Translating authorization information within computer networks

A method comprising:

• receiving, with a network security device, network traffic from an endpoint device;
• in response to receiving the network traffic, requesting, with the network security device, authorization information from an intermediate storage device in accordance with Interface for Metadata Access Point (IF-MAP) protocol, wherein the intermediate storage device stores the authorization information in accordance with a first IF-MAP authorization data model that complies with an IF-MAP standard;
• receiving, with the network security device, the authorization information from the intermediate storage device;
• applying, with the network security device, an import translation policy to translate the authorization information stored in accordance the first IF-MAP authorization data model into translated authorization information that complies with a second proprietary authorization data model, wherein the second IF-MAP authorization data model is different from the first proprietary authorization data model;
• and
• forwarding, with the network security device, the network traffic based on the translated authorization information.

An authentication device comprising:

• an authorization database that stores authorization information in accordance with a first proprietary authorization data model;
• a policy database that stores data defining an export translation policy;
• and
• a control unit comprising:
• an authorization agent that receives authentication information from an endpoint device, authenticates the endpoint device based on the authentication information, and stores, based on the authentication, authorization information in accordance with the first proprietary authorization data model to the authorization database;
• a translation module that applies the export translation policy to translate the received authorization information stored in accordance with the first proprietary authorization data model into translated authorization information that complies with a second Interface for Metadata Access Point (IF-MAP) authorization data model conforming to an IF-MAP standard, wherein the second IF-MAP authorization data model is different from the first proprietary authorization data model;
• and
• a client module that publishes the translated authorization information to an intermediate storage device that implements the second IF-MAP authorization data model.

A network security device comprising:

• a policy database that stores an import translation policy;
• and
• a control unit comprising:
• an admission module that receives network traffic from an endpoint device;
• a client module that requests, in response to receiving the network traffic, authorization information from an intermediate storage device in accordance with an Interface for Metadata Access Point (IF-MAP) protocol and receives the authorization information from the intermediate storage device, wherein the intermediate authorization storage device stores the authorization information in accordance with a first IF-MAP authorization data model that confirms to an IF-MAP standard;
• and
• a translation module that applies the import translation policy to translate the authorization information stored in accordance the first IF-MAP authorization data model into translated authorization information that complies with a second proprietary authorization data model, wherein the second IF-MAP authorization data model is different from the first proprietary authorization data model,
• wherein the admission module forwards the network traffic based on the translated authorization information.

A network system comprising:

• an endpoint device;
• a network that includes:
• an authentication device that authenticates the endpoint device in accordance with a first authorization data model;
• an intermediate storage device that implements a vendor-neutral authorization data model;
• a protected resource server;
• and
• a network security device that controls access to the protected resource server in accordance with a second authorization data model,
• wherein the authentication device comprises:
• a first authorization database that stores authorization information in accordance with the first authorization data model;
• a first policy database that stores data defining an export translation policy;
• and
• a first control unit that comprises:
• an authorization agent that receives authentication information from an endpoint device, authenticates the endpoint device based on the authentication information, and stores, based on the authentication, authorization information in accordance with the first authorization data model to the authorization database;
• a first translation module that applies the export translation policy to translate the received authorization information stored in accordance the first authorization data model into translated authorization information that complies with the vendor-neutral authorization data model, wherein the vendor-neutral authorization data model is different from the first authorization data model;
• and
• a first client module that publishes the translated authorization information to an intermediate storage device that implements the vendor-neutral authorization data model, and
• wherein the network security device comprises:
• a second policy database that stores an import translation policy;
• and
• a second control unit that comprises:
• an admission module that receives network traffic from an endpoint device;
• a second client module that requests, in response to receiving the network traffic, authorization information from an intermediate storage device and receives the authorization information from the intermediate storage device, wherein the intermediate authorization storage device stores the authorization information in accordance with the vendor-neutral authorization data model;
• and
• a second translation module that applies the import translation policy to translate the authorization information stored in accordance the vendor-neutral authorization data model into translated authorization information that complies with the second authorization data model, wherein the second authorization data model is different from the vendor-neutral authorization data model,
• wherein the admission module forwards the network traffic based on the translated authorization information.

A non-transitory computer-readable medium comprising instructions for causing a programmable processor to:

• receive, with an authentication device, authentication information from an endpoint device;
• authenticates with the authentication device, the endpoint device based on the authentication information;
• based on the authentication, store, with the authentication device, the authorization information in accordance with a first authorization data model;
• apply, with the authentication device, an export translation policy to translate the authorization information stored in accordance the first authorization data model into translated authorization information that complies with a second authorization data model, wherein the second authorization data model is different from the first authorization data model;
• and
• publish, with the authentication device, the translated authorization information to an intermediate storage device that implements the second authorization data model.

A non-transitory computer-readable medium comprising instructions for causing a programmable processor to:

• receive, with a network security device, network traffic from an endpoint device;
• in response to receiving the network traffic, request, with the network security device, authorization information from an intermediate storage device in accordance with an Interface for Metadata Access Point (IF-MAP) protocol, wherein the intermediate storage device stores the authorization information in accordance with a first IF-MAP authorization data model that conforms to an IF-MAP standard;
• receive, with the network security device, the authorization information from the intermediate storage device;
• apply, with the network security device, an import translation policy to translate the authorization information stored in accordance the first IF-MAP authorization data model into translated authorization information that complies with a second proprietary authorization data model, wherein the second IF-MAP authorization data model is different from the first proprietary authorization data model;
• and
• forward, with the network security device, the network traffic based on the translated authorization information.