US 2014/0237539 A1 · Identity Propagation

Abstract

In one implementation, identity based security features and policies are applied to endpoint devices behind an intermediary device, such as a network address translation device. The access network switch authenticates an endpoint based on a user identity and a credential. A hypertext transfer protocol (HTTP) packet is generated or modified to include the user identity in an inline header. The HTTP packet including the user identity is sent to a policy enforcement device to look up one or more policies for the endpoint. The access switch receives traffic from the policy enforcement device that is filtered according the user identity. Subsequent TCP connections may also include identity information within the TCP USER_HINT option in a synchronization packet thus allowing identity propagation for other applications and protocols.

Claims20

Dependent claims

A method comprising:

authenticating an endpoint based on a user identity and a credential;
generating a hypertext transfer protocol (HTTP) packet including the user identity;
sending the HTTP packet including the user identity to a policy enforcement device;
and
receiving traffic from the policy enforcement device, wherein the traffic is filtered according the user identity.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application

13/773,157Filed 21 Feb 2013

Published

21 Aug 2014

Term ends

Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 69/161
Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]: implementation…
H04L 69/22
Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass:…

Identity Propagation

Life of this patent

Identity Propagation

Life of this patent

Abstract

Claims20