Security extensions using at least a portion of layer 2 information or bits in the place of layer 2 information

• US 8,087,064 B1
• Filed: 07/20/2001
• Issued: 12/27/2011
• Est. Priority Date: 08/31/2000
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Communications Inc.
• Inventors: Baum, Robert T.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US09/910,429
• Time in Patent Office: 3,812 Days
• Field of Search: 713/168, 713/151, 705/73, 726/3
• US Class Current: 726/3
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/324 in the data link layer [OSI layer 2], e.g. HDLC
• CPC Class Codes: H04L 69/325 in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence

Abstract

Using information applied to a packet at an ingress port of a network for enhancing security such as user authentication for example. Such authentication may be applied in addition to (i.e., as an extension of) other authentication measures. The information applied to a packet may be “context information” which replaces at least some bits of layer 2 information (e.g., a header). Users or customers may define security policies. They may define different security policies for different types of transactions. They may also define security policies based on the location from which the transaction originated. If the customer is an organization with different classes of users, it may define different security policies based on the type of transaction, the location from which the transaction originated, and/or the class of user. The class of user may be identified based on at least a part of the “context information”. At least a part of the context information may also be used to monitor a location from which a transaction originated, thereby permitting fraudulent uses to be traced.

Claims

1. A method for authenticating a party to a transaction, the method comprising:

receiving a packet having at least a part of layer 2 header information replaced with a unique bit string;

examining at least a part of the unique bit string;

comparing the at least a part of the unique bit string examined with stored information; and

authenticating the party only if the at least a part of the unique bit string examined matches the stored information;

wherein the at least a part of the unique bit string examined depends on a type of the transaction, the type being a type of financial transaction.

2. The method of claim 1 further comprising:

approving a transaction if the party was authenticated.

3. The method of claim 2 wherein the stored information compared with the at least a part of the unique bit string examined depends on the type of the transaction.

4. The method of claim 1 wherein the type of the transaction is selected from a group of transaction types consisting of:

(A) transactions greater than a predetermined amount;

(B) transactions less than a predetermined amount;

(C) purchases delivered to a credit card billing address; and

(D) purchases delivered to an address other than a credit card billing address.

5. The method of claim 1 wherein the stored information compared with the at least a part of the unique bit string examined depends on a type of the transaction.

6. The method of claim 1 wherein the at least a part of the unique bit string examined identifies a location at which packets from the party to the transaction entered the network.

7. The method of claim 1 wherein the at least a part of the unique bit string examined identifies an individual who is a party to the transaction.

8. The method of claim 1 wherein the at least a part of the unique bit string examined identifies a group to which an individual, who is a party to the transaction, belongs.

9. The method of claim 1 wherein the at least a part of the unique bit string examined identifies a customer that is a party to the transaction.

10. The method of claim 1 wherein the at least a part of the unique bit string identifies at least one of a customer identification, an individual user identification, a network ingress location, and a user class.

11. The method of claim 1 wherein the at least a part of the unique bit string identifies at least two of a customer identification, an individual user identification, a network ingress location, and a user class.

12. The method of claim 1 wherein the at least a part of the unique bit string identifies at least three of a customer identification, an individual user identification, a network ingress location, and a user class.

13. The method of claim 1 wherein the unique bit string is provisioned by a network service provider.

14. The method of claim 1 wherein the unique bit string is controlled by a network service provider.

15. The method of claim 1 wherein the act of authenticating does not require the transmission of any authentication information from the party.

16. The method of claim 1, wherein the layer 2 header information is one of data link layer header and a network access layer header.

17. The method of claim 1, wherein the layer 2 header information is a MAC header.

18. A method for authenticating a party to a transaction, the method comprising:

a) applying a unique bit string to layer 2 header information of packets entering the network, the unique bit string uniquely identifying the party and an ingress location of the network;

b) examining at least a part of the unique bit string;

c) comparing the at least a part of the unique bit string examined with stored information; and

d) approving a transaction only if the at least a part of the unique bit string examined matches the stored information;

wherein the at least a part of the unique bit string examined depends on a type of the transaction, the type being a type of financial transaction.

19. The method of claim 18 wherein the unique bit string is maintained as the packet is communicated within the network.

20. The method of claim 18 wherein the unique bit string identifies a logical port at which the packet entered the network.

21. The method of claim 18 wherein no information in addition to the unique bit string is needed for authenticating the party to the transaction.

22. An apparatus for authenticating a party to a transaction, the apparatus comprising:

a) an input for accepting an authentication request, the authentication request including a packet having at least a part of a layer 2 header information replaced with a unique bit string;

b) storage means for storing authentication information;

c) means for examining at least a part of the unique bit string;

d) a comparison facility for comparing the at least a part of the unique bit string examined with the stored authentication information; and

e) means for authenticating a party to a transaction only if the at least a part of the unique bit string examined matches the stored authentication information;

wherein the at least a part of the unique bit string examined depends on a type of the transaction, the type being a type of financial transaction.

23. The apparatus of claim 22 further comprising:

f) means for approving the transaction if the party was authenticated.

24. The apparatus of claim 23 further comprising:

g) an output for forwarding an authorization response to the transaction facility.

25. The apparatus of claim 22 further comprising:

f) an output for forwarding an authentication response to the transaction facility.