System and method of changing a network designation in response to data received from a device

• US 8,102,860 B2
• Filed: 11/30/2006
• Issued: 01/24/2012
• Est. Priority Date: 11/30/2006
• Status: Expired due to Fees

• Current Assignee: Access Layers Limited (Trumpf GmbH + Company KG)
• Original Assignee: Access Layers Limited (Trumpf GmbH + Company KG)
• Inventors: Amitai, Ofer, Aran, Nir
• Primary Examiner(s): Shah, Chirag
• Assistant Examiner(s): SMITH, JOSHUA Y
• Application Number:
  US11/606,009
• Publication Number:
  US 20080133719A1
• Time in Patent Office: 1,881 Days
• Field of Search: None
• US Class Current: 370/395.53
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones

Abstract

A method and system to create a virtual network to isolate a device connected to a port, and to change a designation of such network in response to identification data received from the device so as to provide the identified device with access to further areas of a network.

Claims

1. A method of determining whether to grant to an electronic device access to a local area network associated with a second port network identifier, the method comprising:

designating by a network device a virtual inspection network, wherein said virtual inspection network is associated with a first port network identifier;

upon connection of said electronic device to a port connected to said network device, associating said electronic device with said virtual inspection network by providing said first port network identifier by said network device to packets sent from said port;

accepting by said network device information from said electronic device;

determining based on said information whether said electronic device satisfies a criteria for granting access to said local area network, while said electronic device is connected to said port; and

upon determination that said electronic device satisfies said criteria, granting to said electronic device access to said local area network, by changing said first port network identifier associated with said inspection network to said second port network identifier associated with said local area network, thus associating said electronic device with said local area network.

2. The method as in claim 1, wherein accepting said information comprises accepting information selected from the group consisting of a media access control address associated with said device, an internet protocol address associated with said device, a product license of said device, an identifier associated with software on said device, and an identifier associated with a user of said device.

3. The method as in claim 1, comprising querying said device by said network device.

4. The method as in claim 1, wherein said determining comprises comparing said information to said criteria in a policy server comprised in said network device.

5. The method as in claim 1, comprising making connection to a resource of said local area network available for said electronic device upon determination that said electronic device satisfies said criteria.

6. The method as in claim 1, comprising

searching for an unwanted item on a memory of said device;

and

upon satisfaction of another criteria changing said second identifier to a third identifier, said third identifier identifying a second network.

7. The method as in claim 1, wherein said accepting said information from said device comprises accepting an indication of a network resource used by said device;

and wherein said granting to said device access to said network comprises connecting said device to said network resource.

8. The method as in claim 1, wherein said accepting said information from said device comprises accepting an indication of a quality of service required by said device.

9. An article comprising a non-transitory computer-readable storage medium having stored thereon software commands that, when executed by a processor, result in determining whether to grant to an electronic device access to a local area network associated with a second layer 2 identifier by:

designating by a network device a virtual inspection network, said virtual inspection network is associated with a first layer 2 identifier;

upon connection of said electronic device to a port connected to said network device, associating said electronic device with said virtual inspection network by providing said first layer 2 identifier by said network device;

accepting information from said electronic device;

determining based on said information whether said electronic device satisfies a criteria for granting access to said local area network, while said electronic device is connected to said port; and

upon determination that said electronic device satisfies said criteria, granting to said electronic device access to said local area network, by changing said first layer 2 identifier to said second layer 2 identifier, thus associating said electronic device with said local area network.

10. The article as in claim 9, wherein accepting said information comprises accepting information selected from the group consisting of a media access control address associated with said device, an internet protocol address associated with said device, a product license of said device, an identifier associated with software on said device, and an identifier associated with a user of said device.

11. The article as in claim 9, wherein said execution of said software commands further result in querying said device by said network device.

12. The article as in claim 9, wherein said determining comprises evaluating said information against a criteria in a policy server comprised in said network device.

13. The article as in claim 9, wherein said execution of said software commands further results in making connection to a resource of said local area network available for said electronic device upon determination that said electronic device satisfies said criteria.

14. The article as in claim 9, wherein said execution of said software commands further results in,

searching for an unwanted item on a memory of said device;

and

upon satisfaction of another criteria changing said second identifier to a third identifier, said third identifier identifying a second network.

15. The article as in claim 9, wherein said accepting said information from said device comprises accepting an indication of a network resource used by said device;

and wherein said granting to said device access to said network, comprises connecting said device to said network, said network providing access to said network resource.

16. The article as in claim 9, wherein said accepting said information from said device comprises accepting an indication of a quality of service required by said device.