Resource Identifier Based Access Control in an Enterprise Network

• US 20080077697A1
• Filed: 09/26/2006
• Published: 03/27/2008
• Est. Priority Date: 09/26/2006
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Sundararajan, Mukund, Chu, Christopher, Rozensky, Ronald S., Seibel, Robert Rhea
• Granted Patent: US 8,218,435 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

An entry in an authentication database of an enterprise network is activated responsive to generation of an alarm by a corresponding product that is part of a set of internal resources of the enterprise network. A dynamic URL or other resource identifier based on the activated entry is supplied to an external service provider associated with the product. The external service provider is granted access to the product responsive to submission of the resource identifier by the service provider.

Claims

1. A method for use in controlling access to an enterprise network of a communication system, the method comprising the steps of:

temporarily activating an entry in an authentication database of the enterprise network responsive to generation of an alarm by a corresponding product that is part of a set of internal resources of the enterprise network;

supplying a resource identifier based on the activated entry to an external service provider associated with the product; and

granting the external service provider access to the product responsive to submission of the resource identifier by the service provider.

2. The method of claim 1 wherein the external service provider comprises a technician device equipped with a browser and the browser is operative to utilize the resource identifier to obtain access to the product.

3. The method of claim 2 wherein the technician device comprises one of a computer and a mobile communications device.

4. The method of claim 1 wherein the resource identifier comprises a uniform resource locator having an associated user name and password.

5. The method of claim 1 wherein the entry comprises a virtual private network user entry indicating an authorized user of a virtual private network through which the product is accessible.

6. The method of claim 1 wherein the supplying step further comprises supplying the resource identifier to a ticketing system of the external service provider.

7. The method of claim 1 wherein the supplying step further comprises supplying the resource identifier to the external service provider in encrypted form.

8. The method of claim 7 wherein the resource identifier is encrypted using a public key of the product.

9. The method of claim 8 wherein the external service provider has a private key for decrypting the resource identifier.

10. The method of claim 1 wherein the product requests the temporary activation of the entry in the authentication database of the enterprise network in conjunction with generation of the alarm.

11. The method of claim 6 wherein the ticketing system of the external service provider generates a ticket for servicing the alarm and sends the ticket to a technician device along with the resource identifier.

12. The method of claim 1 further comprising the step of deactivating the entry in the authentication database of the enterprise network after the alarm has been processed by the external service provider.

13. The method of claim 1 further including the step of disabling the resource identifier after a single access by the external service provider to the product.

14. The method of claim 1 further including the step of specifying at least one of a limited duration for use of the resource identifier and a limited number of accesses obtainable using the resource identifier.

15. The method of claim 1 wherein the activating, supplying and granting steps are implemented at least in part in software running on a processing element of the system.

16. An article of manufacture comprising a machine-readable storage medium containing software code, wherein the software code when executed by a processing element of the system performs the steps of the method of claim 1.

17. An apparatus for use in a communication system, the apparatus comprising:

at least one processing element comprising a processor coupled to a memory, the processing element being operative to temporarily activate an entry in an authentication database of the enterprise network responsive to generation of an alarm by a corresponding product that is part of a set of internal resources of the enterprise network;

wherein a resource identifier based on the activated entry is supplied to an external service provider associated with the product; and

wherein the external service provider is granted access to the product responsive to submission of the resource identifier by the service provider.

18. The apparatus of claim 17 wherein the resource identifier comprises a uniform resource locator having an associated user name and password.

19. The apparatus of claim 17 wherein the entry comprises a virtual private network user entry indicating an authorized user of a virtual private network through which the product is accessible.

20. A system comprising:

an enterprise network comprising a set of internal resources including at least one product; and

a service provider external to the enterprise network;

wherein at least one processing element associated with the enterprise network is operative to temporarily activate an entry in an authentication database of the enterprise network responsive to generation of an alarm by the product;

wherein a resource identifier based on the activated entry is supplied to the external service provider; and

wherein the external service provider is granted access to the product responsive to submission of the resource identifier by the service provider.