System and method for controlling network access

• US 20060037063A1
• Filed: 08/11/2004
• Published: 02/16/2006
• Est. Priority Date: 08/11/2004
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Viswanathan, Sriram Chittur, Srinivas, TK, Clemmons, Merlon Odell II, Mazumdar, Subrata, Seibel, Robert R.
• Granted Patent: US 7,587,588 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system for controlling network access to products. The system includes a security appliance connected to a product under operational control of a first entity, a product connection platform and a user terminal under operational control of a second entity, the product connection platform being accessed by the user terminal, and a trust relationship established between the first entity and the second entity based on predetermined criteria between the first entity and the second entity, the trust relationship being represented by a certificate or public/private key exchange. Authentication of access by a user of the user terminal of the second entity to the product of the first entity is deferred to the product connection platform of the second entity based on the predetermined criteria of the trust relationship, whereupon if authentication is granted, the user is provided access to the product.

Claims

1. A system for controlling network access, comprising:

a security appliance connected to a product under operational control of a first entity;

a product connection platform and a user terminal under operational control of a second entity, the product connection platform being accessed by the user terminal;

a trust relationship established between the first entity and the second entity based on predetermined criteria between the first entity and the second entity, the trust relationship being represented by a certificate or public/private key exchange,

wherein authentication of access by a user of the user terminal of the second entity to the product of the first entity is deferred to the product connection platform of the second entity based on the predetermined criteria of the trust relationship, whereupon if authentication is granted, the user is provided access to the product.

2. The system for controlling network access according to claim 1, wherein the security appliance and product connection platform are separate from each other and connectable by a secure network connection, whereupon if the access is granted, the user terminal accesses the product over the secure connection.

3. The system for controlling network access according to claim 1, wherein the security appliance includes a first SOCKS server, a policy server, and a product access audit log.

4. The system for controlling network access according to claim 1, wherein the product connection system includes a second SOCKS server.

5. The system for controlling network access according to claim 1, wherein an authentication server and a trouble management system are connected to the product connection system.

6. The system for controlling network access according to claim 1, wherein the product connection system issues an access request, the access request including a trouble ticket number, an identifier of the product, and a role of the user.

7. The system for controlling network access according to claim 1, wherein the first entity and the second entity are the same.

8. The system for controlling network access according to claim 3, wherein the policy server may specify that access to the product requires real-time authorization.

9. A system for controlling network access, comprising:

a security appliance connected to a product under operational control of a first entity;

a user terminal under operational control of a second entity;

a trust relationship established between the first entity and the second entity based on predetermined criteria between the first entity and the second entity, the trust relationship being represented by a certificate or public/private key exchange,

wherein authentication of access by a user of the user terminal of the second entity to the product of the first entity is deferred to the user terminal of the second entity based on the predetermined criteria of the trust relationship, whereupon if authentication is granted, the user is provided access to the product.

10. The system for controlling network access according to claim 9, wherein the user terminal is provided with SOCKS software for communicating with the security appliance.

11. The system for controlling network access according to claim 9, wherein the security appliance includes a first SOCKS server, a policy server, and a product access audit log.

12. The system for controlling network access according to claim 9, wherein the user terminal issues an access request, the access request including a trouble ticket number, an identifier of the product, and a role of the user.

13. The system for controlling network access according to claim 11, wherein the policy server may specify that access to the product requires real-time authorization.

14. A method for controlling network access, comprising the steps of:

establishing a trust relationship between a first and a second entity that is represented by a certificate or public/private key exchange;

a user of the second entity requesting access to a product of the first entity;

deferring to the second entity authentication of the user requesting access to the first entity;

providing access by the user of the second entity to the product of the first entity if authentication is granted,

wherein authentication of the access is granted based on predetermined criteria of the trust relationship.

15. The method for controlling network access according to claim 14, further comprising the step of:

creating and sending an access request to a security appliance of the first entity.

16. The method for controlling network access according to claim 14, further comprising the step of sending the access request over a secure network connection to a SOCKS server.

17. The method for controlling network access according to claim 14, further comprising the steps of:

authorizing and administering access at the local network gateway based upon the predetermined criteria, the predetermined criteria including a user identity, a trouble ticket number and an identity of the product to be accessed.

18. The method for controlling network access according to claim 14, wherein the predetermined criteria may be dynamically controlled by the first entity.

19. The method for controlling network access according to claim 14, further comprising the steps of:

granting authentication on a real-time basis.