Method and system for including network security information in a frame

• US 8,561,140 B2
• Filed: 05/13/2010
• Issued: 10/15/2013
• Est. Priority Date: 11/23/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Finn, Norman W., Smith, Michael R.
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US12/779,212
• Publication Number:
  US 20100223657A1
• Time in Patent Office: 1,251 Days
• Field of Search: 726/3, 713/160
• US Class Current: 726/3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method and apparatus for including network security information in a frame is disclosed. Network security information is included in a secure portion of overhead of a frame. The network security information is configured to facilitate network security. A network device configured to process a frame is also disclosed. The frame includes frame security information and network security information. The frame security information is configured to facilitate securing a portion of overhead of the frame, and the network security information is located in the secure portion of the overhead of the frame and is configured to facilitate network security.

Claims

1. A method comprising:

authenticating an address and identifier combination, wherein

the address/identifier combination is a combination of a network address and a logical network identifier;

retrieving retrieved network security information;

assigning the retrieved network security information to the address/identifier combination;

accessing forwarding information;

determining network security information to be associated with a frame, wherein

the frame is sourced by a network device, and

the network security information is determined based on a result of the accessing; and

determining frame security information, wherein

the frame security information is configured to facilitate security of an overhead portion of the frame,

the overhead portion of the frame comprises the network security information, and

the frame security information is configured to prevent access to the overhead portion of the frame.

2. The method of claim 1, wherein

the forwarding information is a forwarding table,

the accessing comprises

searching a plurality of entries of the forwarding table, and

identifying an entry of the entries, and

the entry comprises the network security information to be associated with the frame.

3. The method of claim 2, wherein

the network address is a media access control (MAC) address,

the logical network identifier is a virtual local area network (VLAN) identifier,

the address/identifier combination is for an entity coupled to a port,

the retrieved network security information is for the entity,

the retrieved network security information is retrieved from a host, and

the assigning assigns the retrieved network security information to a combination of the MAC address and VLAN identifier.

4. The method of claim 1, further comprising:

including the network security information in the frame, wherein

the network security information is included in the overhead portion of the frame; and

including the frame security information in the frame.

5. The method of claim 4, further comprising:

sending the frame with the network security information to a second network device.

6. The method of claim 5, further comprising:

processing the frame by

accessing the network security information; and

determining the network access permitted to the frame, wherein

the network access permitted to the frame is determined by accessing security policies for the frame, and

the security policies for the frame are defined in a user group permissions list associated with the network security information of the frame.

7. The method of claim 1, wherein the network security information comprises a security group tag.

8. An apparatus comprising:

means for authenticating an address and identifier combination, wherein

the address/identifier combination is a combination of a network address and a logical network identifier;

means for retrieving retrieved network security information;

means for assigning the retrieved network security information to the address/identifier combination;

means for accessing forwarding information;

means for determining network security information to be associated with a frame, wherein

the frame is sourced by a network device, and

the network security information is determined based on a result of the accessing; and

means for determining frame security information, wherein

the frame security information is configured to facilitate security of an overhead portion of the frame,

the overhead portion of the frame comprises the network security information, and

the frame security information is configured to prevent access to the overhead portion of the frame.

9. The apparatus of claim 8, wherein

the forwarding information is a forwarding table,

the means for accessing comprises

means for searching a plurality of entries of the forwarding table, and

means for identifying an entry of the entries, and

the entry comprises the network security information to be associated with the frame.

10. The apparatus of claim 9, wherein

the network address is a media access control (MAC) address,

the logical network identifier is a virtual local area network (VLAN) identifier,

the address/identifier combination is for an entity coupled to a port,

the retrieved network security information is for the entity,

the retrieved network security information is retrieved from a host, and

the means for assigning is configured to assign the retrieved network security information to a combination of the MAC address and VLAN identifier.

11. The apparatus of claim 8, further comprising:

means for including the network security information in the frame, wherein

the network security information is included in the overhead portion of the frame; and

means for including frame security information in the frame.

12. The apparatus of claim 11, further comprising:

means for sending the frame with the network security information to a second network device.

13. The apparatus of claim 12, further comprising:

means for processing the frame, wherein the means for processing comprises

means for accessing the network security information; and

means for determining the network access permitted to the frame, wherein

the network access permitted to the frame is determined by accessing security policies for the frame, and

the security policies for the frame are defined in a user group permissions list associated with the network security information of the frame.

14. The apparatus of claim 8, wherein the network security information comprises a security group tag.

15. A non-transitory computer program product, comprising:

a first set of instructions, executable on a computer system, configured to

authenticate an address and identifier combination, wherein

the address/identifier combination is a combination of a network address and a logical network identifier;

a second set of instructions, executable on the computer system, configured to retrieve retrieved network security information;

a third set of instructions, executable on the computer system, configured to assign the retrieved network security information to the address/identifier combination;

a fourth set of instructions, executable on the computer system, configured to access forwarding information;

a fifth set of instructions, executable on the computer system, configured to determine network security information to be associated with a frame, wherein

the frame is sourced by a network device, and

the network security information is determined based on a result of accessing the forwarding information;

a sixth set of instructions, executable on the computer system, configured to determine frame security information, wherein

the frame security information is configured to facilitate security of an overhead portion of the frame,

the overhead portion of the frame comprises the network security information, and

the frame security information is configured to prevent access to the overhead portion of the frame; and

computer readable media, wherein the computer program product is encoded in the computer readable media.

16. The non-transitory computer program product of claim 15, wherein

the forwarding information is a forwarding table,

the fourth set of instructions, executable on the computer system, further comprises

a first subset of instructions, executable on the computer system, configured to search a plurality of entries of the forwarding table, and

a second subset of instructions, executable on the computer system, configured to identify an entry of the entries, and

the entry comprises the network security information to be associated with the frame.

17. The non-transitory computer program product of claim 16, wherein

the network address is a media access control (MAC) address,

the logical network identifier is a virtual local area network (VLAN) identifier,

the address/identifier combination is for an entity coupled to a port,

the retrieved network security information is for the entity,

the retrieved network security information is retrieved from a host, and

the retrieved network security information is assigned to a combination of the MAC address and VLAN identifier.

18. The non-transitory computer program product of claim 15, further comprising:

a seventh set of instructions, executable on the computer system, configured to include the network security information in a frame, wherein

the network security information is included in the overhead portion of the frame; and

a eighth set of instructions, executable on the computer system, configured to include frame security information in the frame.

19. The non-transitory computer program product of claim 18, further comprising:

a ninth set of instructions, executable on the computer system, configured to process the frame, wherein the ninth set of instructions further comprises

a first subset of instructions, executable on the computer system, configured to access the network security information; and

a second subset of instructions, executable on the computer system,

configured to determine the network access permitted to the frame, wherein

the network access permitted to the frame is determined by accessing security policies for the frame, and

the security policies for the frame are defined in a user group permissions list associated with the network security information of the frame.

20. The non-transitory computer program product of claim 15, wherein the network security information comprises a security group tag.