Method and apparatus for user domain based white lists

• US 20060059092A1
• Filed: 08/16/2005
• Published: 03/16/2006
• Est. Priority Date: 09/16/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Manning, Michael, Burshan, Chen Yehezkel, Goldberg, Elad
• Granted Patent: US 8,996,603 B2
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1467 involving prepayment
• CPC Class Codes: H04L 12/1496 involving discounts
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method is disclosed for determining a whether access to host requested by a user is permitted. User identifying information is obtained using any of a variety of techniques. The method includes determining a user domain, which indicates an identity of the user'"'"'s home service provider. A list of hosts is determined based on the home provider. If the requested host is in the list of hosts, then the user is allowed access to the requested host though the user is not authorized. The list of hosts may be determined by one or more attributes from an actual or implied user profile, such as a domain name.

Claims

1. A method of determining whether access to a host requested by a user is permitted after an authorization failure, the method comprising the computer-implemented steps of:

determining a home provider associated with the user;

determining a list of hosts based on the home provider; and

using the list of hosts to determine whether to permit the user to access the requested host.

2. The method of claim 1, wherein the list of hosts comprises a list of permissible hosts, and the step of using the list of hosts to determine whether access to the requested host is permitted comprises determining whether the requested host is in the list of hosts, and if the requested host is in the list of hosts, allowing the user to access the requested host.

3. The method of claim 1, wherein the list of hosts comprises a list of impermissible hosts, and the step of using the list of hosts to determine whether access to the requested host is permitted comprises determining whether the requested host is in the list of hosts, and if the requested host is not in the list of hosts, disallowing the user to access the requested host.

4. The method of claim 1, wherein the step of determining a home provider associated with the user comprises parsing a provider name from the user'"'"'s username.

5. The method of claim 1, Wherein the step of determining a home provider associated with the user comprises using information from the user'"'"'s SIM card to determine a home provider.

6. The method of claim 1, wherein the list of hosts comprises any one of a list of URLs, and a list of network addresses.

7. The method of claim 1, wherein the list of hosts comprises at least one partial domain name associated with the home provider and any host with a URL that has a trailing portion matching the partial domain name is included in the list of hosts.

8. The method of claim 1, wherein the list of hosts includes at least one host through which the user can manage the user'"'"'s account with the home provider.

9. The method of claim 1, additionally comprising the step of:

determining a location associated with the user;

wherein the step of determining a list of hosts based on the home provider additionally comprises determining a list of hosts based on both the home provider and the determined location.

10. The method of claim 1, wherein if a list of hosts based on the home provider cannot be determined or if the home provider cannot be determined, the method additionally comprises the steps of:

determining a location associated with the user;

determining a list of hosts associated with the location; and

using the list of hosts determined by the location to determine whether to permit the user to access the requested host.

11. The method of claim 1, wherein the user is an authenticated user.

12. The method of claim 1, wherein the step of determining a list of hosts comprises looking up a home provider to list of hosts association in a configuration file.

13. The method of claim 1, wherein the user has requested access to the host at a wireless network access point.

14. The method of claim 1, wherein access to the requested host is provided through a transparent proxy.

20. A method as recited in claim 1, wherein the list of hosts is determined based on any one of:

NAC posture parameters;

current time of day;

current date; and

current day of week.

21. A method as recited in claim 1, wherein the list of hosts is determined based on one or more attributes from an actual or implied user profile.

15. A computer readable medium comprising one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to determine whether access to host requested by a user is permitted after an authorization failure by performing the steps of:

determining a home provider associated with the user;

determining a list of hosts based on the home provider; and

using the list of hosts to determine whether to permit the user to access the requested host.

16. The computer-readable medium of claim 15, wherein the list of hosts comprises a list of permissible hosts, and the step of using the list of hosts to determine whether access to the requested host is permitted comprises determining whether the requested host is in the list of hosts, and if the requested host is in the list of hosts, allowing the user to access the requested host.

17. The computer-readable medium of claim 15, wherein the step of determining a home provider associated with the user comprises parsing a provider name from the user'"'"'s username.

18. The computer-readable medium of claim 15, wherein the step of determining a home provider associated with the user comprises using information from the user'"'"'s SIM card to determine a home provider.

19. A method of managing a user session in a wireless network, the method comprising the computer-implemented steps of:

receiving an authentication request from a user

receiving a request from the user for access to a host;

determining that the user is not authorized to access the requested host;

determining a home provider associated with the user;

determining a list of hosts associated with the home provider; and

if the requested host is included in the list of hosts, then connecting the user to the requested host.