Access control method and apparatus
The present invention relates to an access control unit ( 21 ) of a data communication network ( 61 ) comprising an access control means ( 101 ) adapted to receive an authorization ( 111 ) from an authentication server ( 51 ), whereby a particular user ( 15 ) is authorized to access said data communication network, and thereupon to grant said particular user an access ( 106 ) to said data communication network. An access control unit according to the invention is characterized in that said access control means is further adapted to derive, from an additional information element ( 112 ) encoded into said authorization, an association ( 114 ) for said particular user between a particular payload type (Ipv6) and a particular virtual network (VLAN 2 ) overlaying over said data communication network, and in that said access control unit further comprises a frame classifier ( 102 ) coupled to said access control means (via 103 ), and adapted to tag particular untagged frames ( 121 ) entering said data communication network, related to said particular user and carrying said particular payload type, with a particular virtual network identifier (VID 2 ) of said particular virtual network. The present invention also relates to a method for controlling the access to a data communication network, and to an authentication server for use in cooperation with the access control unit.
1 . An access control unit ( 21 ) of a data communication network ( 61 ) comprising an access control means ( 101 ) adapted to receive an authorization ( 111 ) from an authentication server ( 51 ), whereby a particular user ( 15 ) is authorized to access said data communication network, and thereupon to grant said particular user an access ( 106 ) to said data communication network,
characterized in that said access control means is further adapted to derive, from an additional information element ( 112 ) encoded into said authorization, an association ( 114 ) for said particular user between a particular payload type (IPv6) and a particular virtual network (VLAN 2 ) overlaying over said data communication network,
and in that said access control unit further comprises a frame classifier ( 102 ) coupled to said access control means (via 103 ), and adapted to tag particular untagged frames ( 121 ) entering said data communication network, related to said particular user and carrying said particular payload type, with a particular virtual network identifier (VID 2 ) of said particular virtual network.
2 . An access control unit according to claim 1 , characterized in that said access control means is further adapted:
to download, out of any particular user context, a definition of said association from said authentication server into a local repository ( 103 ),
to decode a particular common reference from said information element that points, for said particular user, towards said association within said local repository.
3 . An access control unit according to claim 1 , characterized in that said access control means is further adapted to decode a definition of said association directly from said information element.
4 . A method for controlling the access to a data communication network ( 61 ), and comprising the steps of:
receiving an authorization ( 111 ) from an authentication server ( 51 ), whereby a particular user ( 15 ) is authorized to access said data communication network,
thereupon, granting said particular user an access ( 106 ) to said data communication network, characterized in that said method further comprises the steps of:
deriving, from an additional information element ( 112 ) encoded into said authorization, an association ( 114 ) for said particular user between a particular payload type (IPv6) and a particular virtual network (VLAN 2 ) overlaying over said data communication network,
tagging particular untagged frames ( 121 ) entering said data communication network, related to said particular user and carrying said particular payload type, with a particular virtual network identifier (VID 2 ) of said particular virtual network.
5 . An authentication server ( 51 ) for use in cooperation with an access control unit ( 21 ) of a data communication network ( 61 ), and adapted to send an authorization ( 111 ) to said access control unit, whereby a particular user ( 15 ) is authorized to access said data communication network,
characterized in that said authentication server is further adapted to encode an additional information element ( 112 ) into said authorization, whereby an association ( 114 ), for said particular user, between a particular payload type (IPv6) and a particular virtual network (VLAN 2 ) overlaying over said data communication network, is derived.