# US 2014/0208388 A1 · User Notifications During Computing Network Access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208388 A1 - Document ID: US20140208388A1 - Status: Published application - Kind: A1 - Application number: 13/748,893 - Filed: 2013-01-24 - Published: 2014-07-24 - Earliest claimed: 2013-01-24 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Pok Sze Wong; Paul Forbes Bigbee - Web page: https://patentgrep.com/patent/US20140208388A1 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A notification is received that a network device in a computing network has blocked a service request directed towards a network resource of the computing network. A determination is made, based on authentication information associated with one or more of a network endpoint that transmitted the service request and a user at the network endpoint, as to whether the user should be notified of a reason that the network device blocked the service request. If it is determined that the user should be notified, a notification summarizing the reason that the network device blocked the service request is transmitted to the network endpoint. ## Claims ### Claim 1 A method comprising: receiving a notification that a network device in a computing network has blocked a service request directed towards a network resource of the computing network; determining, based on authentication information associated with one or more of a network endpoint that transmitted the service request and a user at the network endpoint, if the user should be notified of a reason that the network device blocked the service request; and if is determined that the user should be notified, transmitting a notification summarizing the reason that the network device blocked the service request to the network endpoint. ### Claim 2 (depends on 1) The method of claim 1, wherein determining if the user should be notified of a reason that the network device blocked the service request comprises: determining if the user has a verifiable identity. ### Claim 3 (depends on 2) The method of claim 2, wherein determining if the user has a verifiable identity comprises: accessing a user directory to determine if the user's identity is recognized within the directory. ### Claim 4 (depends on 1) The method of claim 1, wherein determining if the user should be notified of a reason that the network device blocked the service request comprises: determining if the user previously had a higher access level, but is currently reduced to a lower access level. ### Claim 5 (depends on 1) The method of claim 1, transmitting a notification summarizing the reason that the network device blocked the service request to the network endpoint further comprises: transmitting a notification that includes remediation information configured to assist the user in gaining access to the network resource. ### Claim 6 (depends on 1) The method of claim 1, wherein the service request includes a plurality of packets that will each be dropped by the network device, and further comprising: executing a thresholding mechanism to prevent notification from being transmitted to the network endpoint with the dropping of each packet in the service request. ### Claim 7 (depends on 1) The method of claim 1, further comprising: at the network endpoint, generating a message to the user that is independent of the application or protocol that the user is using, the message summarizing the reason the service request was blocked. ### Claim 8 An apparatus comprising: one or more network interface ports configured to enable network communications; a memory; and a processor coupled to the one or more network interface ports and the memory, the processor configured to: receive a notification that a network device in a computing network has blocked a service request directed towards a network resource of the computing network; determine, based on authentication information associated with one or more of a network endpoint that transmitted the service request and a user at the network endpoint, if the user should be notified of a reason that the network device blocked the service request; and if is determined that the user should be notified, transmit a notification summarizing the reason that the network device blocked the service request to the network endpoint. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein to determine if the user should be notified of a reason that the network device blocked the service request the processor is configured to: determine if the user has a verifiable identity. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein to determine if the user has a verifiable identity the processor is configured to: access a user directory to determine if the user's identity is recognized within the directory. ### Claim 11 (depends on 8) The apparatus of claim 8, wherein to determine if the user should be notified of a reason that the network device blocked the service request the processor is configured to: determine if the user previously had a higher access level, but is currently reduced to a lower access level. ### Claim 12 (depends on 8) The apparatus of claim 8, wherein to transmit a notification summarizing the reason that the network device blocked the service request to the network endpoint the processor is configured to: transmit a notification that includes remediation information configured to assist the user in gaining access to the network resource. ### Claim 13 (depends on 8) The apparatus of claim 8, wherein the service request includes a plurality of packets that will each be dropped by the network device, and wherein the processor is configured to: execute a thresholding mechanism to prevent notification from being transmitted to the network endpoint with the dropping of each packet in the service request. ### Claim 14 (depends on 8) The apparatus of claim 8, wherein to transmit a notification summarizing the reason that the network device blocked the service request to the network endpoint the processor is configured to: transmit a notification that enables the network endpoint to generate a message to the user that is independent of the application or protocol that the user is using and that summarizes the reason the service request was blocked. ### Claim 15 One or more computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to: receive a notification that a network device in a computing network has blocked a service request directed towards a network resource of the computing network; determine, based on authentication information associated with one or more of a network endpoint that transmitted the service request and a user at the network endpoint, if the user should be notified of a reason that the network device blocked the service request; and if is determined that the user should be notified, transmit a notification summarizing the reason that the network device blocked the service request to the network endpoint. ### Claim 16 (depends on 15) The computer readable storage media of claim 15, wherein the instructions operable to determine if the user should be notified of a reason that the network device blocked the service request comprise instructions operable to: determine if the user has a verifiable identity. ### Claim 17 (depends on 16) The computer readable storage media of claim 16, wherein the instructions operable to determine if the user has a verifiable identity comprise instructions operable to: access a user directory to determine if the user's identity is recognized within the directory. ### Claim 18 (depends on 15) The computer readable storage media of claim 15, wherein the instructions operable to determine if the user should be notified of a reason that the network device blocked the service request comprise instructions operable to: determine if the user previously had a higher access level, but is currently reduced to a lower access level. ### Claim 19 (depends on 15) The computer readable storage media of claim 15, wherein the instructions operable to transmit a notification summarizing the reason that the network device blocked the service request to the network endpoint comprise instructions operable to: transmit a notification that includes remediation information configured to assist the user in gaining access to the network resource. ### Claim 20 (depends on 15) The computer readable storage media of claim 15, wherein the service request includes a plurality of packets that will each be dropped by the network device, and comprising instructions operable to: execute a thresholding mechanism to prevent notification from being transmitted to the network endpoint with the dropping of each packet in the service request. ### Claim 21 (depends on 15) The computer readable storage media of claim 15, wherein the instructions operable to transmit a notification summarizing the reason that the network device blocked the service request to the network endpoint comprise instructions operable to: transmit a notification that enables the network endpoint to generate a message to the user that is independent of the application or protocol that the user is using and that summarizes the reason the request was blocked.