System for controlling users access to a distributive network in accordance with constraints present in common access distributive network interface separate from a server

• US 5,991,807 A
• Filed: 06/24/1996
• Issued: 11/23/1999
• Est. Priority Date: 06/24/1996
• Status: Expired due to Term

• Current Assignee: Avaya Incorporated
• Original Assignee: Nortel Networks Corporation
• Inventors: Savage, Herb, Murphy, John, Baron, Peter, Donzis, Henry, Schmidt, Jonathan, Donzis, Lewis
• Primary Examiner(s): Luu, Le Hien
• Application Number:
  US08/669,053
• Time in Patent Office: 1,247 Days
• Field of Search: 340/825.31, 707/9, 380/25, 709/225, 713/200, 713/201
• US Class Current: 709/225
• CPC Class Codes: H04L 12/2858 Access network architectures
• CPC Class Codes: H04L 12/2876 Handling of subscriber policies group policies management H04L41/0893

Abstract

A method of managing access to a distributive network provides both time and site access restraints for users or groups of users on a LAN or WAN adapted for accessing the network through a common network access interface system. The method utilizes the LAN server to develop and monitor the constraints, minimizing the utilization of the access interface system. The management parameters for each group or individual having access to the distributive network via the LAN or WAN is entered into the interface box by the administrator as a compact reference, a series of pointers to the larger database of users and groups stored in the existing LAN server directory services. The existing database of users and groups and their relationships exist already in the LAN servers as a normal consequence of LAN operation and a simple, graphical user interface in the preferred embodiment of the invention permits familiar selection of objects of that database and assignment of access constraints.

Claims

1. A method for controlling access to a distributive network by users and user groups utilizing personal computers (PCs) on a local area network (LAN) comprising:

utilizing a server for centralized, common access by the PCs on the LAN;

establishing a database for the server to identify users and user group assignments for the LAN, the database including users and user groups native to normal LAN operation, each user group comprising one or more users;

establishing a common access distributive network interface separate from the server and communicatively coupling the LAN to the distributive network without directly connecting through the server;

programming user and user group control parameters into the database at the server, including constraints for access by users and user groups to the distributive network;

transferring the constraints to the distributive network interface; and

controlling access to the distributive network for a particular user at the distributive network interface without routing the particular user'"'"'s access through the server and in accordance with the constraints present in the distributive network interface for the particular user or the group to which the particular user is assigned.

2. The method of claim 1, further including defining a plurality of groups each having a unique set of parameters.

3. The method of claim 2, further including assigning a user to multiple groups.

4. The method of claim 3, wherein distributive network access by said user is limited to the parameters of the combined access restrictions of all the group memberships to which the user is assigned.

5. The method of claim 1, wherein each group is assigned a time parameter for defining specific time blocks during which the user may gain access to the distributive network via the central, common access distributive network interface.

6. The method of claim 5, further including disconnecting users attempting to remain connected outside the specific time blocks.

7. The method of claim 1, wherein the parameters include specific distributive network destinations and services to which the user may gain access on the distributive network via the central, common access distributive network interface.

8. The method of claim 7, wherein each distributive network destination and service is an address defined by an address locator and a port number, and wherein each group includes an address parameter to which is assigned a combination of specified address locators and specified port numbers.

9. The method of claim 8, wherein the address parameter includes all address locators with specific port numbers.

10. The method of claim 8, wherein the address parameter includes all specific address locators with all port numbers.

11. The method of claim 1, including logging of actual user access to the distributive network.

12. The method of claim 11, wherein the logging further includes maintaining a log of the time blocks when accessed and the distributive network locators accessed.

13. The method of claim 12, wherein the logging further includes maintaining a log of the port numbers accessed.

14. The method of claim 12, wherein the logging further includes the reverse name lookup of each IP address to display in the log the name of the accessed domain rather than only the numeric IP address.

15. A storage medium having therein a plurality of programming instructions which, when executed by a processor, implement a service for controlling access of users on a local area network (LAN) to a distributive network, the service including a function for:

accessing a database of a server for centralized, common access by personal computers (PCs) on the LAN to identify users and user group assignments native to the normal LAN operation, each user group comprising one or more users;

assigning user and user group control parameters into the database at the server, including constraints for access by users and user groups to the distributive network;

transferring the constraints to a distributed network interface which is separate from the server, the distributed network interface providing a communicative coupling of the LAN to the distributive network without directly connecting through the server; and

controlling access to the distributive network for a particular user at the distributive network interface without routing the particular user'"'"'s access through the server and in accordance with the constraints present in the distributive network interface for the particular user or the group to which the particular user is assigned.

16. The storage medium of claim 15, wherein the function is further for defining a plurality of groups each having a unique set of parameters.

17. The storage medium of claim 15, wherein each group is assigned a time parameter for defining specific time blocks during which the user may gain access to the distributive network.

18. The storage medium of claim 17, wherein the function is further for disconnecting users attempting to remain connected outside the specific time blocks.

19. The storage medium of claim 15, wherein the parameters include specific distributive network sites to which the user may gain access on the distributive network.

20. The storage medium of claim 19, wherein each distributive network destination or service is an address defined by an address locator and a port number, and wherein each group includes an address parameter to which is assigned a combination of specified address locators and specified port numbers.

21. The storage medium of claim 15, wherein each distributive network access to a newsgroup is defined by the hierarchical newsgroup name and access constraints are forged by floating text strings for allow or disallow of access.

22. The storage medium of claim 15, wherein the function is further for logging of actual user access to the distributive network.

23. The storage medium of claim 22, wherein the logging further includes maintaining a log of the time blocks when accessed and the distributive network locators accessed.

24. The storage medium of claim 22, wherein the logging further includes maintaining a log of the port numbers accessed.

25. An apparatus comprising:

a storage medium having stored therein a plurality of programming instructions; and

an execution unit, coupled to the storage medium, to execute the programming instructions to,

access a database of a server for centralized, common access by personal computers (PCs) on a local area network (LAN) to identify users and user group assignments native to the normal LAN operation, each user group comprising one or more users,

assign user and user group control parameters into the database at the server, including constraints for access by users and user groups to a distributive network,

transfer the constraints to a distributed network interface which is separate from the server, the distributed network interface providing a communicative coupling of the LAN to the distributive network without directly connecting through the server,

control access to the distributive network for a particular user at the distributive network interface without routing the particular user'"'"'s access through the server and in accordance with the constraints present in the distributive network interface for the particular user or the group to which the particular user is assigned.

26. The apparatus of claim 25, wherein each group is assigned a time parameter for defining specific time blocks during which the user may gain access.

27. The apparatus of claim 25, wherein the parameters include specific Internet addresses and ports to which the user may gain access.

28. The apparatus of claim 25, wherein the execution unit is further to execute the programming instructions to maintain a log of actual user access to the Internet.

29. The apparatus of claim 28, wherein the execution unit is further to execute the programming instructions to include a log of the time blocks when accessed and the distributive network locators accessed.