Authentication via monitoring
AssigneeCisco Technology, Inc.
InventorsDavid McGREW, Sandeep RAO
Life of this patent
Estimating the term…
Abstract
Systems, methods, and other embodiments associated with authentication via monitoring are described. One example method includes detecting a data flow in which indicia of identity (DFWIOI) travel between a first endpoint and a second endpoint. The DFWIOI may be partially encrypted. The example method may also include collecting an identity data associated with the DFWIOI from the DFWIOI, the first endpoint, the second endpoint, and so on. The example method may also include making an authentication policy decision regarding the DFWIOI based, at least in part, on the identity data. The example method may also include controlling a networking device associated with the DFWIOI based, at least in part, on the authentication policy decision.
Claims30
A logic encoded in a tangible media for execution and when executed operable to perform a method, the method comprising:
- detecting a data flow in which indicia of identity (DFWIOI) travel between a first endpoint and a second endpoint, where the indicia of identity include information from which an endpoint can be authenticated;
- collecting an identity data associated with the DFWIOI from one or more of, the DFWIOI, the first endpoint, and the second endpoint, making an authentication policy decision regarding the DFWIOI based, at least in part, on the identity data;
- and
- controlling a networking device associated with the DFWIOI based, at least in part, on the authentication policy decision.
An apparatus, comprising:
- a data flow detection logic to detect a data flow having indicators of identity, where the data flow is between a first network communicator (NC) and a second NC;
- an identification logic to collect an identification information from one or more of, the data flow, the first NC, and the second NC, the identification information being associated with the indicators of identity;
- a control logic to determine a connection policy for the data flow, where the connection policy is based, at least in part on the identification information, and where the connection policy controls one or more of, whether to allow a connection for the data flow, and a quality of service (QoS) for the data flow;
- and
- a network policing agent to control the data flow based, at least in part, on the connection policy.
An apparatus, comprising:
- a data flow detection logic to detect a data flow having indicators of identity, where the data flow is into and out of a single network communicator (NC);
- an identification logic to collect an identification information from one or more of, the data flow, and the NC, the identification information being associated with the indicators of identity;
- a control logic to determine a connection policy for the data flow, where the connection policy is based, at least in part on the identification information, and where the connection policy controls one or more of, whether to allow a connection for the data flow, and a quality of service (QoS) for the data flow;
- and
- a network policing agent to control the data flow based, at least in part, on the connection policy.
A system, comprising:
- means for detecting a data flow having indicators of identity, where the data flow is between a first network communicator (NC) and a second NC;
- means for collecting an identity data associated with the data flow from one or more of, the data flow, the first NC, and the second NC, the identity data being associated with the indicators of identity;
- means for determining a connection policy for the data flow, where the connection policy controls one or more of, whether to allow an exchange of information for the data flow, and a quality of service (QoS) for the data flow;
- and
- means for controlling a networking device through which the data flow passes based, at least in part, on the connection policy.
A computer-implemented method, comprising:
- passively monitoring a certificate capable flow;
- and
- selectively blocking data traffic on the certificate capable flow based, at least in part, on flow endpoint identity,
- where the method is configured to execute on one or more of, a host-based system, and a server-based system.
Dependencies are inferred from the claim text.