METHOD AND SYSTEM FOR THE ASSIGNMENT OF SECURITY GROUP INFORMATION USING A PROXY

• US 20090049196A1
• Filed: 08/13/2007
• Published: 02/19/2009
• Est. Priority Date: 08/13/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Fine, Michael, Smith, Michael R., Nemat, Awais B.
• Granted Patent: US 7,840,708 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method and system for the assignment of security group information using a proxy is disclosed. The method includes receiving an address of a network device at a first network device, receiving a security group of the network device at the first network device and associating the address information and the security group information with one another at the first network device. The first network device is coupled to a second network device. The address is represented by address information, which is received from the second network device. The security group is identified using the security group information, which indicates the network device is a member of the security group. The address information and the security group information are associated with one another by storing the address information and the security group information at the first network device.

Claims

1. A method comprising:

identifying an address of a network device, wherein

said address is identified using address information;

identifying a security group of said network device, wherein

said security group is identified using said security group information, and

said security group information indicates said network device is a member of said security group; and

sending said address information and said security group information, wherein

said identifying and said sending are performed by a first network device.

2. The method of claim 1, wherein said sending comprises:

sending said address information and said security group information from said first network device to a second network device, wherein

said second network device is configured to associate said address information and said security group information with one another.

3. The method of claim 2, further comprising:

causing said second network device to associate said address information and said security group information by storing said address information and said security group information such that said address information and said security group information are associated with one another.

4. The method of claim 1, wherein said sending comprises:

sending an install message from said first network device to a second network device, wherein

said install message comprises said address information and said security group information, and

said install message is configured to cause said second network device to associate said address information and said security group information.

5. The method of claim 4, further comprising:

if said security group is invalidated, sending a delete message from said first network device to a second network device, wherein

said delete message is configured to cause said second network device to delete said association of said address information and said security group information.

6. The method of claim 5, wherein

said delete message comprises said address information and said security group information.

7. The method of claim 3, further comprising:

receiving a packet from said first network device at said second network device, wherein

packet address information is associated with said packet,

packet address information is address information associated with said network device;

determining if said security group information should be associated with said packet using said packet address information; and

associating said security group information with said packet, if said packet address information indicates that said security group information is associated with said network device.

8. The method of claim 7, further comprising:

associating an address and said security group information with one another, wherein

said address allows said security group information to be associated with said packet.

9. The method of claim 8, wherein

said address is at least one of a media access control address, an internet protocol address and a transport layer port address.

10. The method of claim 7, wherein said associating comprises:

adding said security group information to said packet.

11. The method of claim 10, wherein said adding comprises one of:

inserting said security group information in said packet; and

encapsulating said packet, wherein

said encapsulating comprises one of prepending and appending said security group information to said packet.

12. An apparatus comprising:

a first network device, wherein

said network device is configured to

identifying an address of a network device, wherein

said address is identified using address information,

identifying a security group of a network device, wherein

said security group is identified using said security group information, and

said security group information indicates said network device is a member of said security group; and

sending said address information and said security group information.

13. The apparatus of claim 12, further comprising:

a distribution layer network device, wherein

said network device is an access layer network device,

said distribution layer network device is coupled to receive said address information and said security group information from said access layer network device, and

said distribution layer network device is configured to associate said address information and said security group information.

14. The apparatus of claim 13, wherein

said distribution layer network device is configured to associate said address information and said security group information by virtue of being configured to

store said address information and said security group information such that said address information and said security group information are associated with one another.

15. The apparatus of claim 13, wherein

said access layer network device is configured to cause said distribution layer network device to store said address information and said security group information by virtue of being configured to

send an install message to said distribution layer network device, wherein

said install message comprises said address information and said security group information, and

said install message is configured to cause said distribution layer network device to associate said address information and said security group information.

16. The apparatus of claim 15, wherein

said access layer network device is further configured to send a packet;

and

said distribution layer network device is further configured to receive said packet,

determine if security group information is associated with said packet, and

associate said security group information with said packet, if security group information is not associated with said packet.

17. An apparatus comprising:

a first network device, wherein

said first network device is configured to be coupled to a second network device, and

said first network device is further configured to

receive an address of a network device, wherein

said address is represented by address information, and

said address information is received from said second network device,

receive a security group of said network device, wherein

said security group is identified using said security group information,

said security group information indicates said network device is a member of said security group, and

said security group information is received from said second network device, and

associate said address information and said security group information with one another by storing said address information and said security group information.

18. The apparatus of claim 17, wherein

said network device is further configured to receive a packet from said second network device,

determine if security group information is associated with said packet using address information associated with said packet, and

associate said security group information with said packet using address information associated with said packet, if security group information is not associated with said packet.

19. The apparatus of claim 18, wherein said network device is a distribution layer network device, and said distribution layer network device is further configured to:

determine if security group information should be associated with said packet; and

perform said association of said security group information with said packet only if said security group information should be associated with said packet and said security group information is not associated with said packet, wherein said network device is configured to associate said security group information with said packet by virtue of being configured to add said security group information to said packet.

20. The apparatus of claim 19, further comprising:

an access layer network device, wherein

said second network device is said access layer network device,

said access layer network device is coupled to said distribution layer network device, and

said access layer network device is configured to send said packet to said distribution layer network device.

21. The apparatus of claim 20, wherein said access layer network device is configured to:

identify a security group membership of another network device, wherein

address information is associated with said another network device,

said security group membership indicates said another network device is a member of a security group, and

said security group is identified using said security group information; and

send said address information and said security group information, wherein

said identifying and said sending are performed by said access layer network device.

22. An apparatus comprising:

a first network device, comprising

means for coupling said first network device to a second network device,

means for receiving an address of a network device, wherein

said address is represented by address information, and

said address information is received from said second network device via said means for receiving,

means for receiving a security group of said network device, wherein

said security group is identified using said security group information,

said security group information indicates said network device is a member of said security group, and

said security group information is received from said second network device via said means for receiving, and

means for associating said address information and said security group information with one another comprising means for storing said address information and said security group information.