Network security enhancement using flexible client grouping

Abstract

Embodiments of the present disclosure relate to network security enhancement using flexible client grouping. In addition to role-based access (e.g., administrator or guest) and device identifier access (e.g., IP or MAC address), a system and method of custom grouping of end user devices using a new group identifier tag (GIT) is provided. Two components can be implemented at a network access device, including a data plane component and a control plane component. For example, the control plane component can authenticate end user devices, store MAC addresses and IP addresses of authenticated end user devices, and define access roles of the end user devices in the data path. The data plane component can perform data packet processing according to previously defined rules. Whenever a data packet arrives at the network access device, the data packet is forwarded according to rules specified by the "role" and GIT in the entry, allowing for improved handling and scalability of network traffic processing.

Description

Background Technology

[0001] Traditional discretionary access control (DAC) systems implement access control lists (ACLs) to allow authenticated devices to access certain data objects on the network. For example, an ACL can be used to grant or deny write access to a specific file. An ACL can be implemented as a database containing individual entries for devices or groups of devices that are permitted to access these data objects. Attached Figure Description

[0002] This disclosure is described in detail with reference to the following figures, based on one or more different examples. These figures are provided for illustrative purposes only and depict only typical examples.

[0003] Figure 1 Illustrative network access devices are provided, according to some examples of the present disclosure, for communicating with other network access devices and user equipment via a network.

[0004] Figure 2 The illustration shows user-based grouping of user devices according to some examples of this disclosure.

[0005] Figure 3 The illustration shows a memory component of a system for storing a set of identifiers to enhance the network security of a user device, according to some examples of this disclosure.

[0006] Figure 4 The illustration shows a memory component of a system for storing role-based rules to enhance network security for user devices, according to some examples of this disclosure.

[0007] Figure 5 The illustration shows location-based grouping of user devices according to some examples of this disclosure.

[0008] Figure 6 The illustration shows a memory component of a system for storing a set of identifiers to enhance the network security of a user device, according to some examples of this disclosure.

[0009] Figure 7 The illustration shows a memory component of a system for storing role-based rules to enhance network security for user devices, according to some examples of this disclosure.

[0010] Figure 8 The illustration shows the grouping of supplier entities for user equipment according to some examples of this disclosure.

[0011] Figure 9The illustration shows a memory component of a system for storing a set of identifiers to enhance the network security of a user device, according to some examples of this disclosure.

[0012] Figure 10 Illustrative data path entries are provided based on some examples of this disclosure.

[0013] Figure 11 It is an example computing component that can be used to implement the various features of the examples described in this disclosure.

[0014] Figure 12 A block diagram depicts an example computer system in which the various examples described herein can be implemented.

[0015] The accompanying drawings are not exhaustive and do not limit this disclosure to the precise form disclosed. Detailed Implementation

[0016] Managing and allocating Access Control Lists (ACLs) using traditional Discretionary Access Control (DAC) systems can be resource-intensive and inefficient in large networks, especially when authorized users connect to the network using multiple devices. For example, an end-user device connects to the network, and after authentication, access to network components is granted to the device based on assigned "roles" defined in the ACL. Roles are configurable objects provided by the network access device that contain a list of rules governing access to network resources. The network access device can also have the ability to create multiple roles with different privilege levels (e.g., as defined by the network administrator). Furthermore, the network access device can associate roles with end-user devices and manage traffic to / from end-user devices based on role privileges.

[0017] Roles defined in an ACL can also specify which data object resources a device can access. However, network security can be compromised when a user's primary device (e.g., a work laptop) has adequate authentication and security features installed, while a user's secondary device (e.g., an IoT or personal mobile device) does not. Different users operating under the same "role" may not be allowed to access each other's data objects.

[0018] Furthermore, existing software layers use media access control (MAC) addresses or internet protocol (IP) addresses to identify end-user devices and store the role information of each end-user device in the corresponding user entry. There is no existing scheme to map these MAC addresses or IP addresses to ownership information or any other kind of "group" association.

[0019] Examples of the disclosed technology implement any logic-based packetization (e.g., packetization by device type, device category, credentials, location, operating system, user identifier, or other defined device or user grouping). Logic-based packetization can be implemented using at least two components of a network access device (e.g., an access point (AP) or switch) that can analyze new identifiers stored in transmitted packets, rather than relying on MAC addresses or IP addresses. The two components of the network access device include a data plane component and a control plane component. The control plane component can be implemented in software to instruct the data plane component to perform tasks upon receiving packets. For example, the control plane component can authenticate end-user devices, store the MAC addresses and IP addresses of authenticated end-user devices, and define access roles for end-user devices in the data path. The data plane component can be implemented in software or hardware to perform packet processing (e.g., forwarding and policy enforcement) according to rules defined by the control plane component. The data plane component can analyze each packet and access a data table storing the association between a specific MAC address or IP address and a "role" applicable to the device (referred to as a "data path user entry"). Whenever a data packet arrives at a network access device, it looks up the "data path user entry" and forwards the data packet according to the rules specified by the "role" in the entry.

[0020] Using improved control plane and data plane components at the network access device, the system can assign a Group Identifier Tag (GIT) to each uniquely identifiable group of end-user devices. The GIT can identify end-user device groups based on, for example, device type (e.g., laptop, camera, IoT device, mobile device, phone, management computer, or other type of device), device category (e.g., administrator or user), credentials (e.g., user or location), location (e.g., building A, building B, or other location), operating system type or version (e.g., Android OS, Apple OS, version 16.1.2, etc.), user or vendor identifier, or other defined device or user grouping. Multiple groups of devices can be user-based, device-based, role-based, etc., and a shared GIT can be assigned to each device in the group. Other grouping, including any kind of logical grouping that can be recognized by the components of the network access device, can be implemented without departing from the spirit of this disclosure.

[0021] The format of a Git can vary depending on the implementation (e.g., 32-bit or 64-bit unsigned integer) and helps identify any logical group of end-user devices (e.g., user, location, device type, device category, operating system version, security policy, custom grouping, etc.). The Git can be encapsulated / added to data packets by a control plane component or can be learned from programming associated with the data plane, control plane, or central controller. Whenever an end-user device connects to the network, the control plane component can identify the "group" to which the end-user device belongs and instruct the data plane component to assign a specific Git (e.g., credential / username) applicable to devices in that group. In this way, a first end-user device and a second end-user device corresponding to the same logical group can be assigned a first Git, while a third end-user device not corresponding to the same logical group can be assigned a second Git. Communication originating from either the first or second end-user device can be allowed to be transmitted to each other (e.g., corresponding to the same Git), and communication originating from either the first or second end-user device but transmitted to a third end-user device corresponding to a different Git can be discarded / rejected.

[0022] In some examples, management users can define additional groups based on parameters of the end-user device. Whenever any packet needs to be processed, the data plane component looks up the packet's source and destination addresses in the "Data Path User Entry". It then retrieves the "Source Role", "Destination Role", "Source GIT", and "Destination GIT" from these data path user entries. If the "Source Role" or "Destination Role" has GIT-based rules, it forwards / drops packets according to those rules.

[0023] Technical improvements are achieved throughout the disclosure. For example, the disclosed technology can improve data security and scalability across the network, at least by separating authentication from users and their device groups. User groups and user device groups can be identified by Git, which can provide the ability to separate access from previously assigned IP addresses, MAC addresses, or role-based access to devices / users. This allows access between multiple devices of a user or multiple devices located in a single location to access services / content from each other, and restricts access between users or locations when groups differ.

[0024] Figure 1Illustrative network access devices are provided that communicate with other network access devices and user equipment via a network according to some examples of this disclosure. In example 100, network access device 102 includes a processor 104, memory 105, and machine-readable medium 106. Network access device 102 can store, access, and maintain multiple data repositories, including a credential data repository 120 and a group identifier tag (GIT) data repository 122. Network access device 102 communicates with a central controller 128, other network access devices 130, and a first end user equipment 132A and a second end user equipment 132B (hereinafter referred to as "end user equipment 132") via network 140.

[0025] For example, processor 104 may include a general-purpose processing engine or a dedicated processing engine, such as a microprocessor, controller, or other control logic. Processor 104 may be connected to a bus, although any communication medium may be used to facilitate interaction with other components of network access device 102 or external communication.

[0026] Memory 105 may include random access memory (RAM) or other dynamic memory for storing information and instructions to be executed by processor 104. Memory 105 may also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by processor 104. Memory 105 may also include read-only memory (ROM) or other static storage devices coupled to a bus for storing static information and instructions for processor 104.

[0027] Machine-readable medium 106 may include one or more interfaces, circuits, components, and modules for implementing the functions discussed herein. Machine-readable medium 106 may carry one or more sequences of one or more instructions for execution by processor 104. These instructions embodied on machine-readable medium 106 enable the overall system to perform the features or functions of the disclosed techniques discussed herein. For example, the interfaces, circuits, components, and modules of machine-readable medium 106 may include, for example, a data processing component 110, a control plane component 112, and a data plane component 114.

[0028] Data processing component 110 is configured to receive and transmit network services as data packets. Network services can be transmitted from network access device 102 to other network access devices 130, or network services can be transmitted from network access device 102 to end user equipment 132.

[0029] The content of data packets sent as network services may differ. For example, the packet format may include IPv4 format with a header and payload. The header of an IPv4 packet may consist of 14 fields, including the source IP address, destination IP address, offset, version, and other information. In another example, the packet format may include IPv6 format with a header and payload. The header of an IPv6 packet may consist of a header and payload. The header of an IPv6 packet may also include the source IP address, destination IP address, offset, version, and other information. Various features of the packet format can be implemented or removed, including error detection in higher-level protocols of IPv6, such as the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) at the transport layer. IPv4 can allow UDP datagram headers without checksums, while IPv6 can require UDP datagram headers to include checksums.

[0030] Any content of a data packet can be used as an end-user device identifier. For example, the end-user device identifier of end-user device 132A can be the source IP address of the data packet, while the end-user device identifier of end-user device 132B can be the destination IP address of the data packet.

[0031] In some examples, data processing component 110 may receive credentials during authentication or registration of end user device 132, or may authenticate or register end user device 132 independently. When data processing component 110 receives credentials, central controller 128 may receive the credentials from end user device 132 and add them to an approval or rejection list, which may be accessed and implemented at multiple devices communicatively connected to central controller 128. In some examples, central controller 128 may distribute GIT to different network access devices 102, 130, or end user device 132. Central controller 128 may be implemented / executable as a component on a virtual machine (VM) or at network access devices 102, 130, or the cloud (not shown). When data processing component 110 is capable of authenticating or registering end user device 132 independently, it may receive credentials and add them to an approval or rejection list prior to a login attempt without assistance from central controller 128.

[0032] During authentication / registration of terminal user equipment 132, data processing component 110 can compare the credentials provided in the network service during login with credentials stored in an approval list or a denial list. When the credentials are included in the approval list, data processing component 110 can grant access to terminal user equipment 132. When the credentials are included in the denial list, data processing component 110 can deny access to terminal user equipment 132. User credentials can be received via data transmission in the network that communicatively connects network access device 102 to the first terminal user equipment 132A and the second terminal user equipment 132B. User credentials can correspond to the user operating both the first terminal user equipment 132A and the second terminal user equipment 132B.

[0033] Credentials can be user-associated credentials, device location-associated credentials, or some other identification credential that allows a device / user to authenticate using the system. For example, network services may include credentials associated with the location of end-user equipment 132. Credentials can be received via data transmission in a network that communicatively connects network access device 102 to the first end-user equipment 132 and the second end-user equipment 132. Credentials may correspond to the locations of both the first end-user equipment 132A and the second end-user equipment 132B, and these two end-user equipments may be grouped together.

[0034] Network access device 102 or central controller 128 can authorize access to network resources based on an end-user device identifier (e.g., the source IP address included in a data packet sent from end-user device 132A). Access to network resources can also be authorized based on an access control list (ACL), which allows authenticated devices to access certain data objects within the network. In some examples, network access device 102 or central controller 128 can assign roles based on role-based access control (RBAC). End-user device 132 can then access network resources based on the role assigned to it.

[0035] End-user equipment and network services may include new identifiers (called Group Identifier Tags (GITs)) stored in transmitted data packets. As discussed herein, data plane component 114 may use GITs stored in GIT data repository 122 to add / attach / encapsulate GITs into network services.

[0036] Control plane component 112 is configured to authenticate credentials associated with various end-user devices 132. Credentials can be received via data transmission in network 140, which communicatively connects network access device 102 to first end-user device 132A and second end-user device 132B. For example, credentials can be authenticated by comparing credentials received during data transmission with credentials stored in credential data repository 120 (e.g., credentials added by the central controller or network access device 102 during the registration of end-user devices).

[0037] Control plane component 112 is also configured to group end user equipment 132 according to public users or public locations. For example, control plane component 112 can receive additional network traffic originating from end user equipment not previously identified by control plane component 112. Control plane component 112 can identify end user equipment associated with network traffic (e.g., using end user equipment identifiers such as MAC addresses or IP addresses) and associate network traffic with specific users (e.g., a second user with second credentials).

[0038] Control plane component 112 is configured to assign a first GIT to a first network service originating from the first end-user equipment 132A. To assign a GIT to a network service, control plane component 112 may generate a new GIT associated with any logic-based packets included in the network service data packet (e.g., packets grouped by device type, device category, credentials, location, operating system, user identifier, or other defined device or user grouping). The GIT may be stored in a GIT data repository 122.

[0039] In some examples, assigning GIT to network services is achieved by sending GIT from the control plane component 112 of network access device 102 to the data plane component 114 of network access device 102.

[0040] Data plane component 114 can access GIT data repository 122 and search for logical packets that match network traffic packets, and determine the matching GIT. Data plane component 114 can add / append the GIT to network traffic packets. In some examples, because control plane component 112 adds GITs to GIT data repository 122, and data plane component 114 accesses GIT data repository 122, control plane component 112 can be configured to instruct data plane component 114 to perform tasks (e.g., based on assigned GITs, roles, credentials, or other logical packets) upon receiving packets.

[0041] Data plane component 114 is configured to add / attach / encapsulate existing GITs into new network services. For example, data plane component 114 can automatically add / attach a first GIT to a second network service received via network 140 originating from a specific user (e.g., from second end-user equipment 132B). When user credentials from second end-user equipment 132B are received, the existing GIT can be added to the new network service.

[0042] When a Git is encapsulated with a data packet, the encapsulation process can implement various procedures. For example, network access device 102 can perform tunneling protocols (such as Generic Routing Encapsulation (GRE)) to encapsulate network layer protocols within a virtual point-to-point or point-to-multipoint link using a transport protocol (such as Internet Protocol (IP)). In another example, network access device 102 can perform protocols such as Virtual Extensible LAN (VXLAN) to encapsulate raw Ethernet frames within User Datagram Protocol (UDP) packets. The new UDP packet contains a VXLAN header and the complete original Ethernet header. The encapsulated Git can then be sent along with network traffic within the data packet.

[0043] Data plane component 114 is also configured to add / attach the first GIT to a second network service received via network 140 and originating from a specific location. The location can be identified by an IP address or a portion of a subnet mask. In some examples, a location similar to a known location can be associated with an existing end-user equipment 132.

[0044] Data plane component 114 is configured to discard network packets received via network 140. For example, when network traffic is being sent to a device associated with a first GIT and the network packet includes a second GIT, data plane component 114 may discard the network packet. The network packet may also be discarded when the first GIT is different from the second GIT. As discussed, the first GIT and the second GIT may correspond to different users operating end-user equipment 132, or in some examples, to different locations of end-user equipment 132, or other logic-based packets discussed herein.

[0045] Figure 2 The illustration shows user-based grouping of user equipment according to some examples of this disclosure. In example 200, a central controller 210 is communicatively connected to a network access device 220, which is communicatively connected to a plurality of user equipments 230, 240. Figure 2 Network access device 220 and user equipment 230, 240 can respectively correspond to Figure 1 Network access device 102 and terminal user device 132.

[0046] In Example 200, user-based grouping can be implemented. For example, a first user 212A (username "ABC") is associated with a first user device 230A and a second user device 240A, and a second user 212B (username "DEF") is associated with a first user device 230B and a second user device 240B. The illustration shows two users, each corresponding to a unique credential (credential "ABC@mail.com" for the first user 212A and "DEF@mail.com" for the second user 212B).

[0047] Alternatively, role-based access implemented by the central controller 210 or network access device 220 can be used to assign roles to each user device. For example, the first user device 230A of the first user 212A (username "ABC") is associated with a first role ("Employee") and an IP address (1.0.0.10). The second user device 240A of the first user 212A (username "ABC") is associated with a second role ("Guest") and an IP address (1.0.0.11). The device types of these user devices are "Laptop" and "Mobile Phone," respectively. In another example, the first user device 230B of the second user 212B (username "DEF") is associated with a first role ("Employee") and an IP address (1.0.0.12). The second user device 240B of the second user 212B (username "DEF") is associated with a second role ("Guest") and an IP address (1.0.0.13). The device types of these user devices are "Laptop" and "Tablet," respectively.

[0048] Central controller 210 or network access device 220 can be configured to perform policy management, end-user authentication, and end-user device registration (e.g., to add to an allow list or deny list). In some examples, central controller 210 is configured to coordinate GITs among multiple network access devices, ensuring consistent permission for public-user-based access across each network access device. Network access device 220 is also configured to create GITs and assign them to end-user devices based on corresponding credentials used to authenticate network devices.

[0049] Figure 3 The illustration shows a memory component of a system for storing a set of identifiers to enhance the network security of a user device, according to some examples of this disclosure. Example 300 is... Figure 2Example 200 illustrates a user-based grouping example. In Example 300, the data repository includes a GIT 310 that has been assigned a specific role 320, end-user equipment identifier 330, and credential 340 by the control plane component of the network access device.

[0050] In some examples, the End User Equipment Identifier 330 may correspond to the IP address of a specific End User Equipment. In some implementations, the MAC address and IP address of the End User Equipment may be stored. The data repository may include other information (e.g., device type, classification, OS version, etc.) related to the first End User Equipment and the second End User Equipment, as well as their corresponding roles in the data path, as described herein.

[0051] Figure 4 The illustration shows a memory component of a system for storing role-based rules to enhance network security for a user device, according to some examples of this disclosure. Example 400 is... Figure 2 Example 200 illustrates a user-based grouping example. In Example 400, the data repository includes ID 410, role 420, and rule 430, which can be combined with GITs assigned by the control plane component of the network access device for specific groups of end-user devices.

[0052] The rules provided are descriptive and should not be restrictive. For example, for devices assigned the role of "employee," rules can be applied according to the order in which they are stored in the data repository. When a device's role is "employee" and Git matches between "any source and destination," the network access device can first allow packet transmission. When a device's role is "employee" and data traffic is provided to the company mail server, the network access device can next allow packet transmission. When a device's role is "employee" and data traffic is transmitted to the Internet, the network access device can next allow packet transmission.

[0053] In another example, for devices assigned the role of "guest," rules can be applied according to the order in which they are stored in the data repository. When a device's role is "guest" and Git matches between "any source and destination," the network access device can first allow packet transmission. When a device's role is "guest" and data traffic is provided to the company mail server, the network access device can then reject any packet transmission. When a device's role is "guest" and data traffic is transmitted to the Internet, the network access device can then allow packet transmission.

[0054] These diagrams illustrate different access roles for end-user devices. For example, a company laptop's MAC address could be part of a database. After successful authentication, an end-user device with a MAC address from that database can be assigned the "employee" role. Devices with mismatched MAC addresses, such as mobile devices belonging to users with valid usernames / passwords, can be assigned the "guest" role. In addition to the access roles associated with end-user devices, GIT assignments can further assign network forwarding decisions or other access and communication permissions / restrictions to end-user devices through a separate process. For example, a device with an "employee" role can be enhanced to make network forwarding decisions based on the GIT assignment and corresponding packets. In this sense, a first end-user device can forward communications within its GIT packets but cannot forward communications or access network resources via the network associated with a second GIT packet. In other examples, with additional GIT assignments, based on corresponding role-based access, a second end-user device can access fewer network resources via the network than the first end-user device. This can be achieved through role-based access and by separately assigning GITs based on different packets to create multi-tiered access and groups for different permissions within the network.

[0055] Figure 5 The illustration depicts location-based grouping of user equipment according to some examples of this disclosure. In example 500, a central controller 510 is communicatively connected to multiple network access devices 520 in different locations / buildings, including a first network device 520A and a second network device 520B. The first network device 520A is communicatively connected to multiple user equipments 530 located in the same location / building, including a first user equipment 530A and a second user equipment 540A. The second network device 520B is also communicatively connected to multiple user equipments 530 located in the same location / building, including a first user equipment 530B and a second user equipment 540B. Figure 5 The network access device 520 and user devices 530 and 540 can correspond to the network access device 102 and the terminal user device 132, respectively.

[0056] In Example 500, location-based grouping can be implemented. For example, a first location / building is associated with a first user equipment 530A and a second user equipment 540A, and a second location / building is associated with a first user equipment 530B and a second user equipment 540B.

[0057] For example, the first location 512A (location name "Building A") is associated with the first network access device 520A, the first user equipment 530A (device type "laptop"), and the second user equipment 540A (device type "camera"). The second location 512B (location name "Building B") is associated with the second network access device 520B, the first user equipment 530B (device type "laptop"), and the second user equipment 540B (device type "camera"). The illustration shows two locations, each corresponding to a unique credential (credential "Building A" for the first location 512A and credential "Building B" for the second location 512B).

[0058] Alternatively, role-based access implemented by the central controller 210 or network access device 220 can be used to assign roles to each user device. For example, the first user device 530A at the first location 512A (location name "Building A") is associated with a first role ("Block Administrator") and an IP address (2.0.0.3). The second user device 540A at the first location 512A (location name "Building A") is associated with a second role ("IoT Device") and an IP address (2.0.0.1). The device types of these user devices are "Laptop" and "Camera," respectively. In another example, the first user device 530B at the second location 512B (location name "Building B") is associated with a first role ("Block Administrator") and an IP address (2.0.0.4). The second user device 540B at the second location 512B (location name "Building B") is associated with a second role ("IoT Device") and an IP address (2.0.0.2). The device types of these user devices are "Laptop" and "Camera," respectively.

[0059] The central controller 510 or network access devices 520A and 520B can be configured to perform policy management, end-user authentication, and end-user device registration (e.g., to add to an allow list or deny list). In some examples, the central controller 510 is configured to coordinate GITs among multiple network access devices, ensuring consistent permission for public location-based access across each network access device. Network access devices 520A and 520B are also configured to create GITs and assign them to end-user devices based on corresponding credentials (location) used to authenticate the network device.

[0060] Figure 6 The illustration shows a memory component of a system for storing a set of identifiers to enhance the network security of a user device, according to some examples of this disclosure. Example 600 is... Figure 5Example 500 illustrates a location-based grouping example. In Example 600, the data repository includes a GIT 610 that has been assigned by the control plane component of the network access device to a specific role 620, end-user equipment identifier 630, credential 640, and device type 650.

[0061] Figure 7 The illustration shows a memory component of a system for storing role-based rules to enhance network security for a user device, according to some examples of this disclosure. Example 700 is... Figure 5 Example 500 illustrates a user-based grouping example. In Example 700, the data repository includes ID 710, role 720, and rule 730, which may combine a GIT assigned to a specific group of end-user equipment by the control plane component of the network access device. Figure 4 Similar rules are illustrated and repeated in this article.

[0062] Figure 8 The illustration shows a grouping of user equipment vendor entities according to some examples of this disclosure. In example 800, a plurality of user vendor entities 810 are illustrated, wherein a first subset of user equipment is communicatively connected to network access device 840 and / or network 850. Figure 8 Network access device 840 and user equipment 820, 830 can respectively correspond to Figure 1 Network access device 102 and terminal user device 132.

[0063] In Example 800, two user supplier entities 810 are illustrated as a first user supplier entity 810A (user "ABC") and a second user supplier entity 810B (user "DEF"), where corresponding GITs are assigned to devices associated with a particular user supplier entity. Associated with each supplier entity 810 are multiple user devices, including IoT user devices 820 and supplier server user devices 830. For example, a first user is associated with a first IoT user device 820A and a first supplier server user device 830A, and a second user is associated with a second IoT user device 820B and a second supplier server user device 830B. The IoT user device 820 can correspond to various devices, including IoT devices, smart appliances, and sensors associated with a particular supplier entity.

[0064] The first IoT user device 820A can also communicate with the first vendor server user device 830A and the network access device 840, but only the first vendor server user device 830A and the network access device 840 can communicate with the network 850. Similarly, the second IoT user device 820B can communicate with the second vendor server user device 830B and the network access device 840, but only the second vendor server user device 830B and the network access device 840 can communicate with the network 850.

[0065] In Example 800, user supplier entity grouping can be implemented. For example, a first user supplier entity is associated with a first IoT user device 820A, and a second user supplier entity is associated with a second IoT user device 820B. While each user may also be associated with a supplier server user device 830, these supplier servers cannot access the network access device 840 within the restricted communication network. Instead, a subset of devices associated with user supplier entities, including the first user supplier entity associated with the first IoT user device 820A and the second user supplier entity associated with the second IoT user device 820B, can access the network access device 840 to access the network 850. Individually, each supplier server user device 830 can access the network 850 without using communication means of the network access device 840.

[0066] Additionally, role-based access implemented by network access device 840 can be used to assign roles to user devices in the network. For example, the first IoT user device 820A of the first user 810A (username "ABC") is associated with a first role ("IoT Device Role") and a device identifier (IP address: 4.0.0.1), and the second IoT user device 820B of the second user 810B (username "DEF") is associated with the same role ("IoT Device Role") and device identifier (IP address: 4.0.0.2). Devices outside the network can also be associated with device identifiers instead of roles. For example, the first vendor server user device 830A of the first user 810A (username "ABC") is associated with a device identifier (IP address: 100.100.100.100), and the second vendor server user device 830B of the second user 810B (username "DEF") is associated with a device identifier (IP address: 200.200.200.200).

[0067] In some examples, IoT user equipment 820 connects to network access device 840, which provides each IoT user equipment with access to the Internet or other networks. Vendor server user equipment 830 may connect to the Internet or other networks independently (e.g., without through network access device 840). Network access device 840 can help ensure that IoT user equipment 820 communicates only with its corresponding vendor server user equipment using GIT.

[0068] Network access device 840 can also be configured to perform policy management, end-user authentication, and end-user device registration (e.g., to add to an allow list or deny list). Network access device 840 is also configured to create GITs and assign GITs to end-user devices based on corresponding credentials used to authenticate the network device.

[0069] Figure 9 The illustration shows a memory component of a system for storing a set of identifiers to enhance network security for a user device, according to some examples of this disclosure. Example 900 is... Figure 8 Example 800 illustrates a grouping of user equipment supplier entities. In Example 900, the data repository includes GIT 910, which has been assigned to a specific role 920 (for a subset of end-user equipment), an end-user equipment identifier 930, and a device type 940.

[0070] In some examples, the End User Equipment Identifier 930 may correspond to the IP address of a specific End User Equipment. In some implementations, the MAC address and IP address of the End User Equipment may be stored. The data repository may include other information (e.g., device type, classification, OS version, etc.) related to the first End User Equipment and the second End User Equipment, as well as their corresponding roles in the data path, as described herein.

[0071] In some examples, different access roles are provided for end-user devices. For instance, the device identifier associated with the first IoT user device 820A and the second IoT user device 820B can be part of a database, and after successful authentication, the end-user device can be assigned the "IoT Device Role". Devices with mismatched device identifiers, such as the first vendor server user device 830A of the first user 810A and the second vendor server user device 830B of the second user 810B, cannot be authenticated to use the network, and therefore no role is assigned to these devices. In addition to access roles, GIT assignments can additionally assign network forwarding decisions or other access and communication permissions / restrictions to end-user devices.

[0072] Figure 10Illustrative data path entries are provided according to some examples of this disclosure. In this example, the data repository includes ID 1010, order 1020, role 1030, and rule 1040, which may combine a Git assigned to a specific group of end-user equipment by the control plane component of the network access device. The data repository may also include instructions corresponding to data path entry 1050, which is created for devices corresponding to the same Git to enable communication between them.

[0073] It should be noted that the terms “optimized,” “best,” etc., used in this document can be used to indicate achieving or attaining performance as efficiently or perfectly as possible. However, as those skilled in the art who are reading this document will recognize, perfection is not always achievable. Accordingly, these terms can also encompass achieving or attaining performance as well as efficiently or practically as possible in a given environment, or achieving or attaining performance better than that achieved using other settings or parameters.

[0074] Figure 11 The illustrations depict example computing components, based on various examples, that can be used to implement dynamic, modular, and customizable computing systems. Now refer to... Figure 11 The computing component 1100 can be, for example, a server computer, a controller, or any other similar computing component capable of processing data. Figure 11 In the example implementation, computing component 1100 includes hardware processor 1102 and machine-readable storage medium 1104.

[0075] The hardware processor 1102 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in the machine-readable storage medium 1104. The hardware processor 1102 may retrieve, decode, and execute instructions (such as instructions 1106-1112) to control processes or operations for implementing a dynamically modular and customizable computing system. As an alternative to or supplement to retrieving and executing instructions, the hardware processor 1102 may include one or more electronic circuits, including electronic components for the function of executing one or more instructions, such as field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), or other electronic circuits.

[0076] Machine-readable storage media (such as machine-readable storage media 1104) can be any electronic storage device, magnetic storage device, optical storage device, or other physical storage device that contains or stores executable instructions. Therefore, machine-readable storage media 1104 can be, for example, random access memory (RAM), non-volatile RAM (NVRAM), electrically erasable programmable read-only memory (EEPROM), storage devices, optical discs, etc. In some examples, machine-readable storage media 1104 can be a non-transitory storage medium, where the term "non-transitory" does not cover transient propagation signals. As described in detail below, machine-readable storage media 1104 can be encoded with executable instructions (such as instructions 1106-1112).

[0077] Hardware processor 1102 can execute instructions 1106 to authenticate credentials associated with the first and second end-user devices. This authentication can be performed using a control plane component of computing component 1100. The credentials can be received via a network communicatively connecting computing component 1100 to the first and second end-user devices.

[0078] Hardware processor 1102 can execute instructions 1108 to assign a first group of identifier tags (GITs) to a first network service originating from a first end-user equipment. Assigning the first GIT to the first network service can be performed using the control plane component of computing component 1100.

[0079] Hardware processor 1102 can execute instructions 1110 to automatically add a first GIT to a second network service originating from a second end-user equipment. The first GIT can be added using the data plane component of computing component 1100. The first GIT can be added upon receiving credentials from the second end-user equipment.

[0080] Hardware processor 1102 can also execute instruction 1112 to discard network traffic. For example, when the data plane component receives a third network traffic, including a second GIT, destined for the first and second end-user devices, it can discard the network traffic. The data plane component of computing component 1100 can discard the network traffic. In some examples, the second GIT may be different from the first GIT, and the second GIT may be assigned to a fourth network traffic originating from the third end-user device, without any association with the first, second, and third network traffic from either the first or second end-user device.

[0081] Figure 12A block diagram of an example computer system 1200, in which various examples described herein may be implemented, is depicted. The computer system 1200 includes a bus 1202 or other communication mechanism for transmitting information, and one or more hardware processors 1204 coupled to the bus 1202 for processing information. The hardware processors 1204 may be, for example, one or more general-purpose microprocessors.

[0082] Computer system 1200 also includes main memory 1206 (such as random access memory (RAM), cache, and / or other dynamic storage devices) coupled to bus 1202 for storing information and instructions to be executed by processor 1204. Main memory 1206 can also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by processor 1204. When these instructions are stored in storage media accessible to processor 1204, computer system 1200 becomes a dedicated machine customized to perform the operations specified in the instructions.

[0083] Computer system 1200 also includes a read-only memory (ROM) 1208 or other static storage device coupled to bus 1202 for storing static information and instructions of processor 1204. Storage device 1210 (such as a disk, optical disk, or USB thumb drive (flash drive)) is provided and coupled to bus 1202 for storing information and instructions.

[0084] Generally, the terms "component," "engine," "system," "database," and "data repository" used in this article can refer to logic embodied in hardware or firmware, or to a set of software instructions that may have entry and exit points, written in programming languages ​​such as Java, C, or C++. Software components can be compiled and linked into executable programs, installed in dynamic link libraries, or written in interpreted programming languages ​​such as BASIC, Perl, or Python. It will be understood that software components can be invoked from other components or from themselves, and / or can be invoked in response to detected events or interrupts. Software components configured to execute on a computing device may be provided on computer-readable media (such as compressed disks, digital video disks, flash drives, hard disks, or any other tangible media) or as digital downloads (and may initially be stored in compressed or installable formats that require installation, decompression, or decryption before execution). This software code may be stored, in part or in whole, on a memory device executing the computing device for execution by the computing device. Software instructions may be embedded in firmware, such as EPROM. It will also be understood that hardware components may consist of connected logic units (such as gates and flip-flops), and / or may consist of programmable units (such as programmable gate arrays or processors).

[0085] Computer system 1200 may implement the techniques described herein using custom hard-wired logic, one or more ASICs or FPGAs, firmware, and / or program logic. This custom hard-wired logic, one or more ASICs or FPGAs, firmware, and / or program logic, combined with the computer system, enable computer system 1200 to be a dedicated machine or to be programmed. According to one example, computer system 1200 performs the techniques of this invention in response to processor(s) 1204 executing one or more sequences of one or more instructions contained in main memory 1206. These instructions may be read into main memory 1206 from another storage medium, such as storage device 1210. Execution of the instruction sequence contained in main memory 1206 causes processor(s) 1204 to perform the process steps described herein. In alternative examples, hard-wired circuitry may be used in place of or in combination with software instructions.

[0086] As used herein, the term "non-transitory media" and similar terms refer to any medium that stores data and / or instructions that cause a machine to operate in a particular manner. Such non-transitory media can include non-volatile media and / or volatile media. Non-volatile media include, for example, optical discs or magnetic disks, such as storage device 1210. Volatile media include dynamic memory, such as main memory 1206. Common forms of non-transitory media include, for example, floppy disks, collapsible disks, hard disks, solid-state drives, magnetic tape or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a perforated pattern, RAM, PROMs and EPROMs, FLASH-EPROMs, NVRAMs, any other memory chips or cassette tapes, and their network versions.

[0087] Non-transitory media differ from transmission media, but can be used in conjunction with transmission media. Transmission media participate in the transmission of information between non-transitory media. For example, transmission media include coaxial cables, copper wires, and optical fibers, including conductors containing bus 1202. Transmission media can also take the form of sound waves or light waves, such as those generated during radio wave communication and infrared data communication.

[0088] Computer system 1200 also includes a communication interface 1218 coupled to bus 1202. Communication interface 1218 provides bidirectional data communication coupled to one or more network links connected to one or more local networks, including receiving and sending network traffic as data packets, wherein the data packets store a new GIT / identifier (as opposed to...). Figure 1The data processing component 110 of the network access device 102 shown cooperates with this component. For example, the communication interface 1218 may be an Integrated Services Digital Network (ISDN) card, a cable modem, a satellite modem, or a modem used to provide data communication connectivity to a corresponding type of telephone line. As another example, the communication interface 1218 may be a local area network (LAN) card used to provide data communication connectivity to a compatible LAN (or a WAN component communicating with a WAN). A wireless link may also be implemented. In any such implementation, the communication interface 1218 transmits and receives electrical, electromagnetic, or optical signals carrying digital data streams representing various types of information.

[0089] Network links typically provide data communication to other data devices via one or more networks. For example, a network link can provide a connection via a local network to a host or to data devices operated by an Internet Service Provider (ISP). ISPs, in turn, provide data communication services through the global packet data communication network now commonly referred to as the "Internet." Both local area networks (LANs) and the Internet use electrical, electromagnetic, or optical signals that carry digital data streams. Signals through various networks, as well as signals on network links and through communication interface 1218, are example forms of transmission media carrying digital data to and from computer system 1200.

[0090] Computer system 1200 can send messages and receive data, including program code, through multiple networks, network links, and communication interface 1218. In the Internet example, the server can send the code of the requested application through the Internet, ISP, local network, and communication interface 1218.

[0091] The received code may be executed by processor 1204 when it is received, and / or stored in storage device 1210 or other non-volatile storage device for later execution.

[0092] Each process, method, and algorithm described in the preceding sections may be embodied in a code component executed by one or more computer systems or computer processors including computer hardware, and the code component executed by one or more computer systems or computer processors including computer hardware may be wholly or partially automated. One or more computer systems or computer processors may also operate to support the execution of related operations in a “cloud computing” environment or as “software as a service” (SaaS). These processes and algorithms may be implemented partially or entirely in dedicated circuitry. The various features and processes described above may be used independently of each other or may be combined in various ways. Different combinations and sub-combinations are intended to fall within the scope of this disclosure, and certain method or process blocks may be omitted in some implementations. The methods and processes described herein are not limited to any particular order, and the blocks or states associated with them may be executed in other suitable orders, or may be executed in parallel, or may be executed in some other manner. Blocks or states may be added to the disclosed example embodiments, or blocks or states may be removed from the disclosed examples. The execution of certain operations or processes may be distributed across computer systems or computer processors, residing not only within a single machine but also deployed across multiple machines.

[0093] As used herein, the term “or” can be understood as inclusive or exclusive. Furthermore, descriptions of resources, operations, or structures in the singular form should not be interpreted as excluding the plural form. Conditional language such as “can,” “may,” “might,” or “can” is generally intended to convey that certain examples include certain features, elements, and / or steps while others do not, unless otherwise specifically stated or understood in the context in which it is used.

[0094] The terms and phrases used in this document, and their variations thereof, should be understood as open-ended rather than restrictive, unless otherwise expressly stated. Adjectives such as “regular,” “traditional,” “normal,” “standard,” “known,” and similar terms should not be construed as limiting the described items to those available up to a given time period, but rather as encompassing regular, traditional, normal, or standard techniques available or known at any time now or in the future. In some cases, the presence of extended words and phrases such as “one or more,” “at least,” “but not limited to,” or other similar phrases should not be construed as implying an intention or need for a narrower scope where such extended phrases might not exist.

Claims

1. A network access device, comprising: Memory; as well as The processor is configured to execute machine-readable instructions stored in the memory to operate the processor for: The control plane component of the network access device is used to authenticate credentials of a user or location associated with a first terminal user equipment and a second terminal user equipment, the credentials being received via a network that communicatively connects the network access device to the first terminal user equipment and the second terminal user equipment. The control plane component is used to assign the first set of identifier labels (GIT) to the first network service originating from the first end user equipment. When the credentials for the user or location of the second terminal user equipment are received, the first GIT is automatically added to the second network service originating from the second terminal user equipment using the data plane component of the network access device; as well as When a third network service, including a second GIT, destined for the first and second end-user devices, is received by the data plane component of the network access device, the data plane component of the network access device is used to discard the third network service. The second GIT is different from the first GIT. The second GIT is assigned to the third network service originating from a third end-user device, which has no association with the first network service and the second network service.

2. The network access device according to claim 1, wherein the third network service originates from an end-user device associated with a second user having a second credential.

3. The network access device according to claim 1, wherein the third network service originates from a second location other than the first location of the first terminal user equipment and the second terminal user equipment.

4. The network access device of claim 1, wherein allocating the GIT to the first network service and the second network service is implemented by sending the GIT from the control plane component of the network access device to the data plane component of the network access device.

5. The network access device according to claim 1, wherein the processor is further configured to: The control plane component of the network access device is used to assign a first access role to the first end-user device. The assignment of the GIT therein additionally corresponds to the first access role for the first end-user device to access network resources via the network.

6. The network access device according to claim 1, wherein the control plane component is further configured to: The MAC addresses, IP addresses, and corresponding roles in the data paths of the first and second terminal user devices are programmed.

7. The network access device according to claim 1, wherein the GIT is a 64-bit unsigned integer.

8. A method comprising: The control plane component of the network access device is used to authenticate credentials associated with a first end user equipment and a second end user equipment, the credentials being received via a network that communicatively connects the network access device to the first end user equipment and the second end user equipment; The control plane component is used to assign the first set of identifier labels (GIT) to the first network service originating from the first end user equipment. When the credentials for the user or location of the second terminal user equipment are received, the first GIT is automatically added to the second network service originating from the second terminal user equipment using the data plane component of the network access device; as well as When a third network service, including a second GIT, destined for the first and second end-user devices, is received by the data plane component of the network access device, the data plane component of the network access device is used to discard the third network service. The second GIT is different from the first GIT. The second GIT is assigned to the third network service originating from a third end-user device, which has no association with the first network service and the second network service.

9. The method of claim 8, wherein the third network service originates from an end-user device associated with a second user having a second credential.

10. The method of claim 8, wherein the third network service originates from a second location other than the first location of the first terminal user equipment and the second terminal user equipment.

11. The method of claim 8, wherein assigning the GIT to the first network service and the second network service is accomplished by sending the GIT from the control plane component of the network access device to the data plane component of the network access device.

12. The method according to claim 8, further comprising: The control plane component of the network access device is used to assign a first access role to the first end-user device. The allocation of the GIT additionally corresponds to a first access role for the first end-user device to access network resources via the network.

13. The method of claim 8, further comprising: The MAC addresses, IP addresses, and corresponding roles in the data paths of the first and second terminal user devices are programmed.

14. The method of claim 8, wherein the GIT is a 64-bit unsigned integer.

15. A non-transitory computer-readable storage medium storing a plurality of instructions executable by a processor, said plurality of instructions, when executed by said processor, causing the processor to: The control plane component of the network access device is used to authenticate credentials for a user or location associated with a first end-user device and a second end-user device, the credentials being received via a network that communicatively connects the network access device to the first end-user device and the second end-user device. The control plane component is used to assign the first set of identifier labels (GIT) to the first network service originating from the first end user equipment. When credentials for the user or location of the second terminal user equipment are received, the first GIT is automatically added to the second network service originating from the second terminal user equipment using the data plane component of the network access device. as well as When a third network service, including a second GIT, destined for the first and second end-user devices, is received by the data plane component of the network access device, the data plane component of the network access device is used to discard the third network service. The second GIT is different from the first GIT. The second GIT is assigned to the third network service originating from a third end-user device, which has no association with the first network service and the second network service.

16. The non-transitory computer-readable storage medium of claim 15, wherein the third network service originates from an end-user device associated with a second user having a second credential.

17. The non-transitory computer-readable storage medium of claim 15, wherein the third network service originates from a second location other than the first location of the first terminal user equipment and the second terminal user equipment.

18. The non-transitory computer-readable storage medium of claim 15, wherein allocating the GIT to the first network service and the second network service is achieved by sending the GIT from the control plane component of the network access device to the data plane component of the network access device.

19. The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to: The control plane component of the network access device is used to assign a first access role to the first end-user device. The allocation of the GIT additionally corresponds to the first access role of the first end-user device to access network resources via the network.

20. The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to: The MAC addresses, IP addresses, and corresponding roles in the data paths of the first and second terminal user devices are programmed.

Images