Network security enhancements using flexible client packets

Abstract

Embodiments of the present disclosure relate to network security enhancements using flexible client packets. In addition to role-based access (e.g., administrator or guest) and device identifier access (e.g., IP or MAC address), systems and methods for custom grouping end user devices using a new group identifier tag (GIT) are provided. Two components may be implemented at the network access device, including a data plane component and a control plane component. For example, a control plane component may authenticate an end user device, store a MAC address and an IP address of the authenticated end user device, and define an access role of the end user device in a data path. The data plane component may perform packet processing according to a previously defined rule. Whenever a data packet arrives at the network access device, the data packet is forwarded according to the "role" in the entry and the rules specified by the GIT, thereby allowing for improved processing and scalability of network traffic processing.

Description

Background Art

[0001] Traditional discretionary access control (DAC) systems implement access control lists (ACLs) to allow authenticated devices to access certain data objects in the network. For example, an ACL can be used to grant or deny write access to a specific file. The ACL can be implemented as a database with individual entries for the devices or groups of devices that are permitted to access these data objects. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] According to one or more different examples, the present disclosure is described in detail with reference to the following drawings. These drawings are provided for illustration purposes only and depict only typical examples.

[0003] Figure 1 Illustrative network access devices that communicate with other network access devices and user equipment via a network are provided according to some examples of the present disclosure.

[0004] Figure 2 User-based grouping of user devices according to some examples of the present disclosure is illustrated.

[0005] Figure 3 Memory components of a system for storing a set of identifiers to enhance network security of a user device according to some examples of the present disclosure are illustrated.

[0006] Figure 4 Memory components of a system for storing role-based rules to enhance network security of a user device according to some examples of the present disclosure are illustrated.

[0007] Figure 5 Illustrated is location-based grouping of user devices according to some examples of the present disclosure.

[0008] Figure 6 Memory components of a system for storing a set of identifiers to enhance network security of a user device according to some examples of the present disclosure are illustrated.

[0009] Figure 7 Memory components of a system for storing role-based rules to enhance network security of a user device according to some examples of the present disclosure are illustrated.

[0010] Figure 8 Illustrated are vendor entity groupings of user devices according to some examples of the present disclosure.

[0011] Fig. 9Memory components of a system for storing a set of identifiers to enhance network security of a user device according to some examples of the present disclosure are illustrated.

[0012] Fig.10 Illustrative data path entries according to some examples of the present disclosure are provided.

[0013] Fig.11 are example computing components that can be used to implement various features of the examples described in this disclosure.

[0014] Fig.12 Depicted is a block diagram of an example computer system in which various examples described herein may be implemented.

[0015] The drawings are not exhaustive and do not limit the disclosure to the precise forms disclosed. DETAILED DESCRIPTION

[0016] The management and distribution of access control lists (ACLs) implemented by traditional discretionary access control (DAC) systems can be resource intensive and inefficient in large networks, especially when authorized users utilize multiple devices to connect to the network. For example, an end user device connects to a network, and after authentication, the device is provided access to components of the network based on an assigned "role" according to the role defined in the ACL. A role is a configurable object provided by a network access device that contains a list of rules that govern access to network resources. The network access device may also have the ability to create multiple roles with different privilege levels (e.g., as defined by a network administrator). The network access device may also have the ability to associate a role with an end user device and to govern traffic to / from the end user device based on the privileges of the role.

[0017] The roles defined in the ACL can also specify what data object resources a device can access. However, network security can be compromised when a user's first device (e.g., a work laptop) has adequate authentication and security installed on the device, while the user's second device (e.g., an IoT or personal mobile device) does not. Different users operating under the same "role" may not be allowed to access each other's data objects.

[0018] Additionally, existing software layers use media access control (MAC) addresses or internet protocol (IP) addresses to identify end-user devices, and store role information for each end-user device in a corresponding user entry. There is no existing solution to map these MAC addresses or IP addresses to ownership information or any other kind of "group" association.

[0019] Examples of the disclosed technology implement any logic-based grouping (e.g., grouping devices or users by device type, device category, credentials, location, operating system, user identifier, or other definition). Logic-based grouping can be implemented using at least two components of a network access device (e.g., an access point (AP) or a switch), and the network access device can analyze new identifiers stored in sent data packets instead of relying on MAC addresses or IP addresses. The two components of the network access device include a data plane component and a control plane component of the network access device. The control plane component can be implemented in software to instruct the data plane component to perform tasks when a data packet is received. For example, the control plane component can authenticate the end-user device, store the MAC address and IP address of the authenticated end-user device, and define the access role of the end-user device in the data path. The data plane component can be implemented in software or hardware to perform data packet processing (e.g., forwarding and policy enforcement) according to the rules defined by the control plane component. The data plane component can analyze each data packet and access a data table storing the association between a specific MAC address or IP address and a "role" applicable to the device (called a "data path user entry"). Whenever a data packet arrives at a network access device, a "data path user entry" is looked up and the packet is forwarded according to the rules specified by the "role" in the entry.

[0020] Using improved control plane components and data plane components at the network access device, the system can assign a group identifier tag (Group Identifier Tag, GIT) to each uniquely identifiable end-user device group. The GIT can identify the grouping of end-user devices according to, for example, device type (e.g., notebook, camera, IoT device, mobile device, mobile phone, management computer or other type of device), device category (e.g., administrator or user), credential (e.g., user or location), location (e.g., building A, building B or other location), operating system type or version (e.g., Android OS, Apple OS, version 16.1.2, etc.), user or supplier identifier, or other defined device or user grouping. Multiple groups of devices can be user-based groupings, device-based groupings, or role-based groupings, etc., and a shared GIT can be assigned to each device in the group. Without departing from the essence of the present disclosure, other groupings can be implemented, including any kind of logical grouping that can be recognized by the components of the network access device.

[0021] The format of the GIT may vary depending on the implementation (e.g., 32-bit or 64-bit unsigned integer) and helps identify any logical end-user device group (e.g., user, location, device type, device category, operating system version, security policy, custom grouping, etc.). The GIT may be encapsulated / added to a data packet by a control plane component, or may be known from programming associated with a data plane, control plane, or central controller. Whenever an end-user device is connected to the network, the control plane component may identify the "group" to which the end-user device belongs and instruct the data plane component to assign a specific GIT (e.g., credentials / username) applicable to the devices in the group. In this way, a first end-user device and a second end-user device corresponding to the same logical grouping may be assigned a first GIT, while a third end-user device not corresponding to the same logical grouping may be assigned a second GIT. Communications transmitted to each other originating from a first end-user device or a second end-user device (e.g., corresponding to the same GIT) may be allowed, and communications transmitted to a third end-user device corresponding to a different GIT may be discarded / rejected originating from a first end-user device or a second end-user device.

[0022] In some examples, the management user can define additional groups based on some parameters of the end-user device. Whenever any packet needs to be processed, the data plane component looks up the source address and destination address of the packet in the "Data Path User Entries". Then, it gets the "Source Role", "Destination Role", "Source GIT" and "Destination GIT" from these data path user entries. If the "Source Role" or "Destination Role" has rules based on the GIT, it forwards / drops the packet according to these rules.

[0023] Technical improvements are achieved throughout the disclosure. For example, the disclosed technology can improve data security and scalability of the entire network by at least separating authentication from users and their device groups. User groups and user device groups can be identified by the GIT, which can provide functionality separate from IP address, MAC address, or role-based access previously assigned to devices / users. This can grant access between multiple devices of a user or multiple devices placed at a single location to access services / content with each other, and restrict access between users or locations when the groups are different.

[0024] Figure 1An illustrative network access device that communicates with other network access devices and user devices via a network according to some examples of the present disclosure is provided. In example 100, the network access device 102 includes a processor 104, a memory 105, and a machine-readable medium 106. The network access device 102 can store, access, and maintain multiple data repositories, including a credential data repository 120 and a group identifier tag (GIT) data repository 122. The network access device 102 communicates with a central controller 128, other network access devices 130, and a first end-user device 132A and a second end-user device 132B (hereinafter referred to as "end-user devices 132") via a network 140.

[0025] For example, processor 104 may include a general purpose or special purpose processing engine such as a microprocessor, controller or other control logic. Processor 104 may be connected to a bus, although any communication medium may be used to facilitate interaction with other components of network access device 102 or external communication.

[0026] Memory 105 may include random access memory (RAM) or other dynamic memory for storing information and instructions to be executed by processor 104. Memory 105 may also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by processor 104. Memory 105 may also include read only memory (ROM) or other static storage devices coupled to the bus for storing static information and instructions for processor 104.

[0027] The machine-readable medium 106 may include one or more interfaces, circuits, components, and modules for implementing the functions discussed herein. The machine-readable medium 106 may carry one or more sequences of one or more instructions for execution by the processor 104. These instructions embodied on the machine-readable medium 106 may enable the overall system to perform the features or functions of the disclosed technology discussed herein. For example, the interfaces, circuits, components, and modules of the machine-readable medium 106 may include, for example, a data processing component 110, a control plane component 112, and a data plane component 114.

[0028] The data processing component 110 is configured to receive and send network traffic as data packets. The network traffic can be sent from the network access device 102 to other network access devices 130, or the network traffic can be sent from the network access device 102 to the end user device 132.

[0029] The content of the data packet sent as a network service may be different. For example, the format of the data packet may include an IPv4 format with a header and a payload. The header of the IPv4 format data packet may consist of 14 fields, including a source IP address, a destination IP address, an offset, a version, and other information. In another example, the format of the data packet may include an IPv6 format with a header and a payload. The header of the IPv6 format data packet may consist of a header and a payload. The header of the IPv6 format data packet may also include a source IP address, a destination IP address, an offset, a version, and other information. Various features of the data packet format may be implemented or removed, including implementing error detection in the high-level protocols of IPv6, such as the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) on the transport layer. IPv4 may allow a UDP datagram header to have no checksum, while IPv6 may require a checksum in the UDP datagram header.

[0030] Any content of the data packet may be used as the end-user device identifier. For example, the end-user device identifier of the end-user device 132A may be the source IP address of the data packet, while the end-user device identifier of the end-user device 132B may be the destination IP address of the data packet.

[0031] In some examples, the data processing component 110 can receive the credentials when the end-user device 132 authenticates or registers, or can authenticate or register the end-user device 132 by itself. When the data processing component 110 receives the credentials, the central controller 128 can receive the credentials from the end-user device 132 and add them to an approved list or a denied list, which can be accessed and implemented at multiple devices that are communicatively connected to the central controller 128. In some examples, the central controller 128 can distribute the GIT to different network access devices 102, 130 or end-user devices 132. The central controller 128 can be implemented / executed as a component on a virtual machine (VM) or a component at a network access device 102, 130 or a cloud (not shown). When the data processing component 110 is able to authenticate or register the end-user device 132 by itself, the data processing component 110 can receive the credentials and add them to the approved list or the denied list before the login attempt without assistance from the central controller 128.

[0032] At the time of authentication / registration of the end-user device 132, the data processing component 110 may compare the credentials in the network service provided at the time of login with the credentials stored in the approved list or the denied list. When the credentials are included in the approved list, the data processing component 110 may grant access to the end-user device 132. When the credentials are included in the denied list, the data processing component 110 may deny access to the end-user device 132. The user credentials may be received via a data transmission in a network that communicatively connects the network access device 102 with the first end-user device 132A and the second end-user device 132B. The user credentials may correspond to a user operating both the first end-user device 132A and the second end-user device 132B.

[0033] The credential may be a credential associated with a user, a credential associated with a location of a device, or some other identifying credential that permits the device / user to authenticate with the system. For example, a network service may include a credential associated with a location of an end-user device 132. The credential may be received via a data transmission in a network that communicatively connects the network access device 102 with the first end-user device 132A and the second end-user device 132B. The credential may correspond to the location at which both the first end-user device 132A and the second end-user device 132B are located, and the two end-user devices may be grouped together.

[0034] The network access device 102 or the central controller 128 may grant access to network resources based on an end-user device identifier (e.g., a source IP address included in a data packet sent from the end-user device 132A). Access to network resources may be granted based on an access control list (ACL), which allows authenticated devices to access certain data objects in the network. In some examples, the network access device 102 or the central controller 128 may assign roles based on role-based access control (RBAC). The end-user device 132 may access network resources based on the role assigned to the end-user device.

[0035] End-user devices and network traffic may include new identifiers stored in transmitted packets, referred to as group identifier tags (GITs). As discussed herein, data plane components 114 may use the GITs stored in GIT data repository 122 to add / append / encapsulate GITs to network traffic.

[0036] The control plane component 112 is configured to authenticate credentials associated with the various end-user devices 132. The credentials may be received via a data transmission in the network 140 that communicatively connects the network access device 102 with the first end-user device 132A and the second end-user device 132B. For example, the credentials may be authenticated by comparing the credentials received during the data transmission with credentials stored in the credential data store 120 (e.g., credentials added by the central controller or the network access device 102 during registration of the end-user device).

[0037] The control plane component 112 is also configured to group the end-user devices 132 by common users or common locations. For example, the control plane component 112 may receive additional network traffic originating from an end-user device not previously identified by the control plane component 112. The control plane component 112 may identify the end-user device associated with the network traffic (e.g., using an end-user device identifier such as a MAC address or an IP address) and associate the network traffic with a particular user (e.g., a second user having a second credential).

[0038] The control plane component 112 is configured to assign a first GIT to a first network service originating from the first end-user device 132A. To assign the GIT to the network service, the control plane component 112 may generate a new GIT associated with any logically based grouping included in the network service data packet (e.g., grouping devices or users by device type, device category, credentials, location, operating system, user identifier, or other definition). The GIT may be stored in the GIT data repository 122.

[0039] In some examples, allocating the GIT to the network traffic is accomplished by sending the GIT from a control plane component 112 of the network access device 102 to a data plane component 114 of the network access device 102 .

[0040] The data plane component 114 can access the GIT data repository 122 and search for a logical grouping that matches the network service data packet, and determine a matching GIT. The data plane component 114 can add / append the GIT to the network service data packet. In some examples, since the control plane component 112 adds the GIT to the GIT data repository 122 and the data plane component 114 accesses the GIT data repository 122, the control plane component 112 can be configured to instruct the data plane component 114 to perform a task (e.g., based on an assigned GIT, role, credential, or other logical grouping) when receiving the data packet.

[0041] The data plane component 114 is configured to add / append / encapsulate an existing GIT into a new network service. For example, the data plane component 114 can automatically add / append a first GIT into a second network service originating from a specific user (e.g., from a second end-user device 132B) received via the network 140. When the user credentials of the second end-user device 132B are received, the existing GIT can be added to the new network service.

[0042] When the GIT is encapsulated with a data packet, the encapsulation process can implement various processes. For example, the network access device 102 can execute a tunneling protocol (such as Generic Routing Encapsulation (GRE)) to encapsulate the network layer protocol in a virtual point-to-point link or a point-to-multipoint link through a transport protocol (such as Internet Protocol (IP)). In another example, the network access device 102 can execute a protocol such as Virtual Extensible LAN (VXLAN) to encapsulate the original Ethernet frame in a User Datagram Protocol (UDP) data packet. The new UDP data packet contains a VXLAN header and a complete original Ethernet header. The encapsulated GIT can be sent in a data packet with the network service.

[0043] The data plane component 114 is also configured to add / append the first GIT to the second network traffic received via the network 140 and originating from a specific location. The location can be identified by a portion of an IP address or a subnet mask. In some examples, a location similar to a known location can be associated with an existing end-user device 132.

[0044] The data plane component 114 is configured to discard network packets received via the network 140. For example, when network traffic is being sent to a device associated with the first GIT and the network packet includes the second GIT, the data plane component 114 can discard the network packet. The network packet can be discarded when the first GIT is different from the second GIT. As discussed, the first GIT and the second GIT can correspond to different users operating the end-user device 132, or in some examples, to different locations where the end-user device 132 is located or other logical-based groupings discussed herein.

[0045] Figure 2 User-based grouping of user devices according to some examples of the present disclosure is illustrated.In example 200, a central controller 210 is communicatively connected to a network access device 220, which is communicatively connected to a plurality of user devices 230,240. Figure 2 The network access device 220 and the user equipment 230, 240 may correspond to Figure 1 network access device 102 and end user device 132.

[0046] In example 200, user-based grouping may be implemented. For example, a first user 212A (user name "ABC") is associated with a first user device 230A and a second user device 240A, and a second user 212B (user name "DEF") is associated with a first user device 230B and a second user device 240B. Two users are illustrated, each corresponding to a unique credential (credential "ABC@mail.com" for the first user 212A and credential "DEF@mail.com" for the second user 212B).

[0047] In addition, role-based access implemented by the central controller 210 or the network access device 220 can be used to assign roles to each user device. For example, the first user device 230A of the first user 212A (user name "ABC") is associated with the first role ("employee") and the IP address (1.0.0.10). The second user device 240A of the first user 212A (user name "ABC") is associated with the second role ("guest") and the IP address (1.0.0.11). The device types of these user devices are "notebook" and "mobile phone", respectively. In another example, the first user device 230B of the second user 212B (user name "DEF") is associated with the first role ("employee") and the IP address (1.0.0.12). The second user device 240B of the second user 212B (user name "DEF") is associated with the second role ("guest") and the IP address (1.0.0.13). The device types of these user devices are "notebook" and "tablet", respectively.

[0048] The central controller 210 or the network access device 220 may be configured to perform policy management, end-user authentication, and end-user device registration (e.g., to be added to an allow list or a deny list). In some examples, the central controller 210 is configured to coordinate the GIT between multiple network access devices so that public user-based access is consistently granted between each network access device. The network access device 220 is also configured to create the GIT and assign the GIT to the end-user device based on the corresponding credentials used to authenticate the device to the network.

[0049] Figure 3 The memory components of a system for storing a set of identifiers to enhance network security of a user device according to some examples of the present disclosure are illustrated. Example 300 is Figure 2An illustrative example of user-based grouping is shown in example 200 of . In example 300 , the data repository includes a GIT 310 that has been assigned to a specific role 320 , an end-user device identifier 330 , and credentials 340 by a control plane component of a network access device.

[0050] In some examples, the end-user device identifier 330 may correspond to an IP address of a particular end-user device. In some implementations, the MAC address and IP address of the end-user device may be stored. The data repository may include other information (e.g., device type, classification, OS version, etc.) related to the first and second end-user devices and corresponding roles in the data path as described herein.

[0051] Figure 4 400 is a diagram illustrating a memory component of a system for storing role-based rules to enhance network security of a user device according to some examples of the present disclosure. Figure 2 An illustrative example of user-based grouping shown in example 200 of . In example 400, the data repository includes ID 410, role 420, and rule 430, which can be combined with a GIT assigned by a control plane component of a network access device for a specific group of end-user devices.

[0052] The rules are provided to be illustrative and should not be limiting. For example, for devices assigned the role of "employee", the rules may be applied in the order in which they are stored in the data repository. When the role of the device is "employee" and the GIT matches between "any source and destination", the network access device may first allow the transmission of the data packet. When the role of the device is "employee" and the data service is provided to the corporate mail server, the network access device may next allow the transmission of the data packet. When the role of the device is "employee" and the data service is transmitted to the Internet, the network access device may next allow the transmission of the data packet.

[0053] In another example, for devices assigned the role of "Guest", the rules may be applied in the order in which they are stored in the data repository. When the role of the device is "Guest" and the GIT matches between "Any Source and Destination", the network access device may first allow the transmission of the data packet. When the role of the device is "Guest" and the data traffic is provided to the corporate mail server, the network access device may then deny any transmission of the data packet. When the role of the device is "Guest" and the data traffic is transmitted to the Internet, the network access device may then allow the transmission of the data packet.

[0054] In these illustrations, different access roles are provided for end-user devices. For example, a company laptop MAC address can be part of a database. After successful authentication, an end-user device with a MAC address from the database can be assigned an "employee" role. Devices with unmatched MAC addresses, such as mobile devices of users with valid usernames / passwords, can be assigned a "guest" role. In addition to the access roles associated with end-user devices, the allocation of GITs can additionally assign network forwarding decisions or other access and communication permissions / restrictions to end-user devices through a separate process. For example, a device with an "employee" role can be enhanced to make network forwarding decisions based on the allocation of GITs and corresponding groups. In this sense, a first end-user device can forward communications within its GIT group, but cannot forward communications or access network resources via a network associated with a second GIT group. In other examples, based on corresponding role-based access in the case of additional allocation of GITs, a second end-user device can access fewer network resources than a first end-user device via a network. This can create multiple layers of access and groups for different permissions in a network via role-based access and solely through GIT allocations based on different groups.

[0055] Figure 5 The diagram illustrates location-based grouping of user devices according to some examples of the present disclosure. In example 500, a central controller 510 is communicatively connected to a plurality of network access devices 520 in different locations / buildings, including a first network device 520A and a second network device 520B. The first network device 520A is communicatively connected to a plurality of user devices 530 located in the same location / building, including a first user device 530A and a second user device 540A. The second network device 520B is also communicatively connected to a plurality of user devices 530 located in the same location / building, including a first user device 530B and a second user device 540B. Figure 5 The network access device 520 and the user devices 530, 540 may correspond to the network access device 102 and the terminal user device 132, respectively.

[0056] In example 500, location-based grouping may be implemented. For example, a first location / building is associated with a first user device 530A and a second user device 540A, and a second location / building is associated with a first user device 530B and a second user device 540B.

[0057] For example, a first location 512A (location name "Building A") is associated with a first network access device 520A, a first user device 530A (device type "laptop"), and a second user device 540A (device type "camera"). A second location 512B (location name "Building B") is associated with a second network access device 520B, a first user device 530B (device type "laptop"), and a second user device 540B (device type "camera"). Two locations are illustrated, each corresponding to a unique credential (credential "Building A" for the first location 512A and credential "Building B" for the second location 512B).

[0058] In addition, role-based access implemented by the central controller 210 or the network access device 220 can be used to assign roles to each user device. For example, a first user device 530A at a first location 512A (location name "Building A") is associated with a first role ("Block Administrator") and an IP address (2.0.0.3). A second user device 540A at a first location 512A (location name "Building A") is associated with a second role ("IoT device") and an IP address (2.0.0.1). The device types of these user devices are "notebook" and "camera", respectively. In another example, a first user device 530B at a second location 512B (location name "Building B") is associated with a first role ("Block Administrator") and an IP address (2.0.0.4). A second user device 540B at a second location 512B (location name "Building B") is associated with a second role ("IoT device") and an IP address (2.0.0.2). The device types of these user devices are "notebook" and "camera", respectively.

[0059] The central controller 510 or the network access devices 520A, 520B can be configured to perform policy management, end-user authentication, and end-user device registration (e.g., to be added to an allow list or a deny list). In some examples, the central controller 510 is configured to coordinate the GIT between multiple network access devices so that access based on a common location is consistently granted between each network access device. The network access devices 520A, 520B are also configured to create the GIT and assign the GIT to the end-user device based on the corresponding credentials (location) used to authenticate the device to the network.

[0060] Figure 6 600 is a diagram illustrating a memory component of a system for storing a set of identifiers to enhance network security of a user device according to some examples of the present disclosure. Figure 5An illustrative example of location-based grouping is shown in example 500 of . In example 600, the data repository includes a GIT 610 that has been assigned to a specific role 620, an end-user device identifier 630, a credential 640, and a device type 650 by a control plane component of a network access device.

[0061] Figure 7 700 is a diagram illustrating a memory component of a system for storing role-based rules to enhance network security of a user device according to some examples of the present disclosure. Figure 5 500 of the example of the illustrative example of user-based grouping shown in. In the example 700, the data repository includes an ID 710, a role 720 and a rule 730, and the rule 730 can be combined with the GIT assigned by the control plane component of the network access device for a specific end-user device group. Figure 4 Similar rules are illustrated and repeated herein.

[0062] Figure 8 Provider entity grouping of user devices according to some examples of the present disclosure is illustrated.In example 800, a plurality of user provider entities 810 are illustrated, wherein a first subset of user devices are communicatively connected to a network access device 840 and / or a network 850. Figure 8 The network access device 840 and the user equipment 820, 830 may correspond to Figure 1 network access device 102 and end user device 132.

[0063] In example 800, two user supplier entities 810 are illustrated as a first user supplier entity 810A (user "ABC") and a second user supplier entity 810B (user "DEF"), where corresponding GITs are assigned to devices associated with a particular user supplier entity. Associated with each supplier entity 810 are multiple user devices, including IoT user devices 820 and supplier server user devices 830. For example, a first user is associated with a first IoT user device 820A and a first supplier server user device 830A, and a second user is associated with a second IoT user device 820B and a second supplier server user device 830B. IoT user devices 820 can correspond to various devices, including IoT devices, smart appliances, and sensors associated with a particular supplier entity.

[0064] The first IoT user device 820A may also communicate with the first vendor server user device 830A and the network access device 840, while only the first vendor server user device 830A and the network access device 840 may communicate with the network 850. Similarly, the second IoT user device 820B may communicate with the second vendor server user device 830B and the network access device 840, while only the second vendor server user device 830B and the network access device 840 may communicate with the network 850.

[0065] In example 800, user supplier entity grouping may be implemented. For example, a first user supplier entity is associated with a first IoT user device 820A, and a second user supplier entity is associated with a second IoT user device 820B. Although each user may also be associated with a supplier server user device 830, these supplier servers may not have access to a network access device 840 within a restricted communication network. Instead, a subset of devices associated with the user supplier entities, including a first user supplier entity associated with the first IoT user device 820A and a second user supplier entity associated with the second IoT user device 820B, may access the network access device 840 to access the network 850. Individually, each supplier server user device 830 may access the network 850 by a communication means that does not use the network access device 840.

[0066] In addition, role-based access implemented by the network access device 840 can be used to assign roles to user devices in the network. For example, a first IoT user device 820A of a first user 810A (user name "ABC") is associated with a first role ("IoT device role") and a device identifier (IP address: 4.0.0.1), and a second IoT user device 820B of a second user 810B (user name "DEF") is associated with the same role ("IoT device role") and a device identifier (IP address: 4.0.0.2). Devices outside the network can also be associated with device identifiers instead of roles. For example, a first vendor server user device 830A of a first user 810A (user name "ABC") is associated with a device identifier (IP address: 100.100.100.100), and a second vendor server user device 830B of a second user 810B (user name "DEF") is associated with a device identifier (IP address: 200.200.200.200).

[0067] In some examples, IoT user devices 820 are connected to a network access device 840, which provides each IoT user device with a connection to the Internet or other network. Provider server user devices 830 can be connected to the Internet or other network separately (e.g., not through network access device 840). Network access device 840 can help ensure that IoT user devices 820 communicate only with their corresponding provider server user devices by using GIT.

[0068] The network access device 840 may also be configured to perform policy management, end-user authentication, and end-user device registration (e.g., to add to an allow list or deny list). The network access device 840 is also configured to create a GIT and assign the GIT to an end-user device based on the corresponding credentials used to authenticate the device to the network.

[0069] Fig. 9 900 is a diagram illustrating a memory component of a system for storing a set of identifiers to enhance network security of a user device according to some examples of the present disclosure. Figure 8 800 of example 900. In example 900, the data repository includes GITs 910 that have been assigned to specific roles 920 (for a subset of end-user devices), end-user device identifiers 930, and device types 940.

[0070] In some examples, the end-user device identifier 930 may correspond to an IP address of a particular end-user device. In some implementations, the MAC address and IP address of the end-user device may be stored. The data repository may include other information (e.g., device type, classification, OS version, etc.) related to the first and second end-user devices and corresponding roles in the data path as described herein.

[0071] In some examples, different access roles are provided for end-user devices. For example, the device identifiers associated with the first IoT user device 820A and the second IoT user device 820B can be part of the database, and after successful authentication, the end-user device can be assigned the "IoT device role" role. Devices with mismatching device identifiers, such as the first vendor server user device 830A of the first user 810A and the second vendor server user device 830B of the second user 810B, cannot be authenticated to use the network, and therefore no role is assigned to these devices. In addition to access roles, the assignment of the GIT can additionally assign network forwarding decisions or other access and communication permissions / restrictions for end-user devices.

[0072] Fig.10Illustrative data path entries according to some examples of the present disclosure are provided. In this example, the data repository includes an ID 1010, an order 1020, a role 1030, and a rule 1040, which can be combined with a GIT assigned by a control plane component of a network access device for a specific end-user device group. The data repository can also include instructions corresponding to a data path entry 1050, which is created for devices corresponding to the same GIT to enable communication between them.

[0073] It should be noted that the terms "optimize", "optimal", etc., as used herein, may be used to mean achieving or achieving a performance as efficiently or perfectly as possible. However, as will be appreciated by those of ordinary skill in the art reading this document, perfection may not always be achieved. Accordingly, these terms may also encompass achieving or achieving a performance as well or efficiently or practically as possible under given circumstances, or achieving or achieving a performance better than that achieved using other settings or parameters.

[0074] Fig.11 Example computing components that can be used to implement a dynamically modular and customizable computing system according to various examples are illustrated. Fig.11 , the computing component 1100 may be, for example, a server computer, a controller, or any other similar computing component capable of processing data. Fig.11 In an example implementation of , computing component 1100 includes a hardware processor 1102 and a machine-readable storage medium 1104 .

[0075] The hardware processor 1102 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in the machine-readable storage medium 1104. The hardware processor 1102 may fetch, decode, and execute instructions (such as instructions 1106-1112) to control processes or operations for implementing a dynamically modular and customizable computing system. As an alternative or in addition to retrieving and executing instructions, the hardware processor 1102 may include one or more electronic circuits including electronic components for performing the functions of one or more instructions, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other electronic circuits.

[0076] A machine-readable storage medium, such as machine-readable storage medium 1104, may be any electronic storage device, magnetic storage device, optical storage device, or other physical storage device that contains or stores executable instructions. Thus, machine-readable storage medium 1104 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, or the like. In some examples, machine-readable storage medium 1104 may be a non-transitory storage medium, where the term "non-transitory" does not encompass transient propagation signals. As described in detail below, machine-readable storage medium 1104 may be encoded with executable instructions, such as instructions 1106-1112.

[0077] The hardware processor 1102 may execute instructions 1106 to authenticate credentials associated with the first end-user device and the second end-user device. The authentication may be performed using a control plane component of the computing component 1100. The credentials may be received via a network that communicatively connects the computing component 1100 with the first end-user device and the second end-user device.

[0078] Hardware processor 1102 can execute instructions 1108 to assign a first group identifier tag (GIT) to first network traffic originating from a first end-user device. Assigning the first GIT to the first network traffic can be performed using a control plane component of computing component 1100.

[0079] The hardware processor 1102 may execute instructions 1110 to automatically add a first GIT to second network traffic originating from a second end-user device. The first GIT may be added using a data plane component of the computing component 1100. The first GIT may be added upon receiving credentials of the second end-user device.

[0080] The hardware processor 1102 may also execute instructions 1112 to discard the network service. For example, when the data plane component receives a third network service including the second GIT that is destined for the first end user device and the second end user device, the network service may be discarded. The data plane component of the computing component 1100 may discard the network service. In some examples, the second GIT may be different from the first GIT, and the second GIT may be assigned to a fourth network service originating from the third end user device without association with the first network service, the second network service, and the third network service from any one of the first end user device and the second end user device.

[0081] Fig.12A block diagram of an example computer system 1200 is depicted in which various examples described herein may be implemented. The computer system 1200 includes a bus 1202 or other communication mechanism for communicating information, one or more hardware processors 1204 coupled to the bus 1202 for processing information. The hardware processor(s) 1204 may be, for example, one or more general-purpose microprocessors.

[0082] The computer system 1200 also includes a main memory 1206 (such as a random access memory (RAM), cache, and / or other dynamic storage device) coupled to the bus 1202 for storing information and instructions to be executed by the processor 1204. The main memory 1206 may also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by the processor 1204. These instructions, when stored in a storage medium accessible to the processor 1204, make the computer system 1200 a special-purpose machine customized to perform the operations specified in the instructions.

[0083] The computer system 1200 also includes a read only memory (ROM) 1208 or other static storage device coupled to the bus 1202 for storing static information and instructions for the processor 1204. A storage device 1210, such as a magnetic disk, optical disk, or USB thumb drive (flash drive), is provided and coupled to the bus 1202 for storing information and instructions.

[0084] In general, the terms "component", "engine", "system", "database", "data repository", etc., as used herein, may refer to logic embodied in hardware or firmware, or to a set of software instructions that may have entry and exit points, written in a programming language such as Java, C, or C++. Software components may be compiled and linked into executable programs, installed in a dynamic link library, or may be written in an interpreted programming language such as BASIC, Perl, or Python. It will be understood that software components may be called from other components or from themselves, and / or may be called in response to detected events or interrupts. Software components configured to execute on a computing device may be provided on a computer-readable medium (such as a compressed disk, digital video disk, flash drive, disk, or any other tangible medium), or provided as a digital download (and may be initially stored in a compressed format or installable format that requires installation, decompression, or decryption prior to execution). Such software code may be stored in part or in whole on a memory device of an executing computing device for execution by the computing device. Software instructions may be embedded in firmware, such as an EPROM. It will also be understood that hardware components may be composed of connected logic units (such as gates and flip-flops), and / or may be composed of programmable units (such as programmable gate arrays or processors).

[0085] The computer system 1200 can implement the techniques described herein using custom hardwired logic, one or more ASICs or FPGAs, firmware, and / or program logic that are combined with the computer system to make the computer system 1200 a special purpose machine or to program the computer system 1200. According to one example, the computer system 1200 performs the techniques herein in response to the processor(s) 1204 executing one or more sequences of one or more instructions contained in the main memory 1206. These instructions can be read into the main memory 1206 from another storage medium, such as the storage device 1210. Execution of the sequences of instructions contained in the main memory 1206 causes the processor(s) 1204 to perform the process steps described herein. In alternative examples, hardwired circuitry can be used in place of or in combination with software instructions.

[0086] The term "non-transitory medium" and similar terms used herein refer to any medium that stores data and / or instructions that cause a machine to operate in a specific manner. Such non-transitory media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 1210. Volatile media include dynamic memory, such as main memory 1206. Common forms of non-transitory media include, for example, floppy disks, foldable disks, hard disks, solid-state drives, tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a pattern of holes, RAM, PROMs and EPROMs, FLASH-EPROMs, NVRAMs, any other memory chips or cassettes, and network versions thereof.

[0087] Non-transitory media are different from transmission media, but can be used in conjunction with transmission media. Transmission media participate in the transfer of information between non-transitory media. For example, transmission media include coaxial cables, copper wires, and optical fibers, including the wires that comprise bus 1202. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave communications and infrared data communications.

[0088] The computer system 1200 also includes a communication interface 1218 coupled to the bus 1202. The communication interface 1218 provides two-way data communication coupled to one or more network links connected to one or more local networks, including receiving and sending network traffic as data packets, wherein the data packets store new GIT / identifiers (with Figure 1The communication interface 1218 may be used in conjunction with the data processing component 110 of the network access device 102 shown in the figure). For example, the communication interface 1218 may be an integrated services digital network (ISDN) card, a cable modem, a satellite modem, or a modem for providing a data communication connection to a corresponding type of telephone line. As another example, the communication interface 1218 may be a local area network (LAN) card for providing a data communication connection to a compatible LAN (or a WAN component that communicates with a WAN). A wireless link may also be implemented. In any such implementation, the communication interface 1218 sends and receives electrical, electromagnetic, or optical signals that carry digital data streams representing various types of information.

[0089] A network link typically provides data communication to other data devices through one or more networks. For example, a network link can provide a connection through a local network to a host or to data devices operated by an Internet Service Provider (ISP). The ISP, in turn, provides data communication services through the global packet data communication network now commonly referred to as the "Internet". Both local area networks and the Internet use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link and through the communication interface 1218 are example forms of transmission media that carry digital data to and from the computer system 1200.

[0090] Computer system 1200 can send messages and receive data, including program code, through the network(s), network links and communications interface 1218. In the Internet example, a server can send the code for a requested application through the Internet, an ISP, a local network and communications interface 1218.

[0091] The received code may be executed by processor 1204 as it is received, and / or stored in storage device 1210 or other non-volatile storage for later execution.

[0092] Each process, method, and algorithm described in the preceding section may be embodied in a code component executed by one or more computer systems or a computer processor including computer hardware, and the code component executed by one or more computer systems or a computer processor including computer hardware may be fully or partially automated. One or more computer systems or computer processors may also operate to support the execution of related operations in a "cloud computing" environment or as "software as a service" (SaaS). These processes and algorithms may be implemented in part or in full in a dedicated circuit. The various features and processes described above may be used independently of each other, or may be combined in various ways. Different combinations and sub-combinations are intended to fall within the scope of the present disclosure, and certain methods or process blocks may be omitted in some implementations. The methods and processes described herein are also not limited to any particular order, and the blocks or states associated therewith may be executed in other appropriate orders, or may be executed in parallel, or in some other manner. Blocks or states may be added to the disclosed example embodiments, or blocks or states may be removed from the disclosed examples. The execution of certain operations or processes may be distributed among computer systems or computer processors, not only residing in a single machine, but also deployed between multiple machines.

[0093] As used herein, the term "or" may be understood to be inclusive or exclusive. In addition, descriptions of resources, operations, or structures in the singular should not be interpreted to exclude the plural. Conditional language such as "can," "may," "might," or "could" is generally intended to convey that certain examples include and other examples do not include certain features, elements, and / or steps, unless otherwise specifically stated or understood otherwise in the context of use.

[0094] The terms and phrases used in this document and variations thereof should be construed as open ended and not restrictive, unless expressly stated otherwise. Adjectives such as "conventional," "traditional," "normal," "standard," "known," and terms of similar meaning should not be construed as limiting the items described to items available as of a given time period or as of a given time, but should be construed as covering conventional, traditional, normal, or standard technologies available or known at any time now or in the future. In some cases, the presence of broad words and phrases such as "one or more," "at least," "but not limited to," or other similar phrases should not be construed to mean that a narrower case is intended or required where such broad phrases may not be present.

Claims

1. A network access device, comprising: Memory; as well as a processor configured to execute machine-readable instructions stored in the memory to operate the processor to: authenticating, using a control plane component of the network access device, credentials of a user or location associated with a first end-user device and a second end-user device, the credentials being received via a network communicatively connecting the network access device with the first end-user device and the second end-user device; assigning, using the control plane component, a first group identifier tag GIT to first network traffic originating from the first end-user device; automatically adding, using a data plane component of the network access device, the first GIT to second network traffic originating from the second end-user device when the credentials for the user or location of the second end-user device are received; as well as when third network traffic including a second GIT destined for the first end-user device and the second end-user device is received by the data plane component of the network access device, discarding the third network traffic using the data plane component of the network access device, the second GIT being different from the first GIT, and The second GIT is assigned to the third network traffic originating from a third end-user device, the third end-user device having no association with the first network traffic and the second network traffic. 2 . The network access device of claim 1 , wherein the third network traffic originates from an end-user device associated with a second user having second credentials.

3. The network access device of claim 1, wherein the third network traffic originates from a second location other than a first location including the first end-user device and the second end-user device.

4. The network access device according to claim 1, wherein allocating the GIT to the first network service and the second network service is achieved by sending the GIT from the control plane component of the network access device to the data plane component of the network access device.

5. The network access device according to claim 1, wherein the processor is further configured to: assigning, using the control plane component of the network access device, a first access role for the first end-user device, Wherein said assignment of said GIT additionally corresponds to said first access role for said first end-user device to access network resources via said network.

6. The network access device according to claim 1, wherein the control plane component is further configured to: The MAC addresses and IP addresses of the first end-user device and the second end-user device and corresponding roles in the data path are programmed. The network access device according to claim 1 , wherein the GIT is a 64-bit unsigned integer.

8. A method comprising: authenticating, using a control plane component of a network access device, credentials associated with a first end-user device and a second end-user device, the credentials being received via a network communicatively connecting the network access device with the first end-user device and the second end-user device; assigning, using the control plane component, a first group identifier tag GIT to first network traffic originating from the first end-user device; automatically adding, using a data plane component of the network access device, the first GIT to second network traffic originating from the second end-user device when the credentials for the user or location of the second end-user device are received; as well as when third network traffic including a second GIT destined for the first end-user device and the second end-user device is received by the data plane component of the network access device, discarding the third network traffic using the data plane component of the network access device, the second GIT being different from the first GIT, and The second GIT is assigned to the third network traffic originating from a third end-user device, the third end-user device having no association with the first network traffic and the second network traffic.

9. The method of claim 8, wherein the third network traffic originates from an end-user device associated with a second user having second credentials.

10. The method of claim 8, wherein the third network traffic originates from a second location other than a first location including the first end-user device and the second end-user device.

11. The method of claim 8, wherein allocating the GIT to the first network service and the second network service is achieved by sending the GIT from the control plane component of the network access device to the data plane component of the network access device.

12. The method according to claim 8, further comprising: assigning, using the control plane component of the network access device, a first access role for the first end-user device, Wherein the assignment of the GIT additionally corresponds to a first access role for the first end-user device to access network resources via the network.

13. The method according to claim 8, further comprising: The MAC addresses and IP addresses of the first end-user device and the second end-user device and corresponding roles in the data path are programmed. The method of claim 8 , wherein the GIT is a 64-bit unsigned integer.

15. A non-transitory computer-readable storage medium storing a plurality of instructions executable by a processor, the plurality of instructions, when executed by the processor, causing the processor to: authenticating, using a control plane component of the network access device, credentials of a user or location associated with a first end-user device and a second end-user device, the credentials being received via a network communicatively connecting the network access device with the first end-user device and the second end-user device; assigning, using the control plane component, a first group identifier tag GIT to first network traffic originating from the first end-user device; automatically adding, using a data plane component of the network access device, the first GIT to second network traffic originating from the second end-user device when credentials for a user or location of the second end-user device are received; as well as when third network traffic including a second GIT destined for the first end-user device and the second end-user device is received by the data plane component of the network access device, discarding the third network traffic using the data plane component of the network access device, the second GIT being different from the first GIT, and The second GIT is assigned to the third network traffic originating from a third end-user device, the third end-user device having no association with the first network traffic and the second network traffic.

16. The non-transitory computer-readable storage medium of claim 15, wherein the third network traffic originates from an end-user device associated with a second user having second credentials.

17. The non-transitory computer-readable storage medium of claim 15, wherein the third network traffic originates from a second location other than a first location including the first end-user device and the second end-user device.

18. The non-transitory computer-readable storage medium of claim 15, wherein allocating the GIT to the first network service and the second network service is achieved by sending the GIT from the control plane component of the network access device to the data plane component of the network access device.

19. The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to: assigning, using the control plane component of the network access device, a first access role for the first end-user device, Wherein the assignment of the GIT additionally corresponds to the first access role of the first end-user device to access network resources via the network.

20. The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to: The MAC addresses and IP addresses of the first end-user device and the second end-user device and corresponding roles in the data path are programmed.

Images