System for securing inbound and outbound data packet flow in a computer network

• US 7,373,655 B1
• Filed: 05/19/1999
• Issued: 05/13/2008
• Est. Priority Date: 12/22/1998
• Status: Expired due to Fees

• Current Assignee: American Patents LLC
• Original Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Maria, Arturo
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US09/314,330
• Time in Patent Office: 3,282 Days
• Field of Search: 713200-202, 713/153, 713/160, 713/162, 713/154, 709223-229, 726/15, 726/2, 726/3, 726/4, 726/13
• US Class Current: 726/2
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers

Abstract

A method provides for control of access to network resources. A virtual identity machine resides in the network and is pre-authorized to access certain network resources. End users desiring access to those network resources attempt to logically connect to the virtual identity machines. If the logical connection attempt is successful, then the end user assumes the virtual identity of the virtual identity machine and has access to all of the same information that was available to the virtual identity machine.

Claims

1. A method for providing access control to a web server, the method comprising:

providing a plurality of machines pre-authorized to access the web server;

associating with each pre-authorized machine an access table storing authorization information;

coupling one of the pre-authorized machines to an access requester;

verifying that said requester is authorized to access a resource on the web server with reference to said access table associated with the pre-authorized machine to which the requester is coupled; and

allowing the requester to assume the identity of said pre-authorized machine to which the requester is coupled after verifying that said requester is authorized, and

based on the requester assuming the identity of said pre-authorized machine, allowing the requester access to the resource.

2. The method of claim 1 wherein said plurality of pre-authorized machines includes a first pre-authorized machine that is pre-authorized to access a first subset of resources at the web server and a second authorized machine that is pre-authorized to access a second subset of resources at the web server, wherein said second subset differs from said first subset.

3. The method of claim 1 wherein said plurality of pre-authorized machines includes a first pre-authorized machine that is pre-authorized to access a first subset of resources at the web server and a second pre-authorized machine that is pre-authorized to access a second subset of resources at the web server, wherein said second subset overlaps with said first subset.

4. The method of claim 3 wherein said first and second subsets are identical.

5. A method comprising:

arranging a network element in a network, the network element being pre-authorized to access a set of network resources;

receiving, at the network element, a request from a user to connect to the network element;

determining whether the user is authorized to connect to the network element;

if so, allowing the user to assume the identity of the network element; and

accessing, by the user, one of the set of network resources that the network element is pre-authorized to access, based on the user'"'"'s assuming the identity of the network element.

6. The method of claim 5, wherein the network element is coupled to one or more network servers providing the set of network resources.

7. The method of claim 5, further comprising checking an identity characteristic of the user to determine whether the user is authorized to connect to the network element.

8. A network element, comprising:

a processor;

an authorization database containing logic for execution by the processor, the processor to determine, based on the logic, whether a user is authorized to assume the identity of the network element to gain access to a network resource that the network element is pre-authorized to access;

a port to couple the network element to a user; and

a port to couple the network element to a network resource.

9. The network element of claim 8, wherein the authorization database correlates user identifiers with resources accessible via the network element.