US6339830B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Deterministic user authentication service for communication network
Assignee: Alcatel USA Sourcing Inc
•
Filing: 2000-03-15
•
Granted: 2002-01-15
•
Expires: 2020-03-15
Abstract
Abstract A user authentication service for a communication network authenticates local users before granting them access to personalized sets of network resources. Authentication agents on intelligent edge devices present users of associated end systems with log-in challenges. Information supplied by the users is forwarded to an authentication server for verification. If successfully verified, the authentication server returns to the agents authorized connectivity information and time restrictions for the particular authenticated users. The agents use the information to establish rules for filtering and forwarding network traffic originating from or destined for particular authenticated users during authorized time periods. An enhanced authentication server may be engaged if additional security is desired. The authorized connectivity information preferably includes identifiers of one or more virtual local area networks active in the network. Log-in attempts are recorded so that the identity and whereabouts of network users may be monitored from a network management station.
Inventors
- 👤 Michael E. See
- 👤 John W. Bailey
- 👤 Charles L. Panza
- 👤 Yuri Pikover
- 👤 Geoffrey C. Stone
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 04:25
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/44; G06F21/445; H04L63/10; H04L63/102; G06F2221/00; G06F2221/21; G06F2221/2101; G06F2221/2137; G06F2221/2141; H04L12/00; H04L12/28; H04L12/46; H04L12/4641; H04L63/0823; H04L63/083; H04L63/101
Claims Analysis
Total Claims: 55
Claim 1
Independent Claim
97 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to a second node the first user identification information, the second node having second user identification information; comparing for a match on the second node the first user identification information with the second user identification information; and authorizing communication between the first node and a group of nodes on the communication network in response to a match, wherein the group of nodes is represented by a virtual local area network identifier.
Claim 2
Dependent Claim
97 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to a second node the first user identification information, the second node having second user identification information; comparing for a match on the second node the first user identification information with the second user identification information; and authorizing communication between the first node and a group of nodes on the communication network in response to a match, wherein the group of nodes is represented by a virtual local area network identifier.
Claim 3
Dependent Claim
100 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to a second node the first user identification information, the second node having second user identification information; comparing for a match on the second node the first user identification information with the second user identification information; and establishing communicability between the first node and a group of nodes associated with the second user identification information in response to a match, wherein the group of nodes is represented by a virtual local area network identifier.
Claim 4
Dependent Claim
100 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to a second node the first user identification information, the second node having second user identification information; comparing for a match on the second node the first user identification information with the second user identification information; and establishing communicability between the first node and a group of nodes associated with the second user identification information in response to a match, wherein the group of nodes is represented by a virtual local area network identifier.
Claim 5
Dependent Claim
26 words
The method of claim 2 , wherein the first, second and group of nodes include devices selected from the group consisting of computers, workstations, and servers.
Claim 6
Dependent Claim
25 words
The user authentication method according to claim 2 , wherein the communicability is established for an access period associated with the second user identification information.
Claim 7
Dependent Claim
24 words
The user authentication method of claim 2 , wherein the first node includes an authentication client and the second node includes an authentication server.
Claim 8
Dependent Claim
66 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: associating a user of the network with a group of nodes represented by a virtual local area network based on a unique user key; verifying the unique user key in a log-in sequence; and authorizing communication between the user and the group of nodes upon verifying the unique user key.
Claim 9
Dependent Claim
66 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: associating a user of the network with a group of nodes represented by a virtual local area network based on a unique user key; verifying the unique user key in a log-in sequence; and authorizing communication between the user and the group of nodes upon verifying the unique user key.
Claim 10
Dependent Claim
26 words
The user authentication method according to claim 6 , wherein the group of nodes is represented in the association by a virtual local area network identifier.
Claim 11
Dependent Claim
17 words
The user authentication method according to claim 6 , wherein the unique user key comprises a password.
Claim 12
Dependent Claim
80 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: associating a user of the network with a group of nodes and an access period based on a unique user key; verifying the unique user key in a log-in sequence; and authorizing communication between the user and the group of nodes for the access period upon verifying the unique user key, wherein the group of nodes is represented by a virtual local area network.
Claim 13
Dependent Claim
80 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: associating a user of the network with a group of nodes and an access period based on a unique user key; verifying the unique user key in a log-in sequence; and authorizing communication between the user and the group of nodes for the access period upon verifying the unique user key, wherein the group of nodes is represented by a virtual local area network.
Claim 14
Dependent Claim
26 words
The user authentication method according to claim 8 , wherein the group of nodes is represented in the association by a virtual local area network identifier.
Claim 15
Dependent Claim
17 words
The user authentication method according to claim 8 , wherein the unique user key comprises a password.
Claim 16
Dependent Claim
82 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: associating based on a unique user key each of a plurality of users of the network with a group of nodes represented by a virtual local area network selected for the user; and verifying in a log-in sequence for each of the plurality of users the user's unique user key prior to establishing communicability between the user and the group of nodes selected for the user.
Claim 17
Dependent Claim
82 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: associating based on a unique user key each of a plurality of users of the network with a group of nodes represented by a virtual local area network selected for the user; and verifying in a log-in sequence for each of the plurality of users the user's unique user key prior to establishing communicability between the user and the group of nodes selected for the user.
Claim 18
Dependent Claim
26 words
The user authentication method according to claim 12 , wherein each group of nodes is represented in the association by a virtual local area network identifier.
Claim 19
Dependent Claim
17 words
The user authentication method according to claim 12 , wherein each unique user key comprises a password.
Claim 20
Dependent Claim
93 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to a second node the first user identification information, the second node having a database with pairs of user identification information and network resources; searching the database for paired user identification information matching the first user identification information; and authorizing communication between the first node and the network resources paired with matching user identification information, wherein the network resources are represented by a virtual local area network.
Claim 21
Dependent Claim
93 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to a second node the first user identification information, the second node having a database with pairs of user identification information and network resources; searching the database for paired user identification information matching the first user identification information; and authorizing communication between the first node and the network resources paired with matching user identification information, wherein the network resources are represented by a virtual local area network.
Claim 22
Dependent Claim
118 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node a first user identification information; transmitting to a second node the first user identification information, the second node having second user identification information; comparing for a match on the second node the first user identification information with the second user identification information; and initiating upon a match an enhanced authentication for the user, whereby more information is solicited from the user and compared with information on a third node prior to establishing communicability between the user and a group of nodes represented by a virtual local area network identifier with which the user is authorized to communicate.
Claim 23
Dependent Claim
118 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node a first user identification information; transmitting to a second node the first user identification information, the second node having second user identification information; comparing for a match on the second node the first user identification information with the second user identification information; and initiating upon a match an enhanced authentication for the user, whereby more information is solicited from the user and compared with information on a third node prior to establishing communicability between the user and a group of nodes represented by a virtual local area network identifier with which the user is authorized to communicate.
Claim 24
Dependent Claim
144 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to an authentication agent on a second node communicating with the first node over a LAN link the first user identification information; relaying from the authentication agent to an authentication server the first user identification information; comparing on the authentication server the first user identification information with user identification information in a database of user identification information; and transmitting from the authentication server to the authentication agent, if the first user identification information matches user identification information in the database of user identification information, information notifying the authentication agent that a user on the first node has been authenticated whereupon the authentication agent authorizes transmission on the second node of packets in data flows involving the first node.
Claim 25
Dependent Claim
144 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to an authentication agent on a second node communicating with the first node over a LAN link the first user identification information; relaying from the authentication agent to an authentication server the first user identification information; comparing on the authentication server the first user identification information with user identification information in a database of user identification information; and transmitting from the authentication server to the authentication agent, if the first user identification information matches user identification information in the database of user identification information, information notifying the authentication agent that a user on the first node has been authenticated whereupon the authentication agent authorizes transmission on the second node of packets in data flows involving the first node.
Claim 26
Dependent Claim
23 words
The user authentication method according to claim 17 , wherein the first node and second node are co-located in a local area network.
Claim 27
Dependent Claim
18 words
The user authentication method according to claim 17 , wherein the authentication server resides on the second node.
Claim 28
Dependent Claim
18 words
The user authentication method according to claim 17 , wherein the authentication server resides on a third node.
Claim 29
Dependent Claim
23 words
The user authentication method according to claim 17 , wherein the authorization includes data flows for which the first node is the source.
Claim 30
Dependent Claim
23 words
The user authentication method according to claim 17 , wherein the authorization includes data flows for which the first node is the destination.
Claim 31
Dependent Claim
117 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: transmitting a log-in response from an end system being used by a user to an authentication agent; relaying the log-in response to an authentication server; reviewing the log-in response at the authentication server to determine if the user is authorized; and transmitting to the authentication agent a list of network resources for which the user is authorized, along with any time restrictions whereupon the authentication agent applies the authorized list of network resources and time restrictions to establish network connectivity rules for the user, wherein the authentication agent is located on a node having a LAN link to the end system.
Claim 32
Dependent Claim
117 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: transmitting a log-in response from an end system being used by a user to an authentication agent; relaying the log-in response to an authentication server; reviewing the log-in response at the authentication server to determine if the user is authorized; and transmitting to the authentication agent a list of network resources for which the user is authorized, along with any time restrictions whereupon the authentication agent applies the authorized list of network resources and time restrictions to establish network connectivity rules for the user, wherein the authentication agent is located on a node having a LAN link to the end system.
Claim 33
Dependent Claim
113 words
A user authentication system for a communication network comprising: a first node for entering user identification information; a second node for receiving the user identification information from the first node and comparing for a match the user identification information with user identification information in a database of user identification information; and a port on the second node that is authenticated upon a match for allowing communication between the first node and a group of nodes associated with the user identification information, and is not authenticated upon a mismatch, thereby failing to establish communication between the first node and other nodes, wherein the group of nodes is associated with a virtual local area network.
Claim 34
Dependent Claim
113 words
A user authentication system for a communication network comprising: a first node for entering user identification information; a second node for receiving the user identification information from the first node and comparing for a match the user identification information with user identification information in a database of user identification information; and a port on the second node that is authenticated upon a match for allowing communication between the first node and a group of nodes associated with the user identification information, and is not authenticated upon a mismatch, thereby failing to establish communication between the first node and other nodes, wherein the group of nodes is associated with a virtual local area network.
Claim 35
Dependent Claim
15 words
The system according to claim 24 , wherein the database resides on the second node.
Claim 36
Dependent Claim
15 words
The system according to claim 24 , wherein the database resides on a third node.
Claim 37
Dependent Claim
24 words
The authentication system of claim 24 , wherein the node is selected from the group consisting of a computer, a workstation, and a server.
Claim 38
Dependent Claim
122 words
A user authentication system for a communication network comprising: a node interconnected to an edge device over a LAN, the edge device managing the packet flow from the node to a backbone network; and the backbone network coupled to a network management station, wherein the edge device comprises: an authentication module interfacing with the node, performing LAN media translations so that the edge device supports nodes operating using disparate LAN media; a backbone module for interfacing the authentication module to the backbone network; a switching link for switching packets from the authentication module to the backbone module, thereby allowing packets from authenticated users to flow between the node and the backbone network; and a management processor module for managing the switching link.
Claim 39
Dependent Claim
122 words
A user authentication system for a communication network comprising: a node interconnected to an edge device over a LAN, the edge device managing the packet flow from the node to a backbone network; and the backbone network coupled to a network management station, wherein the edge device comprises: an authentication module interfacing with the node, performing LAN media translations so that the edge device supports nodes operating using disparate LAN media; a backbone module for interfacing the authentication module to the backbone network; a switching link for switching packets from the authentication module to the backbone module, thereby allowing packets from authenticated users to flow between the node and the backbone network; and a management processor module for managing the switching link.
Claim 40
Dependent Claim
20 words
The authentication module of claim 28 , wherein the authentication module filters and forwards packets to and from the node.
Claim 41
Dependent Claim
20 words
The authentication module of claim 28 , wherein the authentication module interprets and modifies packets to and from the node.
Claim 42
Dependent Claim
78 words
The authentication system of claim 28 , wherein the network management station comprises: a database of user records; and an authentication server that compares user identity information with the user records in the database, and upon a match, the authentication server sends to the edge device, a list of network resources that a user on the first node is authorized to use, and upon a mismatch, the authentication server sends to the edge device an indication of non-authorization.
Claim 43
Dependent Claim
72 words
A user authentication system for a communication network, comprising: a first node being used by a user; and a second node communicating with the first node over a LAN link, the second node providing the sole interface between the first node and a LAN backbone, wherein the second node denies the first node access to the LAN backbone prior to the user becoming authenticated, except for conducting a user authentication protocol exchange.
Claim 44
Dependent Claim
72 words
A user authentication system for a communication network, comprising: a first node being used by a user; and a second node communicating with the first node over a LAN link, the second node providing the sole interface between the first node and a LAN backbone, wherein the second node denies the first node access to the LAN backbone prior to the user becoming authenticated, except for conducting a user authentication protocol exchange.
Claim 45
Dependent Claim
35 words
The user authentication system according to claim 32 , wherein the second node permits the first node access to the LAN backbone for other than the user authentication protocol exchange after the user becomes authenticated.
Claim 46
Dependent Claim
30 words
The user authentication system according to claim 32 , wherein the second node permits the first node access to the LAN backbone for data exchange after the user becomes authenticated.
Claim 47
Dependent Claim
83 words
A user authentication system for a communication network, comprising: a first node being used by a user; and a second node communicating with the first node over a LAN link, the second node providing an exclusive point of access for the first node to the network, wherein the network is an institutional communication network and wherein prior to the user becoming authenticated the second node permits the first node access to the network solely for conducting an authentication protocol exchange with the user.
Claim 48
Dependent Claim
83 words
A user authentication system for a communication network, comprising: a first node being used by a user; and a second node communicating with the first node over a LAN link, the second node providing an exclusive point of access for the first node to the network, wherein the network is an institutional communication network and wherein prior to the user becoming authenticated the second node permits the first node access to the network solely for conducting an authentication protocol exchange with the user.
Claim 49
Dependent Claim
29 words
The user authentication system according to claim 35 , wherein after the user becomes authenticated the second node permits the first node access to the network for data exchange.
Claim 50
Dependent Claim
140 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to an authentication agent on a second node communicating with the first node over a LAN link the first user identification information; relaying from the authentication agent to an authentication server the first user identification information; comparing on the authentication server the first user identification information with user identification information in a database of user identification information; transmitting from the authentication server to the authentication agent, the result of the comparison; transmitting from the authentication server to the authentication agent a list of network resources for which the user is authorized if the result is a match; and associating a list of network resources with the first node if the result is a match.
Claim 51
Dependent Claim
140 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to an authentication agent on a second node communicating with the first node over a LAN link the first user identification information; relaying from the authentication agent to an authentication server the first user identification information; comparing on the authentication server the first user identification information with user identification information in a database of user identification information; transmitting from the authentication server to the authentication agent, the result of the comparison; transmitting from the authentication server to the authentication agent a list of network resources for which the user is authorized if the result is a match; and associating a list of network resources with the first node if the result is a match.
Claim 52
Dependent Claim
34 words
The user authentication method of claim 37 further comprising filtering and forwarding packets between the first node and the network resources of the list according to the association if the result is a match.
Claim 53
Dependent Claim
24 words
The user authentication method of claim 38 further comprising dropping packets between the first node and other nodes if the result is a mismatch.
Claim 54
Dependent Claim
190 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to an authentication agent on a second node the first user identification information; relaying from the authentication agent to an authentication server the first user identification information; comparing on the authentication server the first user identification information with user identification information in a database of user identification information; transmitting from the authentication server to the authentication agent, the result of the comparison; transmitting from the authentication server to the authentication agent a list of network resources for which the user is authorized if the result is a match; associating a list of network resources with the first node if the result is a match; forwarding packets between the first node and a destination node if the result is a match and the nodes share a common VLAN; dropping packets between the first node and a destination node if the result is not a match; and dropping packets between the first node and a destination node if the nodes do not share a common VLAN.
Claim 55
Dependent Claim
190 words
A user authentication method for a communication network having a plurality of nodes, the method comprising: entering on a first node first user identification information; transmitting to an authentication agent on a second node the first user identification information; relaying from the authentication agent to an authentication server the first user identification information; comparing on the authentication server the first user identification information with user identification information in a database of user identification information; transmitting from the authentication server to the authentication agent, the result of the comparison; transmitting from the authentication server to the authentication agent a list of network resources for which the user is authorized if the result is a match; associating a list of network resources with the first node if the result is a match; forwarding packets between the first node and a destination node if the result is a match and the nodes share a common VLAN; dropping packets between the first node and a destination node if the result is not a match; and dropping packets between the first node and a destination node if the nodes do not share a common VLAN.
References Cited (Backward Citations)
US4922486A
Cited
US4896319A
Cited
US4962449A
Cited
US5414844A
Cited
US5191613A
Cited
US5272754A
Cited
US5249230A
Cited
US5499297A
Cited
US5502766A
Cited
US5311593A
Cited
US5469576A
Cited
US5657388A
Cited
US5774650A
Cited
US5778065A
Cited
US5343529A
Cited
US5678004A
Cited
US5564016A
Cited
US5761309A
Cited
US5774525A
Cited
US5671354A
Cited
US5721780A
Cited
US5696898A
Cited
US5774551A
Cited
US5784566A
Cited
US6055638A
Cited
US5684951A
Cited
US6061790A
Cited
US5796942A
Cited
US5852714A
Cited
US6070243A
Cited
US6070240A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-01-14 | 2005-07-16 | 2006-01-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-01-14 | 2009-07-16 | 2010-01-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-01-14 | 2013-07-16 | 2014-01-15 | $7700.00 | Window Closed / Lapsed |