Method and apparatus for best effort propagation of security group information

• US 20060106750A1
• Filed: 11/16/2004
• Published: 05/18/2006
• Est. Priority Date: 11/16/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Smith, Michael R.
• Granted Patent: US 7,877,796 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/56 Packet switching systems
• CPC Class Codes: H04L 45/52 Multiprotocol routers
• CPC Class Codes: H04L 49/35 Switches specially adapted for specific applications
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/00 Network arrangements or protocols for supporting network services or applications user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method and system for best effort propagation of security group information is disclosed. The method includes determining if a reserved group identifier is associated with a destination and, if the reserved group identifier is associated with the destination, indicating that a packet received at a network node can be sent to another network node. The packet includes destination information that identifies the destination as a destination of the packet.

Claims

1. A method comprising:

determining if a reserved group identifier is associated with a destination; and

if said reserved group identifier is associated with said destination, indicating a packet received at a network node can be sent to another network node, wherein

said packet comprises destination information that identifies said destination as a destination of said packet.

2. The method of claim 1, wherein

said indicating indicates that access control processing will not be performed on said packet at said network node.

3. The method of claim 2, wherein

said indicating indicates that said packet should be sent to said another network node.

4. The method of claim 3, wherein

said another network node is a next network node in a route to said destination which is to be taken by said packet.

5. The method of claim 2, further comprising:

receiving said packet at said network node; and

if said indicating indicates that said reserved group identifier is associated with said destination, sending said packet to said another network node.

6. The method of claim 5, wherein

said another network node is a next network node in a route to said destination which is to be taken by said packet.

7. The method of claim 1, further comprising:

determining if a group identifier is associated with said destination, wherein said group identifier is other than said reserved group identifier.

8. The method of claim 7, further comprising:

if said group identifier is associated with said destination, performing access control processing on said packet.

9. The method of claim 8, wherein

said access control processing is performed using a role-based access control list.

10. The method of claim 8, further comprising:

if said group identifier is not associated with said destination, performing said indicating.

11. The method of claim 7, wherein said group identifier is one of a plurality of group identifiers, and further comprising:

determining if any of said group identifiers is associated with said destination, wherein

said group identifiers are other than said reserved group identifier; and

if none of said group identifiers are associated with said destination, performing said indicating.

12. The method of claim 7, further comprising:

determining if a null identifier is associated with said destination, wherein

said null group identifier is other than said group identifier and said reserved group identifier; and

if said null group identifier is associated with said destination, dropping said packet.

13. The method of claim 1, wherein said reserved group identifier is one of a plurality of group identifiers, and further comprising:

if said network node is an egress node and said destination is not associated with any of said group identifiers,

requesting a group identifier, wherein

said destination is a member of a group identified by said group identifier;

receiving said group identifier; and

associating said group identifier with said destination.

14. The method of claim 13, further comprising:

if said group identifier is a member of a super-group, associating a super-group identifier with said destination.

15. A computer program product comprising:

a first set of instructions, executable on a computer system, configured to determine if a reserved group identifier is associated with a destination;

a second set of instructions, executable on said computer system, configured to indicate a packet received at a network node can be sent to another network node, if said reserved group identifier is associated with said destination, wherein

said packet comprises destination information that identifies said destination as a destination of said packet; and

computer readable media, wherein said computer program product is encoded in said computer readable media.

16. The computer program product of claim 15, wherein

said second set of instructions is configured to indicate that access control processing will not be performed on said packet at said network node.

17. The computer program product of claim 16, wherein

said second set of instructions is configured to indicate that said packet should be sent to said another network node.

18. The computer program product of claim 17, wherein

said another network node is a next network node in a route to said destination which is to be taken by said packet.

19. The computer program product of claim 16, further comprising:

a third set of instructions, executable on said computer system, configured to receive said packet at said network node; and

a fourth set of instructions, executable on said computer system, configured to send said packet to said another network node, if said second set of instructions indicate that said reserved group identifier is associated with said destination.

20. The computer program product of claim 19, wherein

said another network node is a next network node in a route to said destination which is to be taken by said packet.

21. The computer program product of claim 15, further comprising:

a third set of instructions, executable on said computer system, configured to determine if a group identifier is associated with said destination, wherein said group identifier is other than said reserved group identifier.

22. The computer program product of claim 21, further comprising:

a fourth set of instructions, executable on said computer system, configured to perform access control processing on said packet, if said group identifier is associated with said destination.

23. The computer program product of claim 22, wherein

said fourth set of instructions use a role-based access control list.

24. The computer program product of claim 22, further comprising:

a fifth set of instructions, executable on said computer system, configured to cause said second set of instructions to be executed, if said group identifier is not associated with said destination.

25. The computer program product of claim 21, wherein said group identifier is one of a plurality of group identifiers, further comprising:

a fourth set of instructions, executable on said computer system, configured to determine if a null identifier is associated with said destination, wherein

said null group identifier is other than said group identifier and said reserved group identifier; and

a fifth set of instructions, executable on said computer system, configured to drop said packet, if said null group identifier is associated with said destination.

26. The computer program product of claim 21, wherein said group identifier is one of a plurality of group identifiers, further comprising:

a fourth set of instructions, executable on said computer system, configured to determine if any of said group identifiers is associated with said destination, wherein

said group identifiers are other than said reserved group identifier; and

a fifth set of instructions, executable on said computer system, configured to cause said second set of instructions to be executed, if none of said group identifiers are associated with said destination.

27. An apparatus comprising:

means for determining if a reserved group identifier is associated with a destination; and

means for indicating a packet received at a network node can be sent to another network node, if said reserved group identifier is associated with said destination, wherein

said packet comprises destination information that identifies said destination as a destination of said packet.

28. The apparatus of claim 27, wherein

said means for indicating is configured to indicate that access control processing will not be performed on said packet at said network node.

29. The apparatus of claim 28, wherein

said means for indicating is configured to indicate that said packet should be sent to said another network node.

30. The apparatus of claim 29, wherein

said another network node is a next network node in a route to said destination which is to be taken by said packet.

31. The apparatus of claim 28, further comprising:

means for receiving said packet at said network node; and

means for sending said packet to said another network node, if said means for indicating indicates that said reserved group identifier is associated with said destination.

32. The apparatus of claim 31, wherein

said another network node is a next network node in a route to said destination which is to be taken by said packet.

33. The apparatus of claim 27, further comprising:

means for determining if a group identifier is associated with said destination, wherein said group identifier is other than said reserved group identifier.

34. The apparatus of claim 33, further comprising:

means for performing access control processing on said packet, if said group identifier is associated with said destination.

35. The apparatus of claim 34, wherein

said access control processing is performed using a role-based access control list.

36. The apparatus of claim 34, further comprising:

means for causing said means for indicating to indicate said packet can be sent to said another network node, if said group identifier is not associated with said destination.

37. The apparatus of claim 33, wherein said group identifier is one of a plurality of group identifiers, and further comprising:

means for determining if any of said group identifiers is associated with said destination, wherein

said group identifiers are other than said reserved group identifier; and

means for causing said means for indicating to indicate said packet can be sent to said another network node, if none of said group identifiers are associated with said destination.

38. The apparatus of claim 33, further comprising:

means for determining if a null identifier is associated with said destination, wherein

said null group identifier is other than said group identifier and said reserved group identifier; and

means for dropping said packet, if said null group identifier is associated with said destination.

39. A method comprising:

receiving a group identifier;

determining if another group identifier is associated with a destination, wherein

said group identifier and said another group identifier are different from one another; and

if said another group identifier is associated with said destination, associating a reserved group identifier with said destination.

40. The method of claim 39, further comprising:

if said another group identifier is associated with said destination, disassociating said another group identifier from said destination.

41. The method of claim 39, further comprising:

if said another group identifier is associated with said destination, and said group identifier and said another group identifier are in a super-group, associating a super-group identifier with said destination.

42. The method of claim 39, further comprising:

determining if any of a plurality of group identifiers is associated with a destination, wherein

said group identifiers comprise said group identifier and said another group identifier.

43. The method of claim 42, further comprising:

if none of said group identifiers is associated with said destination, associating said group identifier with said destination.

44. The method of claim 42, further comprising:

if one of said group identifiers is associated with said destination and said one of said group identifiers is other than said group identifier, performing said associating said reserved group identifier with said destination.

45. The method of claim 44, wherein

said group identifiers comprise said reserved group identifier.

46. The method of claim 42, wherein

said destination is a destination of a route.

47. The method of claim 42, wherein

if a plurality of said group identifiers is associated with said destination and each of said plurality of said group identifiers is in a super-group, associating a super-group identifier with said destination.

48. The method of claim 39, further comprising:

if said another group identifier is not associated with said destination, associating said group identifier with said destination.

49. The method of claim 48, further comprising:

if said another group identifier is not associated with said destination and said group identifier is in a super-group, associating a super-group identifier with said destination.

50. The method of claim 48, further comprising:

determining if said reserved group identifier is associated with said destination; and

if said reserved group identifier is associated with said destination, indicating a packet received at a network node can be sent to another network node, wherein

said packet comprises destination information that identifies said destination as a destination of said packet.

51. The method of claim 50, wherein

said indicating indicates that access control processing will not be performed on said packet at said network node.

52. The method of claim 51, further comprising:

receiving said packet at said network node; and

if said indicating indicates that said reserved group identifier is associated with said destination, sending said packet to said another network node.

53. The method of claim 50, further comprising:

determining if one of a plurality of group identifiers is associated with said destination, wherein

said one of a plurality of group identifiers is other than said reserved group identifier.

54. The method of claim 53, further comprising:

if said one of a plurality of group identifiers is associated with said destination, performing access control processing on said packet.

55. The method of claim 54, further comprising:

if said one of a plurality of group identifiers is not associated with said destination, performing said indicating.

56. A computer program product comprising:

a first set of instructions, executable on a computer system, configured to receive a group identifier;

a second set of instructions, executable on said computer system, configured to determine if another group identifier is associated with a destination, wherein

said group identifier and said another group identifier are different from one another;

a third set of instructions, executable on said computer system, configured to associate a reserved group identifier with said destination, if said another group identifier is associated with said destination; and

computer readable media, wherein said computer program product is encoded in said computer readable media.

57. The computer program product of claim 56, further comprising:

a fourth set of instructions, executable on said computer system, configured to determine if any of a plurality of group identifiers is associated with a destination, wherein

said group identifiers comprise said group identifier and said another group identifier.

58. The computer program product of claim 57, further comprising:

a fifth set of instructions, executable on said computer system, configured to associate said group identifier with said destination, if none of said group identifiers is associated with said destination.

59. The computer program product of claim 57, further comprising:

a fifth set of instructions, executable on said computer system, configured to cause said third set of instructions to be executed, if one of said group identifiers is associated with said destination and said one of said group identifiers is other than said group identifier.

60. The computer program product of claim 59, wherein

said group identifiers comprise said reserved group identifier.

61. The computer program product of claim 56, further comprising:

a fourth set of instructions, executable on said computer system, configured to associate said group identifier with said destination, if said another group identifier is not associated with said destination

62. The computer program product of claim 61, further comprising:

a fifth set of instructions, executable on said computer system, configured to determine if said reserved group identifier is associated with said destination; and

a sixth set of instructions, executable on said computer system, configured to indicate a packet received at a network node can be sent to another network node, if said reserved group identifier is associated with said destination, wherein

said packet comprises destination information that identifies said destination as a destination of said packet.

63. The computer program product of claim 62, wherein

said sixth set of instructions indicate that access control processing will not be performed on said packet at said network node.

64. The computer program product of claim 63, further comprising:

a seventh set of instructions, executable on said computer system, configured to receive said packet at said network node; and

a eighth set of instructions, executable on said computer system, configured to send said packet to said another network node, if said sixth set of instructions indicate that said reserved group identifier is associated with said destination.

65. The computer program product of claim 62, further comprising:

a seventh set of instructions, executable on said computer system, configured to determine if one of a plurality of group identifiers is associated with said destination, wherein

said one of a plurality of group identifiers is other than said reserved group identifier.

66. The computer program product of claim 65, further comprising:

a eighth set of instructions, executable on said computer system, configured to perform access control processing on said packet, if said one of a plurality of group identifiers is associated with said destination.

67. The computer program product of claim 66, further comprising:

a ninth set of instructions, executable on said computer system, configured to cause said sixth set of instructions to be executed, if said one of a plurality of group identifiers is not associated with said destination

68. An apparatus comprising:

means for receiving a group identifier;

means for determining if another group identifier is associated with a destination, wherein

said group identifier and said another group identifier are different from one another; and

means for associating a reserved group identifier with said destination, if said another group identifier is associated with said destination.

69. The apparatus of claim 68, further comprising:

means for determining if any of a plurality of group identifiers is associated with a destination, wherein

said group identifiers comprise said group identifier and said another group identifier.

70. The apparatus of claim 69, further comprising:

means for associating said group identifier with said destination, if none of said group identifiers is associated with said destination.

71. The apparatus of claim 69, further comprising:

means for performing said associating said reserved group identifier with said destination, if one of said group identifiers is associated with said destination and said one of said group identifiers is other than said group identifier.

72. The apparatus of claim 71, wherein

said group identifiers comprise said reserved group identifier.

73. The apparatus of claim 68, further comprising:

means for associating said group identifier with said destination, if said another group identifier is not associated with said destination.

74. The apparatus of claim 73, further comprising:

means for determining if said reserved group identifier is associated with said destination; and

means for indicating a packet received at a network node can be sent to another network node, if said reserved group identifier is associated with said destination, wherein

said packet comprises destination information that identifies said destination as a destination of said packet.

75. The apparatus of claim 74, wherein

said means for indicating is configured to indicate that access control processing will not be performed on said packet at said network node.

76. The apparatus of claim 75, further comprising:

means for receiving said packet at said network node; and

means for sending said packet to said another network node, if said means for indicating indicates that said reserved group identifier is associated with said destination.

77. The apparatus of claim 74, further comprising:

means for determining if one of a plurality of group identifiers is associated with said destination, wherein

said one of a plurality of group identifiers is other than said reserved group identifier.

78. The apparatus of claim 77, further comprising:

means for performing access control processing on said packet, if said one of a plurality of group identifiers is associated with said destination.

79. The apparatus of claim 78, further comprising:

means for performing said indicating, if said one of a plurality of group identifiers is not associated with said destination.