Telecommunication access management system for a packet switching network

• US 5,113,499 A
• Filed: 04/28/1989
• Issued: 05/12/1992
• Est. Priority Date: 04/28/1989
• Status: Expired due to Term

• Current Assignee: Sprint International Communications Corp. (Deutsche Telekom AG)
• Original Assignee: Sprint International Communications Corp. (Deutsche Telekom AG)
• Inventors: Spitzer, Roy L., Kay, Douglas E., Bonica, Ronald P., Pashayan, Patricia A., Ankney, Richard C.
• Primary Examiner(s): Heckler, Thomas M.
• Application Number:
  US07/344,905
• Time in Patent Office: 1,110 Days
• Field of Search: 364/200 MS File, 364/900 MS File
• US Class Current: 340/5.74
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/00 Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass networks security protocols H04L9/40; wireless communication networks H04W
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A security access management system for a packet switched data communications network has access management apparatus operatively associated with the packet switches at each entry point of the network. The access management apparatus includes an administrative host processor for examining user terminal authorization information in packets received at the associated packet switch for transmission through the network to destination addresses for the packets. A database associated with the administrative host stores information including levels of authorization of the user terminals for the respective entry point of the network for access to specified destinations, as pre-assigned by the network customer. Also included in the access management apparatus is a validation host processor which responds to comparisons between the user terminal authorization information contained in the packet and the pre-assigned level of authorization for the same user terminal, and, if they correspond, to grant access by that user terminal through the associated packet switch to the destination address with which a communication session is requested; or, if they differ, to deny such access. The access management apparatus is located remote from the user terminals using the particular entry point for the network.

Claims

1. A system for managing access to data among users and host computers in a public data communications network applied to provide data communications paths between and among the users and the host computers via communication links and transmit nodes of the network, in which the nature and degree of access by or to each user and host computer is designated in advance by respective ones of the plurality of network customers who maintain the host computers and who allow authorized user access thereto, said system comprising

a multiplicity of potential user stations,

a multiplicity of host computers for compiling and furnishing data on request of users and other host computers,

a multiplicity of switch means operatively associated with respective ones of said user stations and said host computers, and located at points of entry to said data communications paths of said network remote from said respective ones of said user stations and said host computers, for establishing and disconnecting a communication path through the network between a user station and a host computer to which access is requested by said user station for a communication session therewith, and

access management means operatively associated with each of said switch means for examining requests for establishing a data communications path through said network between a user station and a host computer received by the associated one of said switch means for validation of said requests and for granting and denying the respective requests by issuance of corresponding instruction signals to said switch means, according to the nature and degree of access designated by the respective network customer.

2. The access management system according to claim 1, wherein requests for establishment of a data communications path are generated from said user stations and host computers in the form of a digital signal containing information indicative of the authorization of the requester for the requested access.

3. The access management system according to claim 1, wherein said network is a packet switching network, said user stations have respective packet assemblers/disassemblers operatively associated therewith, and said digital signals are generated in the form of packets containing information representative of the attributes of the user respecting nature and degree of authorization.

4. The access management system according to claim 1, wherein

said access management means includes

validation host computer means coupled to an associated one of said switch means for validating requests for access received thereby,

administrative host computer means coupled to the validation host computer means for monitoring the respective requests, and

relational database means associated with said validation host computer means and said administrative host computer means for storing information regarding authorized users, user attributes including identification data and passwords, and destination addresses to which users shall have access.

5. The access management system according to claim 1, wherein

each of said switch means includes memory means for controlling priority of requested access by the associated ones of said user stations and host computers, and means for transmitting and receiving data to and from said access management means.

6. The access management system according to claim 4, wherein

said administrative host computer means includes

means for recording invalid attempts at obtaining access to a destination address via the switch means associated with the requester, and

said validation host computer means includes

means for commanding the respective switch means to disconnect the requester after a predetermined number of successive invalid attempts at across to that destination address by that requester.

7. A method for upgrading security in a public data communications network to assure that the dictates of each network customer are followed with respect to accessibility by network users via terminals to host computers maintained by the respective network customer, said method comprising

installing at points of entry to data communications links of said network a plurality of switch means for operative association with respective user terminals and host computers but physically remote therefrom, to establish connection and disconnection of data communications link through the network among user terminals and host computers on demand by authorized users,

installing in association with said network an access management host computer and relational database designating authorized users and their attributes and destination addresses to which the various users are authorized access based on said dictates of the network customers, for analyzing requests for access among said users and host computers and issuing instructions respecting establishment of connections and disconnections to the respective switch means based on information contained in said relational database, and

providing a data link between said access management host computer and each of said switch means for communication of access requests and responsive instructions therebetween.

8. In a security access management system for a packet switched data communications network adapted to selectively provide transmission paths for communication sessions between a multiplicity of data terminal equipments (DTEs) located outside the network via communication links and transit nodes within the network through a plurality of packet switches each located at a respective one of a plurality of entry points to the network and associated with one or more of the DTEs for routing packets therefrom and thereto at that entry point, according to the destination DTE address and source DTE authorization information contained within the packets assembled for transmission from a source DTE, and wherein the extent of access between and among a group of the DTEs associated with a particular customer of the network is mandated by that customer such that different DTEs within the same group may be authorized for different levels of access to destinations within the group, the improvement comprising:

plural access management means each respectively operatively associated with a packet switch at an entry point of the network, each access management means including;

administrative means for examining source DTE authorization information contained within packets received at the associated packet switch for transmission through the network to destination addresses for the packets,

database means maintained by the administrative means for storing information relating to pre-assigned levels of authorization of the source DTEs using the respective entry point of the network for access to specified destinations, and

validation means responsive to comparison of the DTE source authorization information contained in a packet under examination by the administrative means to the pre-assigned level of authorization for that source DTE for granting or denying access thereby through the associated packet switch to the destination address with which a communication session is requested.

9. The improvement of claim 8, wherein

the validation means includes means for instructing the associated packet switch by validation signals to permit or prevent passage of packets therethrough from the source DTE to the destination address with which the communication session is requested, according to the determination of grant or denial of access.

10. The improvement of claim 9, wherein

the pre-assigned levels of authorization of the source DTEs within the information stored by the database means includes authorization for at least one source DTE using the respective entry point to have access to a specified destination address for multiple communications sessions therewith, and for at least some of the other source DTEs using that same entry point to the network to have access for only a single communication session with the specified destination address.

11. The improvement of claim 10, wherein

the packet switch is responsive to validation signals from the associated validation means indicative of a source DTE authorized for multiple communication session access to the requested destination address, to inhibit subsequent examination of source DTE authorization information contained within packets received from that source DTE at the packet switch for transmission through the network to that destination address for at least a predetermined interval of time following receipt of such validation signals.

12. The improvement of claim 9, wherein

each access management means is physically located remote from the source DTEs which use the respective entry point to the network of its associated packet switch.