# US 2014/0208394 A1 · Network user identification and authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208394 A1 - Document ID: US20140208394A1 - Status: Published application - Kind: A1 - Application number: 14/127,944 - Filed: 2012-09-21 - Published: 2014-07-24 - Earliest claimed: 2011-09-22 - Inventors: Russell S. Goodwin - Web page: https://patentgrep.com/patent/US20140208394A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 9/3247: {involving digital signatures} - H04L 63/102: {Entity profiles} - H04L 63/126: {the source of the received data} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/164: {at the network layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of identifying and authenticating a network user includes receiving a first network layer packet from a first user entity. The first network layer packet may include first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet. The method further includes verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information. ## Claims ### Claim 1 A method of identifying and authenticating a network user comprising: receiving a first network layer packet from a first user entity, the first network layer packet including first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet; and verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving a second network layer packet from a second user entity, the second network layer packet associated with the first network address and including second unique identification information unique to the second user entity and independent of the first network address; and verifying, at the network layer of the network, that the second network layer packet is from the second user entity based on the second unique identification information. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving a second network layer packet from the first user entity, the second network layer packet associated with a second network address different from the first network address and including the first unique identification information; and verifying, at the network layer of the network, that the second network layer packet is from the first user entity based on the first unique identification information. ### Claim 4 (depends on 1) The method of claim 1, further comprising verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a key shared by the first user entity and an authentication domain configured to perform the verifying. ### Claim 5 (depends on 1) The method of claim 1, further comprising verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a public/private key pair authentication scheme. ### Claim 6 (depends on 1) The method of claim 1, further comprising applying a policy to the received first network layer packet based on the first unique identification information. ### Claim 7 (depends on 6) The method of claim 6, further comprising allowing or disallowing receipt of the first network layer packet at an intended destination endpoint based on the application of the policy. ### Claim 8 (depends on 6) The method of claim 6, further comprising applying the policy anywhere in a path between the first user entity and an intended destination endpoint. ### Claim 9 (depends on 6) The method of claim 6, further comprising applying the policy at a plurality of points included in a path between the first user entity and an intended destination point. ### Claim 10 (depends on 1) The method of claim 1, further comprising associating a malicious attack with the first user identification information. ### Claim 11 (depends on 1) The method of claim 1, further comprising identifying the first user entity based on the first user identification information after verifying that the first network layer packet is from the first user entity without re-verifying that the first network layer packet is from the first user entity. ### Claim 12 (depends on 1) The method of claim 1, further comprising verifying that the first network layer packet is from the first user entity based on the unique identification information before allowing an application layer connection with an intended destination endpoint. ### Claim 13 (depends on 1) The method of claim 1, further comprising allowing an application layer connection with an intended destination endpoint based on the unique identification information. ### Claim 14 (depends on 13) The method of claim 13, further comprising maintaining the application layer connection with the destination endpoint based on the unique identification information. ### Claim 15 A processor configured to execute computer instructions to cause a system to perform operations for identifying and authenticating a network user, the operations comprising: receiving a first network layer packet from a first user entity, the first network layer packet including first unique identification information unique to the first user entity and independent of a first network address associated with the first network layer packet; and verifying, at a network layer of a network, that the first network layer packet is from the first user entity based on the first unique identification information. ### Claim 16 (depends on 15) The processor of claim 15, wherein the operations further comprise: receiving a second network layer packet from a second user entity, the second network layer packet associated with the first network address and including second unique identification information unique to the second user entity and independent of the first network address; and verifying, at the network layer of the network, that the second network layer packet is from the second user entity based on the second unique identification information. ### Claim 17 (depends on 15) The processor of claim 15, wherein the operations further comprise: receiving a second network layer packet from the first user entity, the second network layer packet associated with a second network address different from the first network address and including the first unique identification information; and verifying, at the network layer of the network, that the second network layer packet is from the first user entity based on the first unique identification information. ### Claim 18 (depends on 15) The processor of claim 15, wherein the operations further comprise verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a key shared by the first user entity and an authentication domain configured to perform the verifying. ### Claim 19 (depends on 15) The processor of claim 15, wherein the operations further comprise verifying that the first network layer packet is from the first user entity based on a digital signature associated with the first user entity, the digital signature generated based on a public/private key pair authentication scheme. ### Claim 20 (depends on 15) The processor of claim 15, wherein the operations further comprise applying a policy to the received first network layer packet based on the first unique identification information. ### Claim 21 (depends on 20) The processor of claim 20, wherein the operations further comprise allowing or disallowing receipt of the first network layer packet at an intended destination endpoint based on the application of the policy. ### Claim 22 (depends on 20) The processor of claim 20, wherein the operations further comprise applying the policy anywhere in a path between the first user entity and an intended destination endpoint. ### Claim 23 (depends on 20) The processor of claim 20, wherein the operations further comprise applying the policy at a plurality of points included in a path between the first user entity and an intended destination point. ### Claim 24 (depends on 15) The processor of claim 15, wherein the operations further comprise associating a malicious attack with the first user identification information. ### Claim 25 (depends on 15) The processor of claim 15, wherein the operations further comprise identifying the first user entity based on the first user identification information after verifying that the first network layer packet is from the first user entity without re-verifying that the first network layer packet is from the first user entity. ### Claim 26 (depends on 15) The processor of claim 15, wherein the operations further comprise verifying that the first network layer packet is from the first user entity based on the unique identification information before allowing an application layer connection with an intended destination endpoint. ### Claim 27 (depends on 15) The processor of claim 15, wherein the operations further comprise allowing an application layer connection with an intended destination endpoint based on the unique identification information. ### Claim 28 (depends on 27) The processor of claim 27, wherein the operations further comprise maintaining the application layer connection with the destination endpoint based on the unique identification information.