US6941465B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method of enforcing a policy on a computer network
Assignee: Microsoft Technology Licensing LLC
•
Filing: 1999-07-26
•
Granted: 2005-09-06
•
Expires: 2019-07-26
Abstract
Abstract A policy server program evaluates one or more policy statements based on the group or groups to which a user belongs as well as other conditions. Each policy statement expresses an implementation of the access policy of the network, and is associated with a profile. The profile contains one or more actions that are to be applied to the user. The policy server program determines the identity of the group or groups to which the user belongs by referencing one or more group attributes contained in a user object which is located in a directory on the network. The user object and its group parameters are established when the user is added to the directory, while a policy statement for a group can be created at any time.
Inventors
- 👤 Ashwin Palekar
- 👤 Bernard D. Aboba
- 👤 Narendra C. Gidwani
- 👤 Michel Guittet
- 👤 Todd L. Paul
- 👤 David L. Eitelbach
- 👤 Stephen E. Bensley
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 13:22
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/10; H04L63/102; G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; H04L63/20
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
189 words
A method for enforcing a selected policy from a set of polices maintained by a policy server to be applied to a user interconnected to a network through a communication path, wherein the network includes a gateway and one or more resources, comprising: receiving, by the gateway, a request from the user to access the one or more resources on the network; selecting a user object from a plurality of stored objects, wherein the user object corresponds to the user and includes a set of attributes comprising a group to which the user belongs, a user name, password, and an override attribute; determining whether to grant or deny access to the network based upon the user name and password; identifying a profile that applies to the user based on the set of attributes, including the group to which the user belongs, wherein the profile includes an authorization parameter and a communication parameter; determining, by the gateway, whether to grant or deny access to the resources on the network based upon the authorization parameter; and configuring the communication path, including setting quality of service (QOS) based upon the communication parameter.
Claim 2
Independent Claim
189 words
A method for enforcing a selected policy from a set of polices maintained by a policy server to be applied to a user interconnected to a network through a communication path, wherein the network includes a gateway and one or more resources, comprising: receiving, by the gateway, a request from the user to access the one or more resources on the network; selecting a user object from a plurality of stored objects, wherein the user object corresponds to the user and includes a set of attributes comprising a group to which the user belongs, a user name, password, and an override attribute; determining whether to grant or deny access to the network based upon the user name and password; identifying a profile that applies to the user based on the set of attributes, including the group to which the user belongs, wherein the profile includes an authorization parameter and a communication parameter; determining, by the gateway, whether to grant or deny access to the resources on the network based upon the authorization parameter; and configuring the communication path, including setting quality of service (QOS) based upon the communication parameter.
Claim 3
Dependent Claim
13 words
The method of claim 1 , wherein the network is a virtual network.
Claim 4
Dependent Claim
46 words
The method of claim 1 , further comprising: determining a characteristic of the communication path between the user and the gateway; and determining, at the gateway, whether to grant or deny access to the one or more resources on the network based on the determined characteristic.
Claim 5
Dependent Claim
17 words
The method of claim 3 , wherein the characteristic of the communication path is a call-back number.
Claim 6
Dependent Claim
13 words
The method of claim 3 , wherein the characteristic is a medium type.
Claim 7
Dependent Claim
22 words
The method of claim 1 , wherein the gateway is interposed between the user and each of the resources on the network.
Claim 8
Dependent Claim
16 words
The method of claim 1 , further comprising: replacing the authorization parameter with the override attribute.
Claim 9
Dependent Claim
16 words
The method of claim 1 , further comprising: replacing the communication parameter with the override attribute.
Claim 10
Dependent Claim
33 words
The method of claim 1 , wherein the communication parameter includes an authentication type and the step of configuring the communication path comprises setting the authentication type to be applied to the user.
Claim 11
Dependent Claim
18 words
The method of claim 1 , wherein the step of configuring the communication path comprises setting a bandwidth.
Claim 12
Dependent Claim
23 words
The method of claim 1 , wherein the step of configuring the communication path comprises establishing a network address assigned to the user.
Claim 13
Dependent Claim
30 words
The method of claim 1 , wherein the step of configuring the communication path comprises establishing an encryption level to be applied to communications between the user and the network.
Claim 14
Dependent Claim
25 words
The method of claim 1 , wherein the authorization parameter represents a time of day during which the user is permitted to access the network.
Claim 15
Dependent Claim
26 words
The method of claim 1 , wherein the authorization parameter represents a phone number from which the user is permitted to call and access the network.
Claim 16
Dependent Claim
196 words
A computer-readable medium having computer-readable instructions for a method for enforcing a selected policy from a set of polices maintained by a policy server to be applied to a user interconnected to a network through a communication path, wherein the network includes a gateway and one or more resources, comprising: receiving, by the gateway, a request from the user to access the one or more resources on the network; selecting a user object from a plurality of stored objects, wherein the user object corresponds to the user and includes a set of attributes comprising a group to which the user belongs, a user name, password, and an override attribute; determining whether to grant or deny access to the network based upon the user name and password; identifying a profile that applies to the user based on the set of attributes, including the group to which the user belongs, wherein the profile includes an authorization parameter and a communication parameter; determining, by the gateway, whether to grant or deny access to the resources on the network based upon the authorization parameter; and configuring the communication path, including setting quality of service (QOS), based upon the communication parameter.
Claim 17
Dependent Claim
196 words
A computer-readable medium having computer-readable instructions for a method for enforcing a selected policy from a set of polices maintained by a policy server to be applied to a user interconnected to a network through a communication path, wherein the network includes a gateway and one or more resources, comprising: receiving, by the gateway, a request from the user to access the one or more resources on the network; selecting a user object from a plurality of stored objects, wherein the user object corresponds to the user and includes a set of attributes comprising a group to which the user belongs, a user name, password, and an override attribute; determining whether to grant or deny access to the network based upon the user name and password; identifying a profile that applies to the user based on the set of attributes, including the group to which the user belongs, wherein the profile includes an authorization parameter and a communication parameter; determining, by the gateway, whether to grant or deny access to the resources on the network based upon the authorization parameter; and configuring the communication path, including setting quality of service (QOS), based upon the communication parameter.
Claim 18
Dependent Claim
14 words
The computer-readable medium of claim 15 , wherein the network is a virtual network.
Claim 19
Dependent Claim
47 words
The computer-readable medium of claim 15 , further comprising: determining a characteristic of the communication path between the user and the gateway; and determining, at the gateway, whether to grant or deny access to the one or more resources on the network based upon the determined characteristic.
Claim 20
Dependent Claim
17 words
The computer-readable medium of claim 15 , further comprising: replacing the authorization parameter with the override attribute.
Claim 21
Dependent Claim
17 words
The computer-readable medium of claim 15 , further comprising: replacing the communication parameter with the override attribute.
Claim 22
Dependent Claim
34 words
The computer-readable medium of claim 15 , wherein the communication parameter includes an authentication type and the step of configuring the communication path comprises setting the authentication type to be applied to the user.
Claim 23
Dependent Claim
19 words
The computer-readable medium of claim 15 , wherein the step of configuring the communication path comprises setting a bandwidth.
Claim 24
Dependent Claim
24 words
The computer-readable medium of claim 15 , wherein the step of configuring the communication path comprises establishing a network address assigned to the user.
Claim 25
Dependent Claim
31 words
The computer-readable medium of claim 15 , wherein the step of configuring the communication path comprises establishing an encryption level to be applied to communications between the user and the network.
References Cited (Backward Citations)
US6163536A
Cited
US6339830B1
Cited
US6041347A
Cited
US6070244A
Cited
US6192361B1
Cited
US6182142B1
Cited
US6493749B2
Cited
US6470453B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-09-05 | 2009-03-07 | 2009-09-06 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-09-05 | 2013-03-07 | 2013-09-06 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-09-05 | 2017-03-07 | 2017-09-06 | $7700.00 | Window Closed / Lapsed |