US6233686B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for providing peer level access control on a network
Assignee: AT&T Inc
•
Filing: 1997-01-17
•
Granted: 2001-05-15
•
Expires: 2017-01-17
Abstract
Abstract A system and method for providing peer-level access control on networks that carry packets of information, each packet having a 5-tuple having a source and destination address, a source and destination port, and a protocol identifier. The local rule base of a peer is dynamically loaded into a filter when the peer is authenticated, and ejected when the peer is loses authentication. The local rule base is efficiently searched through the use of hash tables wherein a hashed peer network address serves as a pointer the peer's local rules. Each rule comprises a 5-tuple and an action. The action of a rule is carried out on a packet when the 5-tuple of the rule corresponds to the 5-tuple of the packet.
Inventors
- 👤 Daniel N. Zenchelsky
- 👤 Partha P. Dutta
- 👤 Thomas B. London
- 👤 Dalibor F. Vrsalovic
- 👤 Karl Andres Siil
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 13:39
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; H04L63/08
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
182 words
A filter for providing peer level access control on a network having a peer with a local rule base, wherein said filter comprises: a. means for accessing a peer's local rule base; b. means for detecting when the peer is authenticated; c. means for loading a rule from the peer's local rule base at the filter when the authentication of the peer is detected; d. means for receiving a packet having a packet identifier, identifying a corresponding local rule, and carrying out the action of the corresponding local rule on the packet while said filter is filtering packets for the peer, and e. a global pre-rule base having a global pre-rule, wherein upon receiving the packet, said filter first searches said global pre-rule base for a rule that corresponds to the packet and carries out the action of the corresponding global pre-rule on the packet, and wherein if no corresponding global pre-rule is identified, the filter searches the local rule base for a rule that corresponds to the packet and carries out the action of the corresponding local rule on the packet.
Claim 2
Dependent Claim
182 words
A filter for providing peer level access control on a network having a peer with a local rule base, wherein said filter comprises: a. means for accessing a peer's local rule base; b. means for detecting when the peer is authenticated; c. means for loading a rule from the peer's local rule base at the filter when the authentication of the peer is detected; d. means for receiving a packet having a packet identifier, identifying a corresponding local rule, and carrying out the action of the corresponding local rule on the packet while said filter is filtering packets for the peer, and e. a global pre-rule base having a global pre-rule, wherein upon receiving the packet, said filter first searches said global pre-rule base for a rule that corresponds to the packet and carries out the action of the corresponding global pre-rule on the packet, and wherein if no corresponding global pre-rule is identified, the filter searches the local rule base for a rule that corresponds to the packet and carries out the action of the corresponding local rule on the packet.
Claim 3
Dependent Claim
37 words
The filter of claim 1 , further comprising: f. means for detecting when the peer logs off; and g. means for ejecting said local rule base from said filter upon detecting that the peer has logged off.
Claim 4
Dependent Claim
25 words
The filter of claim 1 , wherein the packet identifier comprises a source and destination address, a source and destination port, and a protocol identifier.
Claim 5
Dependent Claim
23 words
The filter of claim 1 , wherein said means for accessing the local rule base comprises receiving and storing the local rule base.
Claim 6
Dependent Claim
13 words
The filter of claim 1 , further comprising means for authenticating the peer.
Claim 7
Dependent Claim
159 words
A filter for providing peer level access control on a network having a peer with a local rule base, wherein said filter comprises: a. means for accessing a peer's local rule base; b. means for detecting when the peer is authenticated; c. means for loading a rule from the peer's local rule base at the filter when the authentication of the peer is detected; d. means for receiving a packet having a packet identifier, identifying a corresponding local rule, and carrying out the action of the corresponding local rule on the packet while said filter is filtering packets for the peer, and e. a global post-rule base, wherein the global post-rule base is searched for a rule that corresponds to the packet, and the action of a global post-rule is carried out if it corresponds to the packet only if no corresponding rule in said global pre-rule base and no corresponding rule in said local rule base are identified.
Claim 8
Dependent Claim
159 words
A filter for providing peer level access control on a network having a peer with a local rule base, wherein said filter comprises: a. means for accessing a peer's local rule base; b. means for detecting when the peer is authenticated; c. means for loading a rule from the peer's local rule base at the filter when the authentication of the peer is detected; d. means for receiving a packet having a packet identifier, identifying a corresponding local rule, and carrying out the action of the corresponding local rule on the packet while said filter is filtering packets for the peer, and e. a global post-rule base, wherein the global post-rule base is searched for a rule that corresponds to the packet, and the action of a global post-rule is carried out if it corresponds to the packet only if no corresponding rule in said global pre-rule base and no corresponding rule in said local rule base are identified.
Claim 9
Dependent Claim
37 words
The filer of claim 6 , further comprising: f. means for detecting when the peer logs off; and g. means for ejecting said local rule base from said filter upon detecting that the peer has logged off.
Claim 10
Dependent Claim
25 words
The filter of claim 6 , wherein the packet identifier comprises a source and destination address, a source and destination port, and a protocol identifier.
Claim 11
Dependent Claim
23 words
The filter of claim 6 , wherein said means for accessing the local rule base comprises receiving and storing the local rule base.
Claim 12
Dependent Claim
13 words
The filter of claim 6 , further comprising means for authenticating the peer.
Claim 13
Dependent Claim
157 words
A filter for providing peer level access control on a network having a peer with a local rule base, wherein said filter comprises: a. means for accessing a peer's local rule base; b. means for detecting when the peer is authenticated; c. means for loading a rule from the peer's local rule base at the filter when the authentication of the peer is detected; d. means for receiving a packet having a packet identifier, identifying a corresponding local rule, and carrying out the action of the corresponding local rule on the packet while said filter is filtering packets for the peer, and e. a default rule, wherein if no corresponding pre-global rule and no corresponding local rule and no corresponding post-global rule are identified, said filter carries out the action of said default rule if said default rule corresponds to the packet, and generates an error condition if said default rule does not correspond to the packet.
Claim 14
Dependent Claim
157 words
A filter for providing peer level access control on a network having a peer with a local rule base, wherein said filter comprises: a. means for accessing a peer's local rule base; b. means for detecting when the peer is authenticated; c. means for loading a rule from the peer's local rule base at the filter when the authentication of the peer is detected; d. means for receiving a packet having a packet identifier, identifying a corresponding local rule, and carrying out the action of the corresponding local rule on the packet while said filter is filtering packets for the peer, and e. a default rule, wherein if no corresponding pre-global rule and no corresponding local rule and no corresponding post-global rule are identified, said filter carries out the action of said default rule if said default rule corresponds to the packet, and generates an error condition if said default rule does not correspond to the packet.
Claim 15
Dependent Claim
37 words
The filer of claim 11 , further comprising: f. means for detecting when the peer logs off; and g. means for ejecting said local rule base from said filter upon detecting that the peer has logged off.
Claim 16
Dependent Claim
25 words
The filter of claim 11 , wherein the packet identifier comprises a source and destination address, a source and destination port, and a protocol identifier.
Claim 17
Dependent Claim
23 words
The filter of claim 11 , wherein said means for accessing the local rule base comprises receiving and storing the local rule base.
Claim 18
Dependent Claim
13 words
The filter of claim 11 , further comprising means for authenticating the peer.
Claim 19
Independent Claim
181 words
A method for providing peer-level access control on a network with a peer, said method comprising: a. receiving a packet having a packet identifier; b. searching a global pre-rule base and identifying a global pre-rule that corresponds to the packet; c. carrying out the action of a global pre-rule if the global pre-rule corresponds to the packet; d. loading a local rule base of a peer when the peer is authenticated; e. if no corresponding global pre-rule is found in the global pre-rule base, searching the local rule base, identifying a local rule that corresponds to the packet, and carrying out the action of a local rule if the local rule corresponds to the packet; f. ejecting the local rule base from the filter; g. if no corresponding global pre-rule is found in said global pre-rule base and no corresponding local rule is found in said local rule base, searching a global post-rule base for a global post-rule that corresponds to the packet; and h. carrying out the action of a global post-rule if the global post-rule corresponds to the packet.
Claim 20
Independent Claim
181 words
A method for providing peer-level access control on a network with a peer, said method comprising: a. receiving a packet having a packet identifier; b. searching a global pre-rule base and identifying a global pre-rule that corresponds to the packet; c. carrying out the action of a global pre-rule if the global pre-rule corresponds to the packet; d. loading a local rule base of a peer when the peer is authenticated; e. if no corresponding global pre-rule is found in the global pre-rule base, searching the local rule base, identifying a local rule that corresponds to the packet, and carrying out the action of a local rule if the local rule corresponds to the packet; f. ejecting the local rule base from the filter; g. if no corresponding global pre-rule is found in said global pre-rule base and no corresponding local rule is found in said local rule base, searching a global post-rule base for a global post-rule that corresponds to the packet; and h. carrying out the action of a global post-rule if the global post-rule corresponds to the packet.
Claim 21
Dependent Claim
87 words
The method of claim 16 , further comprising the steps of: i. if no corresponding rule is found in the global pre-rule base and no corresponding rule is found in the local rule base, and no corresponding rule is found in the global post-rule base, determining if the packet corresponds to a default rule; and j. carrying out the action of the default rule if the default rule corresponds to the packet, and generating an error condition if the default rule does not correspond to the packet.
References Cited (Backward Citations)
US5473607A
Cited
US5606668A
Cited
WO1996000549A1
Cited
WO1996005549A1
Cited
US5623601A
Cited
EP0762707A2
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-05-14 | 2004-11-13 | 2005-05-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-05-14 | 2008-11-13 | 2009-05-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-05-14 | 2012-11-13 | 2013-05-15 | $7700.00 | Window Closed / Lapsed |