NETWORK USER IDENTIFICATION AND AUTHENTICATION

• US 20140208394A1
• Filed: 09/21/2012
• Published: 07/24/2014
• Est. Priority Date: 09/22/2011
• Status: Active Grant

• Current Assignee: Russell Stuart Goodwin
• Original Assignee: Russell Stuart Goodwin
• Inventors: Goodwin, Russell S.
• Granted Patent: US 9,699,158 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method of identifying and authenticating a network user includes receiving a first network layer packet from a first user entity. The first network layer packet may include first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet. The method further includes verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information.

Claims

1. A method of identifying and authenticating a network user comprising:

receiving a first network layer packet from a first user entity, the first network layer packet including first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet; and

verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information.

2. The method of claim 1, further comprising:

receiving a second network layer packet from a second user entity, the second network layer packet associated with the first network address and including second unique identification information unique to the second user entity and independent of the first network address; and

verifying, at the network layer of the network, that the second network layer packet is from the second user entity based on the second unique identification information.

3. The method of claim 1, further comprising:

receiving a second network layer packet from the first user entity, the second network layer packet associated with a second network address different from the first network address and including the first unique identification information; and

verifying, at the network layer of the network, that the second network layer packet is from the first user entity based on the first unique identification information.

4. The method of claim 1, further comprising verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a key shared by the first user entity and an authentication domain configured to perform the verifying.

5. The method of claim 1, further comprising verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a public/private key pair authentication scheme.

6. The method of claim 1, further comprising applying a policy to the received first network layer packet based on the first unique identification information.

7. The method of claim 6, further comprising allowing or disallowing receipt of the first network layer packet at an intended destination endpoint based on the application of the policy.

8. The method of claim 6, further comprising applying the policy anywhere in a path between the first user entity and an intended destination endpoint.

9. The method of claim 6, further comprising applying the policy at a plurality of points included in a path between the first user entity and an intended destination point.

10. The method of claim 1, further comprising associating a malicious attack with the first user identification information.

11. The method of claim 1, further comprising identifying the first user entity based on the first user identification information after verifying that the first network layer packet is from the first user entity without re-verifying that the first network layer packet is from the first user entity.

12. The method of claim 1, further comprising verifying that the first network layer packet is from the first user entity based on the unique identification information before allowing an application layer connection with an intended destination endpoint.

13. The method of claim 1, further comprising allowing an application layer connection with an intended destination endpoint based on the unique identification information.

14. The method of claim 13, further comprising maintaining the application layer connection with the destination endpoint based on the unique identification information.

15. A processor configured to execute computer instructions to cause a system to perform operations for identifying and authenticating a network user, the operations comprising:

receiving a first network layer packet from a first user entity, the first network layer packet including first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet; and

verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information.

16. The processor of claim 15, wherein the operations further comprise:

receiving a second network layer packet from a second user entity, the second network layer packet associated with the first network address and including second unique identification information unique to the second user entity and independent of the first network address; and

verifying, at the network layer of the network, that the second network layer packet is from the second user entity based on the second unique identification information.

17. The processor of claim 15, wherein the operations further comprise:

receiving a second network layer packet from the first user entity, the second network layer packet associated with a second network address different from the first network address and including the first unique identification information; and

verifying, at the network layer of the network, that the second network layer packet is from the first user entity based on the first unique identification information.

18. The processor of claim 15, wherein the operations further comprise verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a key shared by the first user entity and an authentication domain configured to perform the verifying.

19. The processor of claim 15, wherein the operations further comprise verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a public/private key pair authentication scheme.

20. The processor of claim 15, wherein the operations further comprise applying a policy to the received first network layer packet based on the first unique identification information.

21. The processor of claim 20, wherein the operations further comprise allowing or disallowing receipt of the first network layer packet at an intended destination endpoint based on the application of the policy.

22. The processor of claim 20, wherein the operations further comprise applying the policy anywhere in a path between the first user entity and an intended destination endpoint.

23. The processor of claim 20, wherein the operations further comprise applying the policy at a plurality of points included in a path between the first user entity and an intended destination point.

24. The processor of claim 15, wherein the operations further comprise associating a malicious attack with the first user identification information.

25. The processor of claim 15, wherein the operations further comprise identifying the first user entity based on the first user identification information after verifying that the first network layer packet is from the first user entity without re-verifying that the first network layer packet is from the first user entity.

26. The processor of claim 15, wherein the operations further comprise verifying that the first network layer packet is from the first user entity based on the unique identification information before allowing an application layer connection with an intended destination endpoint.

27. The processor of claim 15, wherein the operations further comprise allowing an application layer connection with an intended destination endpoint based on the unique identification information.

28. The processor of claim 27, wherein the operations further comprise maintaining the application layer connection with the destination endpoint based on the unique identification information.