Apparatus and methods for allocating addresses in a network

• US 6,792,474 B1
• Filed: 03/27/2000
• Issued: 09/14/2004
• Est. Priority Date: 03/27/2000
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Hopprich, John, Waclawsky, John G., Hiller, Dean
• Primary Examiner(s): Burgess, Glenton B.
• Assistant Examiner(s): BARQADLE, YASIN M
• Application Number:
  US09/536,648
• Time in Patent Office: 1,632 Days
• Field of Search: 709/226, 709/245, 709/238, 709/229, 709/227, 709/225, 709/228, 370/392, 370/94, 370/397, 370/409, 370/230
• US Class Current: 709/245
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The system of the invention provides a unique address assignment mechanism and technique that allows an address server such as a DHCP server to receive requests for network addresses from computer systems or other requesting devices. Based on an identity of the requesting computer system, or on another criteria, the address server can select an address for use on the network from either a set of local addresses or one or more sets of guest addresses. If the address server identifies the requesting computer system as a guest computer system, then a guest address selected from at least one set of guest addresses is assigned and provided to that computer system, whereas if the address server identifies the requesting computer system a local computer system then the address server selects and assigns a local address (from the set of local addresses) to the requesting local computer system. Data communications devices in the network can be configured to selectively route data portions sent from computer systems depending upon if those data portions contain guest addresses or not. Selective transport provides, for example, restricted access to certain parts of the network if the data portion contains a guest address. If multiple sets of guest addresses are provided, data communications devices in the network can be configured to provide less restrictive access to data portions containing a guest address from one set of guest addresses, while also providing more restrictive access to data portions containing a guest address from another set of guest addresses. Security is also provided via a robust verification and authentication technique that allows two components to securely verify the identity of each other via key encryption techniques during the exchange of information. Also, an address server in a local network can verify the identify of a requesting computer system from a verification computer system in a remote domain with which the requesting computer system purports to be associated.

Claims

1. A method for assigning an address to a computer system, the method comprising the steps of:

receiving, from a computer system coupled to a first network, a request for an assignment of an address, the request for the assignment of an address received from the computer system in a secure manner that uses key encryption to verify and authenticate the identity of the computer system requesting an assignment of an address;

identifying whether the computer system is allowed access to the first network; and

if the computer system is allowed access to the first network, assigning an address to the computer system by performing the steps of;

identifying, based on non-IP address information, a level of access permitted to the computer system from a plurality of levels of access to the first network, where the plurality of levels of access includes at least two guest levels of access and a local level of access, each level of access from the plurality having a set of addresses to assign in response to the request;

if the computer system is permitted a guest level of access from the plurality of levels of access, assigning a guest address from the sets of addresses for the guest levels of access as the address for the computer system, the guest address indicative of selective transport within the first network;

if the computer system is permitted a local level of access, assigning a local address from the set of addresses for the local level of access as the address for the computer system; and

providing the assigned address to the computer system to allow the computer system to perform data communications on the first network, the assigned address, if a guest address, operative to indicate to a data communication device within the first network that receives data portions containing the quest address to selectively transport the data portions containing the quest address only on routes designated for transport of the data portions containing the quest address.

2. The method of claim 1 wherein the step of identifying a level of access is based on the request for an assignment of the address.

3. The method of claim 1 wherein the step of identifying a level of access includes the steps of:

determining if the computer system purports to be associated with a remote domain of a second network;

communicating with a verification computer system on the second network to verify if the computer system is associated with the remote domain; and

receiving an indication, from the verification computer system on the second network, that indicates if the computer system is associated with the remote domain.

4. The method of claim 3 wherein the step of receiving an indication from the verification computer system on the second network includes the steps of:

obtaining clear text information and a doubly encrypted version of the clear text information in the indication from the verification computer system;

obtaining a public key associated with the verification computer system;

decrypting the doubly encrypted version of the clear text information with a private key of an address server receiving the indication to produce a result and then decrypting the result with the public key of the verification computer system to produce a final result; and

comparing the final result with the clear text information to verify the authenticity and identity of the verification computer system.

5. The method of claim 3 wherein the step of assigning a guest address for the computer system from the at least one set of guest addresses selects a guest address for the computer system from the sets of guest addresses based on an identity of the computer system as specified in the indication received from the verification computer system on the second network.

6. The method of claim 1 wherein the step of assigning a guest address for the computer system from the sets of addresses for guest levels of access includes the steps of:

determining an identity of the computer system requesting an assignment of an address;

selecting one set of guest addresses from the sets of addresses for guest levels of access based on the identity of the computer system requesting an assignment of an address; and

selecting the address for the computer system from the selected one set of guest addresses that is selected from the sets of addresses for guest levels of access.

7. The method of claim 6 wherein:

the plurality of sets of addresses for guest levels of access includes a set of more restrictive guest addresses and a set of less restrictive guest addresses, the less restrictive guest addresses indicative of providing selective transport; and

wherein data communications devices within the first network are configured to provide data transport facilities to a component on the first network for data portions transported in the first network that have a guest address selected from the less restrictive guest addresses, the data transport facilities responsive to the selective transport indication, and are further configured to provide no data transport facilities to the component on the first network for data portions transported in the first network that have a guest address selected from the more restrictive guest addresses.

8. The method of claim 1 further comprising the step of:

propagating the set of addresses for each guest level of access to data communications devices within the first network such that the data communications devices within the first network provide limited transport of data communications messages that use a guest address as specified in the at least one set of guest addresses.

9. The method of claim 1 further comprising the step of:

determining if the computer system coupled to the first network is an untrusted computer system, and if so, providing an indication to the computer system that no address has been assigned for use on the first network.

10. The method of claim 9 wherein the step of determining includes the steps of:

determining a remote domain of a second network with which the computer system purports to be associated; and

determining if the remote domain is different than a local domain of the first network, and if so, identifying the computer system as an un-trusted computer system, and if not, identifying the computer system as a local computer system.

11. The method of claim 9 wherein the step of determining includes the steps of:

determining a remote domain of a second network with which the computer system purports to be associated; and

determining if the remote domain is different than a local domain of the first network, and if so, identifying the computer system as a guest computer system, and if the domain of the computer system is not different than the domain of the first network, identifying the computer system as a local computer system.

12. The method of claim 9 wherein the step of determining if the computer system coupled to the first network is an un-trusted computer system includes the steps of:

determining a domain of a second network with which the computer system purports to be associated;

communicating with a verification computer system on the second network to verify if the computer system is associated with the domain of the second network;

receiving an indication from the verification computer system on the second network that indicates if the computer system is associated with the domain of the second network;

identifying, if the indication indicates that the computer system is associated with the domain of the second network, the computer system as a guest computer system; and

identifying, if the indication indicates that the computer system is not associated with the domain of the second network, that the computer system is an un-trusted computer system.

13. The method of claim 1 wherein the computer system is assigned a guest address which allows the computer system coupled to the first network to send and receive data communications through selective routes established on the first network that provide access only to other computer systems that are not associated with the first network.

14. The method of claim 1 wherein an address server on the first network is a Dynamic Host Control Protocol server and uses a version of the Dynamic Host Control Protocol that employs the steps of receiving, assigning and providing to provide address assignments to guest and local computer systems that are coupled to the first network.

15. The method of claim 1 wherein an address server receives the request for an assignment of an address and wherein the step of receiving includes the steps of:

obtaining clear text information and a doubly encrypted version of the clear text information contained in the request for an assignment of an address from the computer system;

obtaining a public key associated with the computer system;

decrypting the doubly encrypted version of the clear text information with a private key of the receiver of communication to produce a result and then decrypting the result with the public key of the computer system to produce a final result; and

comparing the final result with the clear text information to verify the authenticity and identity of the computer system requesting an assignment of an address.

16. The method of claim 1 wherein the selective access indicated by the guest address is operative to be interpreted by the data communications device for transporting data portions including the guest address by routing the transported data packets on predetermined routes distinct from the local computer network such that the selective access data portions defined by the guest address are prevented from accessing the local computer system.

17. The method of claim 1 further comprising:

identifying a data communications device disposed between the local computer system and at least one guest computer system;

updating routing information in the data communications device with the assigned address, the routing information indicative of the level of access afforded the user and the corresponding restricted transport routes;

determining, for an incoming data portion, an associated address and the corresponding access level;

identifying an indication in the incoming data portion of transport and at least one restricted transport route;

matching, based on the routing information, the associated address with addresses corresponding to the restricted transport route;

restricting, if the routing information does not indicated the associated address as corresponding to the restricted transport route, transport of the data portion; and

receiving, for a second associated address, routing information; and

permitting, if the second associated address corresponds to the restricted transport route, the transport, the restricting of the data portion corresponding to the associated address independent of the permitting transport of the second associated address.

18. An address server computer system comprising:

a network interface coupled to a first network;

a processor;

a memory system encoded with address assignment instructions and encoded with a plurality of sets of guest addresses and a set of local addresses, each set of addresses permitting different access to the first network;

an interconnection mechanism coupling the at least one communication port, the processor, and the memory system; and

wherein the processor performs the address assignment instructions encoded within the memory system to cause the address server to;

(i) receive, via the network interface, a request for an assignment of an address from a computer system coupled to the first network, the request for the assignment of an address received from the computer system in a secure manner that uses key encryption to verify and authenticate the identity of the computer system requesting an assignment of an address;

(ii) determine whether the computer system is allowed to access the first network;

(iii) if the computer system is allowed to access the first network, identify the level of access permitted to the computer system based on non-IP address information;

(iv) assign, within the memory system, a guest address as the address to the computer system selected according to permitted level of access from the plurality of sets of guest addresses if the computer system is identified as a guest computer system, the guest address indicative of selective transport within the first network, and assign a local address as the address to the computer system if the computer system is identified as a local computer system; and

(v) provide, via network interface coupled to a first network, the address assigned to the computer system to the computer system if at least one of a guest address and a local address are assigned to the computer system to allow the computer system to perform data communications on the first network, the assigned address, if a quest address, operative to indicate to a data communication device within the first network that receives data portions containing the guest address to selectively transport the data portions containing the quest address only on routes designated for transport of the data Portions containing the quest address.

19. The address server of claim 18 wherein the processor performs the address assignment instructions encoded within the memory system to cause the address server to determine if the computer system coupled to the first network is at least one of a guest computer system and a local computer system, and if the processor performs the address assignment instructions to determine that the computer system is a guest computer system, the processor selects an address for the computer system from the plurality of sets of guest addresses encoded in the memory system, and if the processor performs the address assignment instructions to determine that the computer system is a local computer system, the processor selects an address for the computer system from a set of local addresses encoded in the memory system.

20. The address server of claim 19 wherein when the processor performs the address assignment instructions encoded within the memory system to determine if the computer system coupled to the first network is at least one of a guest computer system and a local computer system, the processor further performs the address assignment instructions to cause the address server to:

determine if the computer system purports to be associated a remote domain of a second network that is coupled to the first network;

communicate, via the network interface on the first network, with a verification computer system on the second network to verify if the computer system is associated with the remote domain of the second network; and

receive an indication, via the network interface on the first network, from the verification computer system on the second network, that indicates if the computer system is associated with the remote domain of the second network.

21. The address server of claim 19 wherein when the processor selects an address for the computer system from the plurality of sets of guest addresses, the processor further performs the address assignment instructions to cause the address server to:

determine an identity of the computer system requesting an assignment of an address;

select one set of guest addresses from the plurality of sets of guest addresses based on the identity of the computer system requesting an assignment of an address; and

select the address for the computer system from the selected one set of guest addresses that is selected from the plurality of sets of guest addresses.

22. A computer program product having a computer-readable medium including computer program logic encoded thereon for assigning an address to a computer system, such that the computer program logic, when executed on at least one processor with a computerized device, causes the at least one processor to perform the steps of:

receiving, from a computer system coupled to the first network, a request for an assignment of an address, the request for the assignment of an address received from the computer system in a secure manner that uses key encryption to verify and authenticate the identity of the computer system requesting an assignment of an address;

identifying whether the computer system is allowed access to the first network; and

if the computer system is allowed access to the first network, assigning an address to the computer system by performing the steps of;

identifying, based on non-IP address information, a level of access permitted to the computer system from a plurality of levels of access to the first network, where the plurality of levels of access includes at least two guest levels of access and a local level of access, each level of access from the plurality having a set of addresses to assign in response to the request;

if the computer system is permitted a guest level of access, assigning a guest address from the sets of addresses for the permitted guest levels of access as the address for the computer system, the guest address indicative of selective transport within the first network;

if the computer system is permitted a local level of access, assigning a local address as the address for the computer system; and

providing the assigned address to the computer system to allow the computer system to perform data communications on the first network, the assigned address, if a guest address, operative to indicate to a data communication device within the first network that receives data portions containing the guest address to selectively transport the data portions containing the guest address only on routes designated for transport of the data portions containing the guest address.

23. The computer program product of claim 22 wherein the computer program logic that performs the step of determining further includes computer program logic that when executed, causes the processing unit to perform the steps of:

determining if the computer system purports to be associated a remote domain of a second network;

communicating with a verification computer system on the second network to verify if the computer system is associated with the remote domain; and

receiving an indication, from the verification computer system on the second network, that indicates if the computer system is associated with the remote domain.

24. The computer program product of claim 23 wherein the computer program logic that performs the step of receiving an indication from the verification computer system on the second network further includes computer program logic that when performed on the processing unit, causes the processing unit to perform the steps of:

obtaining clear text information and a doubly encrypted version of the clear text information in the indication from the verification computer system;

obtaining a public key associated with the verification computer system;

decrypting the doubly encrypted version of the clear text information with a private key of an address server receiving the indication to produce a result and then decrypting the result with the public key of the verification computer system to produce a final result; and

comparing the final result with the clear text information to verify the authenticity and identity of the verification computer system.

25. The computer program product of claim 22 wherein the computer program logic that performs the step of selecting an address for the computer system from the plurality of sets addresses permitted a guest level of access further includes computer program logic that when performed on the processing unit, causes the processing unit to perform the steps of:

determining an identity of the computer system requesting an assignment of an address;

selecting one set of guest addresses from the plurality of sets of addresses for guest levels of access based on the identity of the computer system requesting an assignment of an address; and

selecting the address for the computer system from the selected one set of guest address that is selected from the plurality of sets of addresses for guest levels of access.

26. A method for providing to a computer system access to a network, the method comprising the steps of:

receiving, from the computer system coupled to the network, a request for access to the network, the request for the assignment of an address received from the computer system in a secure manner that uses key encryption to verify and authenticate the identity of the computer system requesting an assignment of an address, and further including a hostname of the computer system operable to Provide a computer system identity;

determining the computer system identity of the computer system;

determining based on the computer system identity whether the computer system is allowed access to the network; and

if the computer system is allowed access to the network, assigning an IP address to the computer system by performing the steps of;

a) determining, based on the computer system identity, a level of access permitted to the computer system from a plurality of levels of access to the, network where the plurality of levels of access includes at least two guest levels of access and a non-guest level of access, each level of access in the plurality having a set of IP addresses from which to select the IP address to assign in response to the request;

b) if the computer system is permitted a guest level of access from the plurality of levels of access, assigning a guest address from the sets of IP addresses for the guest levels of access to the computer system;

c) if the computer system is permitted a non-guest level of access, assigning a secure user address from the set of IP addresses for the non-guest level of access to the computer system; and

d) providing the assigned IP address to the computer system to allow the computer system to perform data communications on the network.

27. The method of claim 26 wherein the method of determining a computer system identity further comprises the steps of:

deriving from the request a remote network domain to which the computer system claims association, the remote network domain providing a computer system identity; and

communicating with a verification computer system at the remote network to verify the computer system identity.

28. The method of claim 26 wherein the request from the computer system is a broadcast message on the network.

29. The method of claim 26 wherein the request from the computer system includes a previously assigned network address to provide the computer system identification.

30. The method of claim 26 wherein the network is a local network under the management and control of a single entity, wherein the non-guest level of access to the network is a local level and wherein the secure user address is a local IP address.

31. The method of claim 26 further comprising the step of providing a limited number of routes in the network to the computer system permitted a guest level of access.

32. The method of claim 26 wherein the guest address is indicative of selective transport within the first network, and wherein determining further comprises that the assigned address, if a guest address, is operative to indicate to a data communication device within the first network that receives data portions containing the guest address to selectively transport the data portions containing the guest address only on routes designated for transport of the data portions containing the guest address.