Managing network resource access using session context

• US 10,021,141 B2
• Filed: 06/12/2017
• Issued: 07/10/2018
• Est. Priority Date: 07/09/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wong, Pok Sze, Nampelly, Ramesh
• Primary Examiner(s): Paliwal, Yogesh
• Application Number:
  US15/620,033
• Publication Number:
  US 20170279856A1
• Time in Patent Office: 393 Days
• Field of Search: 726 1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/143 Termination or inactivation of sessions, e.g. event-controlled end of session

Abstract

A computing device providing a network service to a service area may receive a connection request from a user device and generate a session start request to start a user session in a service domain covering the service area. One or more policy rules may be evaluated to determine whether any rule is applicable to the user device, which includes determining that an authoritative user session has already been established in the service domain. The user session may be established in the service domain for the user device, and at least one permission for access to a controlled network resource may be associated with the user session based on the determination that the authoritative user session has already been established. A request from the user device to access the controlled network resource may be received and access to the controlled network resource may be granted.

Claims

1. A method comprising:

establishing, at a computing device, a user session in a service domain covering a service area to which the computing device provides a network service;

determining whether an authoritative user session has already been established in the service domain;

if the authoritative user session has not already been established in the service domain, associating, to the user session, an access control list (ACL) that does not define at least one permission to the user session;

receiving a request from a user device to access a controlled network resource; and

based on whether the ACL defines the at least one permission for access to the controlled network resource, permitting or denying, to the user device, access to the controlled network resource.

2. The method of claim 1, wherein:

if the authoritative user session has not already been established in the service domain;

permitting or denying access includes denying, to the user device, access to the controlled network resource based on the ACL.

3. The method of claim 1, further comprising:

if the authoritative user session has already been established in the service domain;

associating an ACL that defines the at least one permission to the user session.

4. The method of claim 3, wherein:

if the authoritative user session has already been established in the service domain;

permitting or denying access includes permitting, to the user device, access to the controlled network resource based on the ACL that defines the at least one permission to the user session.

5. The method of claim 4, further comprising:

if the authoritative user session has already been established in the service domain;

determining that an authoritative user device that established the authoritative user session has left the service area; and

revoking the access to the controlled network resource previously permitted to the user session.

6. The method of claim 1, further comprising:

receiving a connection request at the computing device from the user device; and

generating a session start request to start the user session.

7. The method of claim 1, wherein the service area is a home and the authoritative user session is a session for a person with authority at the home.

8. The method of claim 1, wherein the service area is a business premise and the authoritative user session is a session for a manager.

9. An apparatus comprising:

one or more network ports to send/receive data packets to/from a communication network; and

a microprocessor coupled to the one or more network ports, the microprocessor configured to;

establish, at a computing device, a user session in a service domain covering a service area to which the computing device provides a network service;

determine whether an authoritative user session has already been established in the service domain;

if the authoritative user session has not already been established in the service domain, associate, to the user session, an access control list (ACL) that does not define at least one permission to the user session;

receive a request from a user device to access a controlled network resource; and

based on whether the ACL defines the at least one permission for access to the controlled network resource, permit or deny, to the user device, access to the controlled network resource.

10. The apparatus of claim 9, wherein the microprocessor is further configured to:

if the authoritative user session has not already been established in the service domain;

permit or deny access by denying, to the user device, access to the controlled network resource based on the ACL.

11. The apparatus of claim 9, wherein the microprocessor is further configured to:

if the authoritative user session has already been established in the service domain;

associate an ACL that defines the at least one permission to the user session.

12. The apparatus of claim 11, wherein the microprocessor is further configured to:

if the authoritative user session has already been established in the service domain;

permit or deny access by permitting, to the user device, access to the controlled network resource based on the ACL that defines the at least one permission to the user session.

13. The apparatus of claim 12, wherein the microprocessor is configured to:

if the authoritative user session has already been established in the service domain;

determine that an authoritative user device that established the authoritative user session has left the service area; and

revoke the access to the controlled network resource previously permitted to the user session.

14. The apparatus of claim 9, wherein the microprocessor is further configured to:

receive a connection request at the computing device from the user device; and

generate a session start request to start the user session.

15. A non-transitory computer readable storage media encoded with instructions that, when executed by a processor of a computing device, cause the processor to:

establish, at the computing device, a user session in a service domain covering a service area to which the computing device provides a network service;

determine whether an authoritative user session has already been established in the service domain;

if the authoritative user session has not already been established in the service domain, associate, to the user session, an access control list (ACL) that does not define at least one permission to the user session;

receive a request from a user device to access a controlled network resource; and

based on whether the ACL defines the at least one permission for access to the controlled network resource, permit or deny, to the user device, access to the controlled network resource.

16. The non-transitory computer readable storage media of claim 15, wherein the instructions further cause the processor to:

if the authoritative user session has not already been established in the service domain;

permit or deny access by denying, to the user device, access to the controlled network resource based on the ACL.

17. The non-transitory computer readable storage media of claim 15, wherein the instructions further cause the processor to:

if the authoritative user session has already been established in the service domain;

associate an ACL that defines the at least one permission to the user session.

18. The non-transitory computer readable storage media of claim 17, wherein the instructions further cause the processor to:

if the authoritative user session has already been established in the service domain;

permit or deny access by permitting, to the user device, access to the controlled network resource based on the ACL that defines the at least one permission to the user session.

19. The non-transitory computer readable storage media of claim 18, wherein the instructions further cause the processor to:

if the authoritative user session has already been established in the service domain;

determine that an authoritative user device that established the authoritative user session has left the service area; and

revoke the access to the controlled network resource previously permitted to the user session.

20. The non-transitory computer readable storage media of claim 15, wherein the instructions further cause the processor to:

receive a connection request at the computing device from the user device; and

generate a session start request to start the user session.