METHOD AND APPARATUS FOR POLICY-BASED NETWORK ACCESS CONTROL WITH ARBITRARY NETWORK ACCESS CONTROL FRAMEWORKS

• US 20130042002A1
• Filed: 07/13/2012
• Published: 02/14/2013
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Krishna Prabhakar, Michael Fine, Santhosh Cheeniyil
• Inventors: Cheeniyil, Santhosh, Fine, Michael, Prabhakar, Krishna
• Granted Patent: US 8,713,639 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and apparatus for integrating various network access control frameworks under the control of a single policy decision point (PDP). The apparatus supports pluggable protocol terminators to interface to any number of access protocols or backend support services. The apparatus contains Trust and Identity Mediators to mediate between the protocol terminators and a canonical policy subsystem, translating attributes between framework representations, and a canonical representation using extensible data-driven dictionaries.

Claims

1. A method comprising:

receiving a first request;

determining a first set of one or more attributes in a first protocol based on the first request;

translating the first set of attributes from the first protocol to a canonical form;

applying policy rules to the first set of attributes in the canonical form to determine whether to grant the first request;

receiving a second request;

determining a second set of one or more attributes in a second protocol based on the second request, the second protocol being different than the first protocol;

translating the second set of attributes from the second protocol to the canonical form;

applying policy rules to the second set of attributes in the canonical form to determine whether to grant the second request;

wherein the method is performed using at least one device comprising a hardware processor.

2. The method of claim 1, further comprising:

based on the first set of attributes in the canonical form, gathering a first information using a first protocol;

translating the first information into the canonical form;

based on the first set of attributes in the canonical form, gathering a second information using a second protocol;

translating the second information into the canonical form.

3. The method of claim 1, wherein the first protocol is a RADIUS protocol and wherein the second protocol is a TACACS+ protocol.

4. The method of claim 1, wherein the translating of the first set of attributes and translating of the second set of attributes is performed using a single database comprising a plurality of conversion dictionaries.

5. The method of claim 1, wherein the translating the first set of attributes and the second set of attributes is performed by a single translation device.

6. A method comprising:

receiving a first request;

determining one or more attributes based on the first request;

translating the one or more attributes into a canonical form;

based on the one or more attributes in the canonical form, gathering information from at least two different devices;

translating the information into the canonical form;

wherein the method is performed using at least one device comprising a hardware processor.

7. The method of claim 6, wherein gathering information comprises gathering a first information from a first device using a first protocol and gathering a second information from a second device using a second protocol.

8. The method of claim 6, wherein gathering information comprises a single device gathering a first information from a first device using a first protocol and gathering a second information from a second device using a second protocol.

9. A method comprising:

receiving a first request;

determining one or more attributes based on the first request;

translating the one or more attributes into a canonical form;

based on the one or more attributes in the canonical form, gathering a first information using a first protocol;

translating the first information into the canonical form;

based on the one or more attributes in the canonical form, gathering a second information using a second protocol;

translating the second information into the canonical form;

wherein the method is performed using at least one device comprising a hardware processor.

10. The method of claim 9, further comprising:

applying policy rules to the one or more attributes in the canonical form based on the first information and the second information to determine a policy result.

11. The method of claim 9, wherein the translating of the first information and translating of the second information is performed by a single translation device.

12. The method of claim 9, wherein the first protocol is an audit protocol and the second protocol is an identity protocol.

13. A non-transitory computer readable medium comprising instructions which when executed by one or more processors causes performance of:

receiving a first request;

determining a first set of one or more attributes in a first protocol based on the first request;

translating the first set of attributes from the first protocol to a canonical form;

applying policy rules to the first set of attributes in the canonical form to determine whether to grant the first request;

receiving a second request;

determining a second set of one or more attributes in a second protocol based on the second request, the second protocol being different than the first protocol;

translating the second set of attributes from the second protocol to the canonical form;

applying policy rules to the second set of attributes in the canonical form to determine whether to grant the second request.

14. The computer readable medium of claim 13, further comprising:

based on the first set of attributes in the canonical form, gathering a first information using a first protocol;

translating the first information into the canonical form;

based on the first set of attributes in the canonical form, gathering a second information using a second protocol;

translating the second information into the canonical form.

15. The computer readable medium of claim 13, wherein the first protocol is a RADIUS protocol and wherein the second protocol is a TACACS+ protocol.

16. The computer readable medium of claim 13, wherein the translating of the first set of attributes and translating of the second set of attributes is performed using a single database comprising a plurality of conversion dictionaries.

17. The computer readable medium of claim 13, wherein the translating the first set of attributes and the second set of attributes is performed by a single translation device.

18. A non-transitory computer readable medium comprising instructions which when executed by one or more processors causes performance of:

receiving a first request;

determining one or more attributes based on the first request;

translating the one or more attributes into a canonical form;

based on the one or more attributes in the canonical form, gathering information from at least two different devices;

translating the information into the canonical form.

19. The computer readable medium of claim 18, wherein gathering information comprises gathering a first information from a first device using a first protocol and gathering a second information from a second device using a second protocol.

20. The computer readable medium of claim 18, wherein gathering information comprises a single device gathering a first information from a first device using a first protocol and gathering a second information from a second device using a second protocol.

21. A non-transitory computer readable medium comprising instructions which when executed by one or more processors causes performance of:

receiving a first request;

determining one or more attributes based on the first request;

translating the one or more attributes into a canonical form;

based on the one or more attributes in the canonical form, gathering a first information using a first protocol;

translating the first information into the canonical form;

based on the one or more attributes in the canonical form, gathering a second information using a second protocol;

translating the second information into the canonical form.

22. The computer readable medium of claim 21, further comprising:

applying policy rules to the one or more attributes in the canonical form based on the first information and the second information to determine a policy result.

23. The computer readable medium of claim 21, wherein the translating of the first information and translating of the second information is performed by a single translation device.

24. The computer readable medium of claim 21, wherein the first protocol is an audit protocol and the second protocol is an identity protocol.