. The method of claim 64, wherein the network protocol is one of HTTP, SMTP, POP, telnet, UDP or FTP.

66. The method of claim 63, further comprising determining if a network communication is associated with an authenticated user by comparing an identifier associated with the network communication to identifiers associated with authenticated users.

67. The method of claim 63, further comprising determining if a network communication is associated with an authenticated user by contacting a federated control device.

68. The method of claim 63, further comprising:

transmitting the credentials to an authentication system;

receiving the user profile from the authentication system.

69. A method of providing network access comprising:

receiving a user profile;

provisioning a user with access to a network based on the user profile.

70. The method of claim 69, further comprising establishing a traffic control rule based on the user profile.

71. The method of claim 70, wherein the traffic control rule specifies a maximum upload bandwidth and maximum download bandwidth.

72. The method of claim 70, further comprising:

receiving a packet;

determining that the traffic control rule applies to the packet based on an identifier extracted from the packet;

applying the traffic control rule to the packet.

73. The method of claim 72, further comprising dropping the packet if the packet causes the maximum upload or download bandwidth limits to be exceeded.

74. The method of claim 69, further comprising establishing user specific firewall rules based on the user profile and enforcing the user specific firewall rules.

75. The method of claim 69, wherein the user profile comprises one or more attributes that govern the provisioning of user'"'"'s access to the network.