Method and system for the assignment of security group information using a proxy

• US 7,840,708 B2
• Filed: 08/13/2007
• Issued: 11/23/2010
• Est. Priority Date: 08/13/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Fine, Michael, Smith, Michael R., Nemat, Awais B.
• Primary Examiner(s): Patel; Haresh N
• Application Number:
  US11/837,958
• Publication Number:
  US 20090049196A1
• Time in Patent Office: 1,198 Days
• Field of Search: 709/245, 709/246, 709217-228, 707/1, 726/5, 726/28, 711/118, 713/171
• US Class Current: 709/246
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method and system for the assignment of security group information using a proxy is disclosed. The method includes receiving an address of a network device at a first network device, receiving a security group of the network device at the first network device and associating the address information and the security group information with one another at the first network device. The first network device is coupled to a second network device. The address is represented by address information, which is received from the second network device. The security group is identified using the security group information, which indicates the network device is a member of the security group. The address information and the security group information are associated with one another by storing the address information and the security group information at the first network device.

Claims

1. An apparatus comprising:

a first network device, comprising at least one hardware processor, wherein

said first network device is configured to be coupled to a second network device,

said first network device is further configured to

receive an address of a network device, wherein

said address is represented by address information, and

said address information is received from said second network device,

receive a security group of said network device, wherein

said security group is identified using security group information,

said security group information indicates said network device is a member of said security group, and

said security group information is received from said second network device, and

associate said address information and said security group information with one another by storing said address information and said security group information,

said second network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed, and

said second network device is configured to cause said first network device to store said address information and said security group information by virtue of being configured to

send an install message to said first network device, wherein

said install message comprises said address information and said security group information, and

said install message is configured to cause said first network device to associate said address information and said security group information.

2. The apparatus of claim 1, wherein

said first network device is further configured to

receive said packet from said second network device,

determine if security group information is associated with said packet using address information associated with said packet, and

associate said security group information with said packet using address information associated with said packet, if security group information is not associated with said packet.

3. The apparatus of claim 2, wherein said first network device is a distribution layer network device, and said distribution layer network device is further configured to:

determine if security group information should be associated with said packet; and

perform said association of said security group information with said packet only if said security group information should be associated with said packet and said security group information is not associated with said packet, wherein said distribution layer network device is configured to associate said security group information with said packet by virtue of being configured to add said security group information to said packet.

4. The apparatus of claim 3, further comprising:

an access layer network device, wherein

said second network device is said access layer network device,

said access layer network device is coupled to said distribution layer network device, and

said access layer network device is configured to send said packet to said distribution layer network device.

5. The apparatus of claim 4, wherein said access layer network device is configured to:

identify a security group membership of another network device, wherein

address information is associated with said another network device,

said security group membership indicates said another network device is a member of a security group, and

said security group is identified using said security group information; and

send said address information and said security group information, wherein

said identifying and said sending are performed by said access layer network device.

19. The method of claim 1, further comprising:

if said security group is invalidated, sending a delete message from said first network device to a second network device, wherein

said delete message is configured to cause said second network device to delete said association of said address information and said security group information.

20. The method of claim 19, wherein

said delete message comprises said address information and said security group information.

6. An apparatus comprising:

a first network device comprising

at least one hardware processor,

means for coupling said first network device to a second network device,

means for receiving an address of a network device, wherein

said address is represented by address information, and

said address information is received from said second network device via said means for receiving,

means for receiving a security group of said network device, wherein

said security group is identified using security group information,

said security group information indicates said network device is a member of said security group, and

said security group information is received from said second network device via said means for receiving, and

means for associating said address information and said security group information with one another comprising means for storing said address information and said security group information, wherein

said second network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed, and

said second network device is configured to cause said first network device to store said address information and said security group information by virtue of being configured to

send an install message to said first network device, wherein

 

said install message comprises said address information and said security group information, and

 

said install message is configured to cause said first network device to associate said address information and said security group information.

7. An apparatus comprising:

a first network device, comprising at least one hardware processor, wherein

said first network device is configured to

identify an address of a network device, wherein

said address is identified using address information,

identify a security group of the network device, wherein

said security group is identified using security group information, and

said security group information indicates said network device is a member of said security group, and

send said address information and said security group information,

said first network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed,

said first network device is an access layer network device, and

said access layer network device is configured to cause a distribution layer network device to store said address information and said security group information by virtue of being configured to

send an install message to said distribution layer network device,

wherein

said install message comprises said address information and said security group information, and

said install message is configured to cause said distribution layer network device to associate said address information and said security group information.

8. The apparatus of claim 7, further comprising:

said distribution layer network device, wherein

said distribution layer network device is coupled to receive said address information and said security group information from said access layer network device, and

said distribution layer network device is configured to associate said address information and said security group information.

9. The apparatus of claim 8, wherein

said distribution layer network device is configured to associate said address information and said security group information by virtue of being configured to

store said address information and said security group information such that said address information and said security group information are associated with one another.

10. The apparatus of claim 8, wherein

said access layer network device is further configured to

send said packet, and

said distribution layer network device is further configured to

receive said packet,

determine if security group information is associated with said packet, and

associate said security group information with said packet, if security group information is not associated with said packet.

11. A method comprising:

identifying, using at least one hardware processor, an address of a network device, wherein

said address is identified using address information;

identifying a security group of said network device, wherein

said security group is identified using security group information, and

said security group information indicates said network device is a member of said security group; and

sending said address information and said security group information, wherein

said identifying said security group and said sending are performed by a first network device,

said first network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed, and

said sending comprises

sending an install message from said first network device to a second network device;

said install message comprises said address information and said security group information, and

said install message is configured to cause said second network device to associate said address information and said security, group information.

12. The method of claim 11, wherein said sending comprises:

sending said address information and said security group information from said first network device to a second network device, wherein

said second network device is configured to associate said address information and said security group information with one another.

13. The method of claim 12, further comprising:

causing said second network device to associate said address information and said security group information by storing said address information and said security group information such that said address information and said security group information are associated with one another.

14. The method of claim 13, further comprising:

receiving said packet from said first network device at said second network device, wherein

packet address information is associated with said packet, and

packet address information is address information associated with said network device;

determining if said security group information should be associated with said packet using said packet address information; and

associating said security group information with said packet, if said packet address information indicates that said security group information is associated with said network device.

15. The method of claim 14, further comprising:

associating an address and said security group information with one another, wherein

said address allows said security group information to be associated with said packet.

16. The method of claim 15, wherein

said address is at least one of a media access control address, an internet protocol address and a transport layer port address.

17. The method of claim 14, wherein said associating comprises:

adding said security group information to said packet.

18. The method of claim 17, wherein said adding comprises one of:

inserting said security group information in said packet; and

encapsulating said packet, wherein

said encapsulating comprises one of prepending and appending said security group information to said packet.