Back to results
US 2016/0255087 A1Published application
Method and Apparatus for Providing Network Security Using Role-Based Access Control
AssigneeCisco Technology, Inc.
InventorMichael R. Smith
Life of this patent
Estimating the term…
Abstract
A method and apparatus for providing network security using role-based access control is disclosed. A network device implementing such a method can include, for example, an access control list. Such an access control list includes an access control list entry, which, in turn, includes a user group field. Alternatively, a network device implementing such a method can include, for example, a forwarding table that includes a plurality of forwarding table entries. In such a case, at least one of the forwarding table entries includes a user group field.
Claims21
(canceled)
A method comprising:
- in response to receipt of a packet at a network interface of a network device,
- determining a source user group identifier that identifies a source user group, by identifying a source of the packet as being a member of the source user group, using a hardware processor of the network device,
- determining a destination user group identifier that identifies a destination user group, by identifying a destination of the packet as being a member of the destination user group, using the hardware processor,
- identifying a permission list entry storing a permission using at least the source user group identifier and the destination user group identifier, and
- enforcing the permission on the packet, using the hardware processor.
2 more elements
A network device comprising:
- one or more hardware processors;
- a network interface, coupled to the one or more hardware processors;
- a memory, coupled to the one or more hardware processors and configured to store a permission list comprising a permission list entry, wherein
- the permission list entry is identified by, at least in part,
- one of a plurality of source user group identifiers, each of which identifies a corresponding one of a plurality of source user groups, and
- one of a plurality of destination user group identifiers, each of which identifies a corresponding one of a plurality of destination user groups;
- a computer-readable storage medium, coupled to the one or more hardware processors;
- and
- a plurality of instructions, encoded in the computer-readable storage medium and configured to cause the one or more hardware processors to
- in response to receipt of a packet by the network interface,
- determine a source user group identifier of the plurality of source user group identifiers, the source user group identifier being associated with a source of the packet,
- determine a destination user group identifier of the plurality of destination user group identifiers, the destination user group identifier being associated with a destination of the packet,
- identify the permission list entry, using at least the source user group identifier and the destination user group identifier, wherein the permission list entry indicates a permission, and
- enforce the permission on the packet.
11 more elements
A network apparatus comprising:
- packet processing means for processing a packet, responsive to receipt of the packet at a network interface of the network apparatus, comprising
- first determining means for determining a source user group identifier identifying a source user group, using a hardware processor of the network apparatus, comprising first identifying means for identifying a source of the packet as being a member of the source user group,
- second determining means for determining a destination user group identifier identifying a destination user group, using the hardware processor, comprising second identifying means for identifying a destination of the packet as being a member of the destination user group,
- identifying means for identifying a permission list entry, using at least the source user group identifier and the destination user group identifier, wherein a permission is stored in the permission list entry, and
- enforcing means for enforcing the permission on the packet, using the hardware processor.
2 more elements
Dependencies are inferred from the claim text.