Methods and devices for enforcing network access control utilizing secure packet tagging

A method for enforcing network access control, the method comprising the steps of:

• (a) storing a packet fragment, received from a protocol stack, in a buffer;
• (b) determining whether said packet fragment is a last packet fragment in a fragmented packet;
• and
• (c) if said packet fragment is said last fragment:
• (i)computing a packet signature using a per-endpoint secret key,
• (ii) embedding said packet signature into each packet fragment of said fragmented packet, and
• (iii) transmitting said packet, of which said packet fragment is said last fragment, to a network;
• wherein said computing of said packet signature is based at least in part on at least a portion of contents of a payload of said packet.

A device for enforcing network access control, the device comprising:

• (a) a gateway configured for:
• (i) receiving a packet fragment from a network;
• (ii) extracting a packet signature from said packet;
• (iii) storing said packet signature and said packet fragment in a buffer;
• (iv) subsequent to said extracting and storing, determining whether said packet fragment is a last fragment in a fragmented packet;
• and
• (v) if said packet fragment is said last fragment:
• (A) computing a local signature using a per-endpoint secret key,
• (B) comparing said packet signature to said local signature to determine whether said packet signature and said local signature are identical, and
• (C) only if said packet signature and said local signature are identical:
• transmitting said packet, of which said packet fragment is said last fragment, to a protocol stack;
• and
• (b) said buffer;
• wherein said computing of said local signature is based at least in part on at least a portion of contents of a payload of said packet.

A device for enforcing network access control, the device comprising:

• (a) a gateway configured for:
• (i) storing a packet fragment, received from a protocol stack, in a buffer;
• (ii) determining whether said packet fragment is a last fragment in a fragmented packet;
• and
• (iii) if said packet fragment is said last fragment:
• (A) computing a packet signature using a per-endpoint secret key,
• (B) embedding said packet signature into each packet fragment of said fragmented packet, and
• (C) transmitting said packet, of which said packet fragment is said last fragment, to a network;
• and
• (b) said buffer;
• wherein said computing of said packet signature is based at least in part on at least a portion of contents of a payload of said packet.

A non-transitory computer-readable storage medium having computer-readable code embodied on the computer-readable storage medium, the computer-readable code comprising program code for:

• for every packet fragment received from a network:
• (a) extracting a packet signature from said packet fragment;
• (b) storing said packet signature and said packet fragment in a buffer;
• (c) determining whether said packet fragment is a last fragment in a fragmented packet;
• and
• (d) if said fragment is said last fragment:
• (i) computing a local signature using a per-endpoint secret key,
• (ii) comparing said packet signature to said local signature to determine whether said packet signature and said local signature are identical, and
• (iii) only if said packet signature and said local signature are identical:
• transmitting said packet, of which said packet fragment is said last fragment, to a protocol stack;
• wherein said computing of said local signature is based at least in part on at least a portion of contents of a payload of said packet.

A non-transitory computer-readable storage medium having computer-readable code embodied on the computer-readable storage medium, the computer-readable code comprising:

• (a) program code for storing a packet fragment, received from a protocol stack, in a buffer;
• (b) program code for determining whether said packet fragment is a last fragment in a fragmented packet;
• and
• (c) program code for:
• if said packet fragment is said last fragment:
• (i) computing a packet signature using a per-endpoint secret key,
• (ii) embedding said packet signature into each packet fragment of said fragmented packet, and
• (iii) transmitting said packet, of which said packet fragment is said last fragment, to a network;
• wherein said computing of said packet signature is based at least in part on at least a portion of contents of a payload of said packet.

A method for enforcing network access control, the method comprising the steps of:

• for every packet fragment received from a network:
• (a) extracting a packet signature from said packet fragment;
• (b) storing said packet signature and said packet fragment in a buffer;
• (c) determining whether said packet fragment is a last fragment in a fragmented packet;
• (d) if said packet fragment is said last fragment:
• (i) computing a local signature using a per-endpoint secret key,
• (ii) comparing said packet signature to said local signature to determine whether said packet signature and said local signature are identical,
• (iii) only if said packet signature and said local signature are identical:
• transmitting said packet, of which said packet fragment is said last fragment, to a protocol stack;
• and
• (e) otherwise, storing a next fragment in said buffer;
• wherein said computing of said local signature is based at least in part on at least a portion of contents of a payload of said packet.

A method for enforcing network access control, the method comprising the steps of:

• (a) storing a packet fragment, received from a protocol stack, in a buffer;
• (b) determining whether said packet fragment is a last fragment in a fragmented packet;
• (c) if said packet fragment is said last fragment:
• (i) computing a packet signature using a per-endpoint secret key,
• (ii) embedding said packet signature into each packet fragment of said fragmented packet, and
• (iii) transmitting said packet, of which said packet fragment is said last fragment, to a network;
• and
• (d) otherwise, storing a next fragment in said buffer;
• wherein said computing of said packet signature is based at least in part on at least a portion of contents of a payload of said packet.

A device for enforcing network access control, the device comprising:

• (a) a gateway configured for:
• (i) receiving a packet fragment from a network;
• (ii) extracting a packet signature from said packet;
• (iii) storing said packet signature and said packet fragment in a buffer;
• (iv) subsequent to said extracting and storing, determining whether said packet fragment is a last fragment in a fragmented packet;
• (v) if said packet fragment is said last fragment:
• (A) computing a local signature using a per-endpoint secret key,
• (B) comparing said packet signature to said local signature to determine whether said packet signature and said local signature are identical, and
• (C) only if said packet signature and said local signature are identical:
• transmitting said packet, of which said packet fragment is said last fragment, to a protocol stack;
• and
• (vi) otherwise, storing a next fragment in said buffer;
• and
• (b) said buffer;
• wherein said computing of said local signature is based at least in part on at least a portion of contents of a payload of said packet.

A device for enforcing network access control, the device comprising:

• (a) a gateway configured for:
• (i) storing a packet fragment, received from a protocol stack, in a buffer;
• (ii) determining whether said packet fragment is a last fragment in a fragmented packet;
• (iii) only if said packet fragment is said last fragment:
• (A) computing a packet signature using a per-endpoint secret key,
• (B) embedding said packet signature into each packet fragment of said fragmented packet, and
• (iv) transmitting said packet, of which said packet fragment is said last fragment, to a network;
• and
• (iv) otherwise, storing a next fragment in said buffer;
• and
• (b) said buffer;
• wherein said computing of said packet signature is based at least in part on at least a portion of contents of a payload of said packet.

A non-transitory computer-readable storage medium having computer-readable code embodied on the computer-readable storage medium, the computer-readable code comprising program code for:

• for every packet fragment received from a network:
• (a) extracting a packet signature from said packet fragment;
• (b) storing said packet signature and said packet fragment in a buffer;
• (c) determining whether said packet fragment is a last fragment in a fragmented packet;
• and
• (d) if said packet fragment is said last fragment:
• (i) computing a local signature using a per-endpoint secret key,
• (ii) comparing said packet signature to said local signature to determine whether said packet signature and said local signature are identical, and
• (iii) only if said packet signature and said local signature are identical, transmitting said packet, of which said packet fragment is said last fragment, to a protocol stack;
• and
• (e) otherwise, storing a next fragment in said buffer;
• wherein said computing of said local signature is based at least in part on at least a portion of contents of a payload of said packet.

A non-transitory computer-readable storage medium having computer-readable code embodied on the computer-readable storage medium, the computer-readable code comprising:

• (a) program code for storing a packet fragment, received from a protocol stack, in a buffer;
• (b) program code for determining whether said packet fragment is a last fragment in a fragmented packet;
• and
• (c) program code for:
• (i) if said packet fragment is said last fragment:
• (A) computing a packet signature using a per-endpoint secret key,
• (B) embedding said packet signature into each packet fragment of said fragmented packet, and
• (C) program code for transmitting said packet, of which said packet fragment is said last fragment, to a network;
• and
• (ii) otherwise, storing a next fragment in said buffer;
• wherein said computing of said packet signature is based at least in part on at least a portion of contents of a payload of said packet.