System and method for providing access to a network with selective network address translation

• US 7,127,524 B1
• Filed: 12/21/2001
• Issued: 10/24/2006
• Est. Priority Date: 12/29/2000
• Status: Expired due to Term

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Vernier Networks, Inc.
• Inventors: Renda, Gregory L, Cobbs, Archibald L, Jacobson, Van
• Primary Examiner(s): VU, THONG H
• Application Number:
  US10/027,010
• Time in Patent Office: 1,768 Days
• Field of Search: 709238-245, 709/208, 709/229, 709231-236, 709219-228, 710/33, 725/119, 726/15, 370/351, 370/229, 370/254, 370/389, 370/401, 455/439, 715/740
• US Class Current: 709/245
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A system and method controls access to a network. The system and method intercepts communications received from, and responses and other communications to, devices on the network. Communications may be forwarded to their intended destination if the sending device has sufficient privileges to do so, or the communications may be handled by the system and method or forwarded to a different destination (e.g. a printer nearby the access point to which the user is communicating) using network address translation or redirection. Responses are received and stored by the system and method and may be forwarded to the device that sent the original communication, either directly or via a different device that requests the stored communications using a tunnel.

Claims

1. A method of forwarding a communication, comprising:

receiving for each of a plurality of users an indication having one selected from a first state and a second state;

receiving the communication having a source identifier;

retrieving at least one of said indications;

responsive to the at least one indication retrieved having the first state, forwarding the communication with the source identifier received with the communication; and

responsive to the at least one indication retrieved having the second state, forwarding the communication with an alternate source identifier different from the source identifier received with the communication.

2. The method of claim 1 wherein the at least one indication is retrieved responsive to at least one selected from the source identifier and an alternate identifier sent with the communication.

3. The method of claim 2 wherein the alternate identifier comprises a MAC address.

4. The method of claim 1, wherein the source identifier comprises an IP address.

5. The method of claim 1 wherein the communication comprises a packet.

6. The method of claim 1 wherein the alternate source identifier comprises an identifier of a device forwarding the communication.

7. The method of claim 1, wherein the communication is received at a device that provides access to a network for the communication.

8. The method of claim 1, wherein

the forwarding step is performed over a network responsive to the indication retrieved having the first state;

and

the forwarding step is performed over the network responsive to the indication retrieved having the second state.

9. A system for forwarding a communication, comprising:

a privileges requester having a privileges input operatively coupled for receiving for each of a plurality of users, an indication having one selected from a first state and a second state, the privileges requester for providing at an output at least one of the indications;

an access point manager having an input operatively coupled for receiving the communication having at least one selected from a source identifier and an alternate identifier, the access point manager for building and providing at an output a second communication responsive to the first communication; and

a network address translation manager having a communication input coupled to the access point manager for receiving at least a portion of the second communication, and a privileges input coupled to the privileges requester output for receiving the at least one indications, the network address translation manager for providing at an output a third communication comprising;

at least a portion of the source identifier, responsive to at least one of the at least one indications received at the privileges requester input having the first state; and

a third source identifier responsive to at least one of the at least one indications received at the privileges requester input having the second state.

10. The system of claim 9, wherein:

the privileges requester additionally has an identifier input, the at least one of the indications provided at the privileges requester output responsive to the privileges requester identifier input; and

the network address translation manager additionally comprising an identifier output coupled to the privileges requester input, the network address translation manager additionally for providing at the identifier output at least one selected from the source identifier and the alternate identifier.

11. The system of claim 9, wherein the source identifier comprises an IP address.

12. The system of claim 9 wherein the alternate identifier comprises a MAC address.

13. The system of claim 9 wherein the communication comprises a packet.

14. The system of claim 9 wherein the alternate source identifier comprises an identifier of a device forwarding the communication.

15. The system of claim 9, wherein the communication is received at a device that provides access to a network for the communication.

16. The system of claim 9, wherein:

the network address translation manager provides the third communication to a network responsive to the indication retrieved having the second state; and

the network address translation manager provides the third communication to the network responsive to the indication retrieved having the first state.

17. A computer program product comprising a computer useable medium having computer readable program code embodied therein for forwarding a communication, comprising computer readable program code devices configured to cause a computer to:

receive for each of a plurality of users an indication having one selected from a first state and a second state;

receive the communication having a source identifier;

retrieve at least one of said indications;

responsive to the at least one indication retrieved having the first state, forward the communication with the source identifier received with the communication; and

responsive to the at least one indication retrieved having the second state, forward the communication with an alternate source identifier different from the source identifier received with the communication.

18. The computer program product of claim 17 wherein the at least one indication is retrieved responsive to at least one selected from the source identifier and an alternate identifier sent with the communication.

19. The computer program product of claim 18 wherein the alternate identifier comprises a MAC address.

20. The computer program product of claim 17, wherein the source identifier comprises an IP address.

21. The computer program product of claim 17 wherein the communication comprises a packet.

22. The computer program product of claim 17 wherein the alternate source identifier comprises an identifier of a device forwarding the communication.

23. The computer program product of claim 17, wherein the communication is received at a device that provides access to a network for the communication.

24. The computer program product of claim 17, wherein:

the forwarding is performed over a network responsive to the indication retrieved having the first state; and

the forwarding is performed over the network responsive to the indication retrieved having the second state.

25. An apparatus for forwarding a communication, comprising:

means for receiving for each of a plurality of users an indication having one selected from a first state and a second state;

means for receiving the communication having a source identifier;

means for retrieving at least one of said indications; and

means for;

responsive to the at least one indication retrieved having the first state, forwarding the communication with the source identifier received with the communication; and

responsive to the at least one indication retrieved having the second state, forwarding the communication with an alternate source identifier different from the source identifier received with the communication.

26. The apparatus of claim 25, wherein:

the forwarding is performed over a network responsive to the indication retrieved having the first state; and

the forwarding is performed over the network responsive to the indication retrieved having the second state.