# US 12,225,051 B2 · Identity-based policy enforcement in wide area networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,051 B2 - Document ID: US12225051B2 - Status: Granted - Kind: B2 - Application number: 17/876,190 - Filed: 2022-07-28 - Published: 2024-02-01 - Granted: 2025-02-11 - Earliest claimed: 2022-07-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Balaji Sundararajan; Vishnuprasad Raghavan; Kannan Kumar; Ramana Babu Polamarasetti; Mahalakshmi Rajaram - Web page: https://patentgrep.com/patent/US12225051B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/0894: Policy-based network configuration management - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/102: {Entity profiles} - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for user identity-based security policy enforcement. The techniques may include sending, to an edge device associated with a network, a networking policy associated with a user. The techniques may also include receiving, from an identity provider, an IP address associated with the user. Additionally, the techniques may include sending, to the edge device, an indication to associate the IP address with the user such that the edge device applies the networking policy to packets that include the IP address. ## Claims ### Claim 1 A method performed at least partially by a network controller of a network, the method comprising: identifying, by the network controller, an edge device associated with the network, the edge device corresponding to a user; sending, from the network controller and based on networking policies associated with the edge device, a networking policy associated with the user to the edge device; receiving, by the network controller and from an identity provider, a first internet protocol (IP) address associated with the user; and sending, from the network controller and to the edge device, an indication to associate the first IP address with the user and instructions to cause the edge device to apply the networking policy to packets that include the first IP address. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving, from the identity provider, a second IP address associated with the user, the second IP address different from the first IP address; and sending, to the edge device or another edge device, another indication to associate the second IP address with the user such that the edge device or the other edge device applies the networking policy to packets that include the second IP address. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving, from the identity provider, a second IP address associated with the user, the second IP address different from the first IP address; and sending, to the edge device, an indication to dissociate the first IP address with the user. ### Claim 4 (depends on 1) The method of claim 1, wherein the networking policy is associated with a user group, the user being a member of the user group. ### Claim 5 (depends on 1) The method of claim 1, wherein the network is a software-defined wide area network (SD-WAN) and the network controller is a software defined networking (SDN) controller. ### Claim 6 (depends on 1) The method of claim 1, wherein receiving the first IP address associated with the user from the identity provider comprises: receiving an indication that the user logged into the network; and obtaining, from the identity provider, an IP address to username binding and a username to user group binding associated with the user. ### Claim 7 (depends on 1) The method of claim 1, wherein the edge device is configured to, responsive to receiving a packet that includes the first IP address, determine the networking policy that is to be applied to the packet based at least in part on a binding stored by the edge device, the binding indicating that the first IP address is associated with the user. ### Claim 8 A system associated with a network controller of a network, the system comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the network controller to perform operations comprising: identifying, by the network controller, an edge device associated with the network, the edge device corresponding to a user; sending, from the network controller and to the edge device, a networking policy associated with a user group, the networking policy to be applied to traffic sent by members of the user group; receiving, by the network controller and from an identity provider, a binding associated with the user who is accessing the network through the edge device, the binding indicating at least an internet protocol (IP) address associated with the user and an indication that the user is a member of the user group; and based at least in part on the indication that the user is the member of the user group, sending, by the network controller and to the edge device, an indication of the binding and instructions to cause the edge device to apply the networking policy to packets that include the IP address. ### Claim 9 (depends on 8) The system of claim 8, the operations further comprising: receiving, from the identity provider, another binding associated with the user, the other binding indicating at least another IP address associated with the user; and sending, to the edge device or to another edge device, another indication of the other binding to cause the edge device or the other edge device to apply the networking policy to packets that include the other IP address. ### Claim 10 (depends on 8) The system of claim 8, the operations further comprising: receiving, from the identity provider, another binding associated with the user, the other binding indicating at least another IP address associated with the user that different from the IP address; and sending, to the edge device, an indication to dissociate the IP address with the user. ### Claim 11 (depends on 8) The system of claim 8, wherein the networking policy is one of multiple networking policies sent to the edge device, each one of the multiple networking policies to be applied to traffic sent by members of different user groups. ### Claim 12 (depends on 8) The system of claim 8, wherein the binding includes a first binding between a username associated with the user and an IP address and a second binding between the username and the user group. ### Claim 13 (depends on 12) The system of claim 12, wherein the edge device is configured to: receive a packet; determine that the packet was sent by the user based at least in part on the first binding and a determination that the packet includes the IP address; and determine to apply the networking policy to the packet based at least in part on the second binding indicating that the username associated with the user is a member of the user group. ### Claim 14 (depends on 8) The system of claim 8, wherein the network is a software-defined wide area network (SD-WAN) and the network controller is a software defined networking (SDN) controller. ### Claim 15 (depends on 8) The system of claim 8, wherein receiving the binding associated with the user from the identity provider comprises: receiving an indication that the user logged into the network; and obtaining, from the identity provider, the binding associated with the user. ### Claim 16 One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors associated with an edge device to perform operations comprising: receiving, by the edge device within a network and from a controller of the network, multiple networking policies associated with respective user groups that access the network via the edge device, a specific networking policy of the multiple networking policies to be applied to traffic sent by members of a specific user group; receiving, by the edge device and from the controller, an indication of a binding associated with a user, the binding indicating at least an internet protocol (IP) address associated with the user and an indication that the user is a member of the specific user group; receiving, by the edge device, a packet that includes the IP address; and determining, based at least in part on the binding indicating the user is the member of the specific user group and the packet including the IP address, to apply the specific networking policy to the packet. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable media of claim 16, the operations further comprising: receiving, from the controller, another binding associated with the user, the other binding indicating at least another IP address associated with the user; receiving another packet that includes the other IP address; and determining, based at least in part on the other binding, to apply the specific networking policy to the other packet. ### Claim 18 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the binding includes a first binding between a username associated with the user and the IP address and a second binding between the username and the specific user group. ### Claim 19 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the network is a software-defined wide area network (SD-WAN) and the controller is a software defined networking (SDN) controller. ### Claim 20 (depends on 16) The one or more non-transitory computer-readable media of claim 16, the operations further comprising storing, in a memory accessible to the edge device, at least one of the multiple networking policies or the binding associated with the user.