Network user identification and authentication

• US 9,699,158 B2
• Filed: 09/21/2012
• Issued: 07/04/2017
• Est. Priority Date: 09/22/2011
• Status: Active Grant

• Current Assignee: Russell S. Goodwin
• Original Assignee: Russell S. Goodwin
• Inventors: Goodwin, Russell S.
• Primary Examiner(s): GOODCHILD, WILLIAM J
• Application Number:
  US14/127,944
• Publication Number:
  US 20140208394A1
• Time in Patent Office: 1,747 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method of identifying and authenticating a network user includes receiving a first network layer packet from a first user entity. The first network layer packet may include first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet. The method further includes verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information.

Claims

1. A method of identifying and authenticating a network user comprising:

receiving, at a network layer of a network, a first Internet Protocol (IP) version 4 (IPv4) packet from a first user entity, wherein the network layer of the network is layer 3 in an Open Systems Interconnection (OSI) model of the network and wherein the first IPv4 packet includes a first IPv4 packet header that includes;

a first network address; and

first unique identification information that identifies the first user entity, is unique to the first user entity, and is independent of the first network address; and

verifying, at the network layer with the first IPv4 packet header and without use of layers of the OSI model higher than the network layer, that the first IPv4 packet is from the first user entity based on the first unique identification information included in the first IPv4 packet header.

2. The method of claim 1, further comprising:

receiving, at the network layer of the network, a second IPv4 packet from a second user entity, wherein the second IPv4 packet includes a second IPv4 packet header that includes;

the first network address; and

second unique identification information that identifies the second user entity, is unique to the second user entity, and is independent of the first network address; and

verifying, at the network layer with the second IPv4 packet header, that the second IPv4 packet is from the second user entity based on the second unique identification information included in the second IPv4 packet header.

3. The method of claim 1, further comprising:

receiving, at the network layer of the network, a second IPv4 packet from the first user entity, wherein the second IPv4 packet includes a second IPv4 packet header that includes;

a second network address different from the first network address; and

the first unique identification information; and

verifying, at the network layer with the second IPv4 packet header, that the second IPv4 packet is from the first user entity based on the first unique identification information included in the second IPv4 packet header.

4. The method of claim 1, wherein the first unique identification information includes a digital signature associated with the first user entity and the method further comprises verifying that the first IPv4 packet is from the first user entity based on the digital signature associated with the first user entity, the digital signature generated based on a key shared by the first user entity and an authentication domain configured to perform the verifying.

5. The method of claim 1, wherein the first unique identification information includes a digital signature associated with the first user entity and the method further comprises verifying that the first IPv4 packet is from the first user entity based on the digital signature associated with the first user entity, the digital signature generated based on a public/private key pair authentication scheme.

6. The method of claim 1, further comprising applying a policy to the received first IPv4 packet based on the first unique identification information and allowing or disallowing receipt of the first IPv4 packet at an intended destination endpoint based on application of the policy.

7. The method of claim 6, further comprising applying the policy anywhere in a path within the network layer and between the first user entity and an intended destination endpoint.

8. The method of claim 6, further comprising applying the policy at a plurality of points included in a path within the network layer and between the first user entity and an intended destination point.

9. The method of claim 1, further comprising associating a malicious attack with the first user identification information.

10. The method of claim 1, further comprising identifying the first user entity based on the first user identification information after verifying that the first IPv4 packet is from the first user entity without re-verifying that the first IPv4 packet is from the first user entity.

11. The method of claim 1, further comprising verifying that the first IPv4 packet is from the first user entity based on the first unique identification information before allowing reception of the first IPv4 packet by an intended destination endpoint.

12. The method of claim 1, further comprising allowing reception of the first IPv4 packet by an intended destination endpoint based on the first unique identification information.

13. The method of claim 12, further comprising allowing reception of one or more IPv4 packets subsequent to the first IPv4 packet by the destination endpoint based on the first unique identification information.

28. The method of claim 1, wherein the first unique

identification information is included in an options field of the first IPv4 packet header.

14. A processor configured to execute computer instructions to cause a system to perform operations for identifying and authenticating a network user, the operations comprising:

receiving, at a network layer of a network, a first Internet Protocol (IP) version 6 (IPv6) packet from a first user entity, wherein the network layer of the network is layer 3 in an Open Systems Interconnection (OSI) model of the network and wherein the first IPv6 packet includes;

a first IPv6 packet header that includes a first IP address; and

a first Hop-by-Hop field that includes first unique identification information that identifies the first user entity, is unique to the first user entity, and is independent of the first IP address; and

verifying, at the network layer with the first Hop-by-Hop field and without use of layers of the OSI model higher than the network layer, that the first IPv6 packet is from the first user entity based on the first unique identification information included in the first Hop-by-Hop field of the first IPv6 packet.

15. The processor of claim 14, wherein the operations further comprise:

receiving, at the network layer of the network, a second IPv6 packet from a second user entity, wherein the second IPv6 packet includes;

a second IPv6 packet header that includes the first IP address; and

a second Hop-by-Hop field that includes second unique identification information that identifies the second user entity, is unique to the second user entity, and is independent of the first IP address; and

verifying, at the network layer with the second Hop-by-Hop field, that the second IPv6 packet is from the second user entity based on the second unique identification information included in the second Hop-by-Hop field of the second IPv6 packet.

16. The processor of claim 14, wherein the operations further comprise:

receiving, at the network layer of the network, a second IPv6 packet from the first user entity, wherein the second IPv6 packet includes;

a second IPv6 packet header that includes a second IP address different from the first IP address; and

a second Hop-by-Hop field that includes the first unique identification information; and

verifying, at the network layer with the second Hop-by-Hop field, that the second IPv6 packet is from the first user entity based on the first unique identification information included in the second Hop-by-Hop field of the second IPv6 packet.

17. The processor of claim 14, wherein the first unique identification information includes a digital signature associated with the first user entity and the operations further comprise verifying that the first IPv6 packet is from the first user entity based on the digital signature associated with the first user entity, the digital signature generated based on a key shared by the first user entity and an authentication domain configured to perform the verifying.

18. The processor of claim 14, wherein the first unique identification information includes a digital signature associated with the first user entity and the operations further comprise verifying that the first IPv6 packet is from the first user entity based on the digital signature associated with the first user entity, the digital signature generated based on a public/private key pair authentication scheme.

19. The processor of claim 14, wherein the operations further comprise applying a policy to the received first IPv6 packet based on the first unique identification information.

20. The processor of claim 19, wherein the operations further comprise allowing or disallowing receipt of the first IPv6 packet at an intended destination endpoint based on the application of the policy.

21. The processor of claim 19, wherein the operations further comprise applying the policy anywhere in a path within the network layer and between the first user entity and an intended destination endpoint.

22. The processor of claim 19, wherein the operations further comprise applying the policy at a plurality of points included in a path within the network layer and between the first user entity and an intended destination point.

23. The processor of claim 14, wherein the operations further comprise associating a malicious attack with the first user identification information.

24. The processor of claim 14, wherein the operations further comprise identifying the first user entity based on the first user identification information after verifying that the first IPv6 packet is from the first user entity without re-verifying that the first IPv6 packet is from the first user entity.

25. The processor of claim 14, wherein the operations further comprise verifying that the first IPv6 packet is from the first user entity based on the first unique identification information before allowing reception of the first IPv6 packet by an intended destination endpoint.

26. The processor of claim 14, wherein the operations further comprise allowing reception of the first IPv6 packet by an intended destination endpoint based on the first unique identification information.

27. The processor of claim 26, wherein the operations further comprise allowing reception of one or more IPv6 packets subsequent to the first IPv6 packet by the destination endpoint based on the first unique identification information.