Method and system for including network security information in a frame

• US 9,461,979 B2
• Filed: 10/11/2013
• Issued: 10/04/2016
• Est. Priority Date: 11/23/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Finn, Norman W., Smith, Michael R.
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US14/051,854
• Publication Number:
  US 20150106896A1
• Time in Patent Office: 1,089 Days
• Field of Search: 713155-159
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method and apparatus for including network security information in a frame is disclosed. Network security information is included in a secure portion of overhead of a frame. The network security information is configured to facilitate network security. A network device configured to process a frame is also disclosed. The frame includes frame security information and network security information. The frame security information is configured to facilitate securing a portion of overhead of the frame, and the network security information is located in the secure portion of the overhead of the frame and is configured to facilitate network security.

Claims

1. A method comprising:

receiving an authentication request at an authentication server, wherein

the authentication server is configured to receive the authentication request from a network device by virtue of comprising a network interface configured to be communicatively coupled to the network device,

the authentication request comprises

an identifier, and

the identifier is configured to identify an entity requesting authentication via the network device;

authenticating the entity, wherein

the authenticating comprises

determining network security information for the entity, wherein the determining uses the identifier,

the network security information comprises a user group identifier,

the user group identifier is configured to be used to maintain security of a network to which the network device is communicatively coupled, by virtue of being configured to be included in a secure portion of a frame, and

the secure portion of the frame is secured using frame security information of the frame; and

sending a response to the network device via the network interface, wherein

the response comprises

the network security information.

2. The method of claim 1, further comprising:

including the network security information in the frame, wherein

the entity is a host computer,

the frame is sourced by the host computer, and

the host computer is communicatively coupled to the network device.

3. The method of claim 2, wherein

the network security information is included in the secure portion of the frame by virtue of being included in a first portion of the frame, wherein

the first portion is within an overhead portion of the frame.

4. The method of claim 1, wherein

the network security information is determined based on a result of accessing a forwarding table.

5. The method of claim 1, wherein

the entity is one of a user or a host computer.

6. The method of claim 1, wherein

the authentication request further comprises

the entity is a host computer, and

an address of the host computer, and

the method further comprises

assigning the network security information to a combination of the address and the identifier.

7. The method of claim 6, further comprising:

receiving the frame at the

network device;

accessing forwarding information, wherein

the forwarding information is stored at the network device, and

the forwarding information comprises

the network security information,

the address, and

the identifier; and

determining that the network security information is to be associated with the frame, wherein

the network security information is determined based on a result of the accessing.

8. The method of claim 7, wherein

the forwarding information is a forwarding table,

the accessing comprises

searching a plurality of entries of the forwarding table, and

identifying an entry of the entries, and

the entry comprises the network security information.

9. The method of claim 6, further comprising:

authenticating the combination of the address and the identifier, wherein the identifier is a logical network identifier; and

retrieving the network security information using the combination of the address and the identifier.

10. The method of claim 9, further comprising:

determining the frame security information, wherein

the frame security information is configured to facilitate security of an overhead portion of the frame,

the overhead portion of the frame comprises the network security information, and

the frame security information is configured to prevent access to the overhead portion of the frame.

11. The method of claim 10, wherein

the address is a media access control (MAC) address,

the logical network identifier is a virtual local area network (VLAN) identifier,

the combination of the address and the identifier identifies the entity as being coupled to a port of the network device,

the network security information is retrieved from a host computer, and

the assigning assigns the network security information to a combination of the MAC address and the VLAN identifier.

12. The method of claim 10, further comprising:

including the network security information in the frame, wherein

the network security information is included in the overhead portion of the frame; and

including the frame security information in the frame.

13. The method of claim 12, further comprising:

sending the frame with the network security information to another network device, wherein

the another network device is comprised in or coupled to the network.

14. The method of claim 13, further comprising:

processing the frame by

accessing the network security information; and

determining network access permitted to the frame, wherein

the network access permitted to the frame is determined by accessing security policies for the frame, and

the security policies for the frame are defined in a user group permissions list associated with the network security information of the frame.

15. A computer networking system comprising:

an authentication server, comprising

a processor,

a network interface, coupled to the processor,

a non-transitory computer-readable storage medium, coupled to the processor, and

a plurality of instructions, encoded in the non-transitory computer-readable storage medium and configured to cause the processor to

receive an authentication request at an authentication server, wherein

 

the authentication server is configured to receive the authentication request from a network device by virtue of comprising a network interface configured to be communicatively coupled to the network device,

 

the authentication request comprises

an identifier, and

 

the identifier is configured to identify an entity requesting authentication via the network device,

authenticate the entity, wherein

 

the authenticating comprises

determining network security information for the entity, wherein

 

the determining uses the identifier,

 

the network security information comprises a user group identifier,

 

the user group identifier is configured to be used to maintain security of a network to which the network device is communicatively coupled, by virtue of being configured to be included in a secure portion of a frame, and

 

the secure portion of the frame is secured using frame security information of the frame, and

send a response to the network device via the network interface, wherein

 

the response comprises

the network security information.

16. The computer networking system of claim 15, wherein

the authentication request further comprises

the entity is a host computer, and

an address of the host computer, and

the plurality of instructions is further configured to cause the processor to

assign the network security information to a combination of the address and the identifier.

17. The computer networking system of claim 16, wherein the plurality of instructions is further configured to cause the processor to:

receive the frame at the network device;

access forwarding information, wherein

the forwarding information is stored at the network device, and

the forwarding information comprises

the network security information,

the address, and

the identifier; and

determine that the network security information is to be associated with the frame, wherein

the network security information is determined based on a result of the accessing.

18. The computer networking system of claim 16, wherein the plurality of instructions is further configured to cause the processor to:

authenticate the combination of the address and the identifier, wherein the identifier is a logical network identifier; and

retrieve the network security information using the combination of the address and the identifier.

19. The computer networking system of claim 18, further comprising:

determining the frame security information, wherein

the frame security information is configured to facilitate security of an overhead portion of the frame,

the overhead portion of the frame comprises the network security information, and

the frame security information is configured to prevent access to the overhead portion of the frame.

20. A computer program product comprising:

a plurality of instructions, comprising

a first set of instructions, executable on a network device, configured to receive an authentication request at an authentication server, wherein

the authentication server is configured to receive the authentication request from a network device by virtue of comprising a network interface configured to be communicatively coupled to the network device,

the authentication request comprises

an identifier, and

the identifier is configured to identify an entity requesting authentication via the network device,

a second set of instructions, executable on the network device, configured to authenticate the entity, wherein

the authenticating comprises

determining network security information for the entity, wherein the determining uses the identifier,

 

the network security information comprises a user group identifier,

 

the user group identifier is configured to be used to maintain security of a network to which the network device is communicatively coupled, by virtue of being configured to be included in a secure portion of a frame, and

 

the secure portion of the frame is secured using frame security information of the frame,

a third set of instructions, executable on the network device, configured to send a response to the network device via the network interface, wherein

the response comprises

 

the network security information; and

a non-transitory computer-readable storage medium, wherein the instructions are encoded in the non-transitory computer-readable storage medium.