Methods and apparatus for enforcing a common user policy within a network

• US 8,804,620 B2
• Filed: 10/04/2011
• Issued: 08/12/2014
• Est. Priority Date: 10/04/2011
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Murphy, James, Choudhury, Abhijit, Pogde, Pranay, Boddu, Jayabharat, Sindhu, Pradeep, Mallya, Raghavendra, Nanda, Phalguni
• Primary Examiner(s): Riyami, Abdullah
• Assistant Examiner(s): COX, BRIAN P
• Application Number:
  US13/252,856
• Publication Number:
  US 20130083725A1
• Time in Patent Office: 1,043 Days
• Field of Search: 370/328
• US Class Current: 370/328
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 74/002 Transmission of channel access control information
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

In some embodiments, an apparatus includes a core network node configured to be operatively coupled to a set of wired network nodes and a set of wireless network nodes. The core network node is configured to receive, at a first time, a first data packet to be sent to a wired device operatively coupled to a wired network node from the set of wired network nodes. The core network node is configured to also receive, at a second time, a second data packet to be sent to a wireless device operatively coupled to a wireless network node from the set of wireless network nodes. The core network node is configured to apply a common policy to the first data packet and the second data packet based on an identifier of a user associated with both the wireless device and the wired device.

Claims

1. An apparatus, comprising:

a core network node configured to be operatively coupled to a plurality of wired network nodes and a plurality of wireless network nodes, the core network node configured to receive, at a first time, a first data packet to be sent to a wired device operatively coupled to a wired network node from the plurality of wired network nodes,

the core network node configured to receive, at a second time, a second data packet to be sent to a wireless device operatively coupled to a wireless network node from the plurality of wireless network nodes,

the core network node configured to apply a common down-link policy to the first data packet and the second data packet based on an identifier of a user associated with both the wireless device and the wired device,

the core network node configured to send a common up-link policy to the wired network node without sending the common down-link policy to the wired network node such that (1) the wired network node applies the up-link policy to a third data packet received from the wired device based on the identifier of the user, and (2) the wired network node does not apply the down-link policy to data packets to be sent to the wired device,

the core network node configured to send the common up-link policy to the wireless network node without sending the common down-link policy to the wireless network node such that (1) the wireless network node applies the up-link policy to a fourth data packet received from the wireless device based on the identifier of the user, and (2) the wireless network node does not apply the down-link policy to data packets to be sent to the wireless device.

2. The apparatus of claim 1, wherein the core network node is configured to send the up-link policy to the wired network node prior to the first time, the core network node configured to send, during a time period that includes the second time, an instruction to remove the up-link policy from the wired network node.

3. The apparatus of claim 1, wherein the core network node is configured to send the up-link policy to the wireless network node in response to the user connecting to the wireless network node using the wireless device, the core network node is configured to send an instruction to remove the up-link policy from the wireless network node in response to the wireless device disconnecting from the wireless network node.

4. The apparatus of claim 1, wherein the wireless device and the wired device are a single device.

5. The apparatus of claim 1, wherein the wireless device and the wired device are distinct devices.

6. The apparatus of claim 1, wherein the core network node is configured to send, in response to receiving the first data packet, the first data packet to the wired network node via a multiprotocol label switching (MPLS) tunnel through an aggregation network node from the plurality of wired network nodes such that the aggregation network node does not store the common down-link policy or the common up-link policy.

7. The apparatus of claim 1, wherein the core network node includes a policy database that associates the common down-link policy and the common up-link policy with the identifier of the user, the policy database including at least one of an allow list or a deny list associated with access control policies for the user.

8. A non-transitory processor-readable medium storing code representing instructions to cause a processor to:

receive, during a first time period, a first data packet to be sent to a wired device, the wired device being operatively coupled to a first wired network node from a plurality of wired network nodes during the first time period;

apply a policy to the first data packet based on a user identifier being associated with the wired device during the first time period;

send the first data packet to the first wired network node via a multiprotocol label switching (MPLS) tunnel through a second wired network node from the plurality of wired network nodes such that the second wired network node does not store the policy;

receive, during a second time period, a second data packet to be sent to a wireless device, the wireless device being operatively coupled to a wireless network node from a plurality of wireless network nodes; and

apply the policy to the second data packet based on the user identifier being associated with the wireless device during the second time period.

9. The non-transitory processor-readable medium of claim 8, further comprising code representing instructions to cause the processor to:

retrieve the policy from a policy database that associates the policy with the user identifier.

10. The non-transitory processor-readable medium of claim 8, further comprising code representing instructions to cause the processor to:

send an up-link policy to the first wired network node without sending a down-link policy to the first wired network node such that (1) the first wired network node applies the up-link policy to a third data packet received from the wired device based on the user identifier being associated with the wired device during the first time period, and (2) the first wired network node does not apply the down-link policy to data packets to be sent to the wired device; and

send the up-link policy to the wireless network node without sending the down-link policy to the wireless network node such that (1) the wireless network node applies the up-link policy to a fourth data packet received from the wireless device based on the user identifier being associated with the wireless device during the second time period, and (2) the wireless network node does not apply the down-link policy to data packets to be sent to the wireless device.

11. The non-transitory processor-readable medium of claim 8, further comprising code representing instructions to cause the processor to:

send, to the first wired network node during the first time period, an up-link policy such that the first wired network node stores and applies the up-link policy; and

send, to the first wired network node after the first time period, an instruction to remove the up-link policy from a database at the first wired network node.

12. The non-transitory processor-readable medium of claim 8, further comprising code representing instructions to cause the processor to:

restrict the first data packet from being sent to the wired device based on the policy being applied to the first data packet.

13. The non-transitory processor-readable medium of claim 8, wherein the wireless device and the wired device are a single device.

14. The non-transitory processor-readable medium of claim 8, wherein the wireless device and the wired device are distinct devices.

15. A system, comprising:

a wired network node configured to receive, from a core network node, an up-link policy associated with a user, the wired network node configured to receive the up-link policy based on the user being associated with a wired device operatively coupled to the wired network node when the user is associated with the wired device, the wired network node configured to apply the up-link policy to a first data packet received from the wired device prior to sending the first data packet to the core network node, the wired network node configured not to apply, based on the user being associated with the wired device an down-link policy to data packets received from the core network node prior to sending the data packets to the wired device; and

a wireless network node configured to receive, from the core network node, the up-link policy associated with the user, the wireless network node configured to receive the up-link policy based on the user being associated with a wireless device operatively coupled to the wireless network node when the user is associated with the wireless device, the wireless network node configured to apply the up-link policy to a second data packet received from the wireless device prior to sending the second data packet to the core network node, the wireless network node configured not to apply, based on the user being associated with the wireless device, any down-link policy to data packets received from the core network node prior to sending the data packets to the wireless device.

16. The system of claim 15, wherein the wired network node is configured to remove the up-link policy from a policy database at the wired network node a predetermined amount of time after at least one of the user is disassociated with the wired device or the wired device is decoupled from the wired network node, the policy database including at least one of an allow list or a deny list associated with access control policies for the user.

17. The system of claim 15, wherein the wireless network node is configured to send an initiation signal to the core network node prior to receiving the up-link policy from the core network node.

18. The system of claim 15, wherein the wired network node is configured to receive the up-link policy from the core network node via a multiprotocol label switching (MPLS) tunnel through an aggregation network node to which the wired network node is configured to be operatively coupled such that the up-link policy is not stored at the aggregation network node.

19. The system of claim 15, wherein the wired network node includes a policy database that associates the up-link policy with an identifier of the wired device when the user is associated with the wired device, the policy database including at least one of an allow list or a deny list associated with access control policies for the user.

20. The system of claim 15, wherein the wired network node is configured to receive a third data packet from the core network node subsequent the core network node applying a down-link policy associated with the user to the third data packet when the user is associated with the wired device.