Policy enforcement in dynamic networks

A method for managing network user traffic received by a network device, said network user traffic including at least a request for a server or service, said method comprising steps of:

• a. identifying a user originating said network user traffic;
• b. consulting a user policy table to locate a user service policy corresponding to said user;
• and
• c. managing said network user traffic based on said consulting step by any one or more of the following:
• i. forwarding network user traffic to a requested server,
• ii. redirecting network user traffic to a server providing a same service as a requested server,
• iii. sending network user traffic through filtering software before forwarding user traffic to a requested server,
• iv. denying transmission of user traffic on the basis of access privileges,
• v. counting or logging user traffic in order to provide network usage information, or
• vi. denying or delaying transmission of network user traffic on the basis of service level parameters.

A method for enforcing service policies over a network, said method implemented in a network device comprising steps of:

• a. receiving authentication messages for a user at said network device;
• b. determining user identifiers and service attributes associated with said user;
• c. creating a user service policy entry in a user policy table for said identified user based on said service attributes;
• d. consulting said user policy table to determine how to manage user traffic subsequent to said user authentication message;
• and
• e. managing said subsequent user traffic including any one or more of the following:
• i. forwarding user traffic to requested server,
• ii. redirecting user traffic to a server providing same service as requested server,
• iii. sending user traffic through filtering software before forwarding user traffic to requested server,
• iv. denying transmission of user traffic on the basis of access privileges,
• v. counting or logging user traffic in order to provide network usage information or
• vi. denying or delaying transmission of user traffic on the basis of service level parameters.

A system for enforcing service policies over a network comprising the following:

• a user request-issuing device;
• a service provider network over which user authentication messages and user traffic originated by said user request-issuing device is transmitted;
• an authentication server to which said user request-issuing device attempts to connect and by which said user request-issuing device is authenticated and registered;
• and
• a service policy director independent of said authentication server, enforcing a service policy for said user request-issuing device,
• wherein said user request-issuing device may be included in at least a network access server of a service provider network or in a user network.

A system for enforcing service policies over a network receiving user access request traffic, said system comprising a service policy director in any of the following configurations:

• a user request-issuing device operatively connected a service policy director, said service policy director connected to an authentication server, and said authentication server being operatively connected to said user request-issuing device, wherein said service policy director receives said user authentication request messages addressed to said authentication server and forwards said user authentication request messages to said authentication server;
• a user request-issuing device operatively connected a service policy director, said service policy director being operatively connected to said user request-issuing device, and an authentication server being operatively connected to said service policy director, wherein said service policy director, receives said user authentication request messages and queries said authentication server;
• and
• a user request-issuing device operatively connected to a service policy director, said service policy director receiving copied network user traffic, said copied network user traffic copied by a network device, and said user-request issuing device being operatively connected to said service policy director, the service policy director receives a copy of said user authentication request messages addressed to and destined for said authentication server.