Method and system for policy-based address allocation for secure unique local networks
View Patent ↗The present invention advantageously provides a method, system and apparatus for allocating addresses to secure unique local networks by providing a brokered federated policy and identity management system, the brokered federated policy and identity management system having an address domain manager that allocates network addresses, the address domain manager arranged to interoperate with a network identity management module, the network identity management module providing management of identity at an application level, receiving an authorization from the brokered federated policy and identity management system, and assigning a network address to a unique local network based on the authorization from the brokered federated policy and identity management system. The method, system and apparatus may further include authenticating a user, wherein authenticating a user includes passing an assertion token to a device of the user. The method, system and apparatus may yet further include providing user policies to a policy enforcement point in a network.
1. A method for allocating addresses to a unique local network, the method comprising:
providing a brokered federated policy and identity management system, the brokered federated policy and identity management system having an address domain manager the address domain manager:
placing a user device into a first virtual local area network (VLAN);
authenticating a user;
placing the user device into a second virtual local area network (VLAN) that is specific to a role of the authenticated user;
the address domain manager arranged to interoperate with a network identity management module, the network identity management module providing management of identity at an application level;
receiving an authorization from the brokered federated policy and identity management system; and
upon receiving a request for a secure application,
assigning a network address to a unique local network based at least upon on the authorization from the brokered federated policy and identity management system.
2. The method of claim 1 , wherein authenticating a user includes passing an assertion token to a device of the user.
3. The method of claim 1 , wherein assigning a network address to a unique local network includes providing one or more user policies to a policy enforcement point network device, the policy enforcement point device enforcing network policies.
4. The method of claim 1 , wherein the address domain manager assigns a network address for a first secure unique local network.
5. The method of claim 4 , wherein the address domain manager assigns the network address for the first secure unique local network to a device of a user.
6. The method of claim 5 , further comprising the step of:
monitoring the data on the first secure unique local network for anomalies.
7. A system for allocating addresses to unique local networks, the system comprising:
a brokered federated policy and identity management system, the brokered federated policy and identity management system having an address domain manager,
the address domain manager:
placing a user device into a first virtual local area network (VLAN); and
authenticating the user; and
placing the user device into a second virtual local area network (VLAN) that is specific to a role of the authenticated user,
the address domain manager arranged to interoperate with a network identity management module, the network identity management module providing management of identity at an application level.
8. The system of claim 7 wherein the brokered federated policy and identity management system includes a policy decision function.
9. The system of claim 7 wherein the brokered federated policy and identity management system includes an authentication broker.
10. The system of claim 7 wherein the brokered federated policy and identity management system includes a secure network access broker.
11. The system of claim 7 wherein the brokered federated policy and identity management system includes a threat protection system.
12. The system of claim 7 further comprising a policy enforcement point.
13. A method for allocating addresses to unique local networks, the method comprising:
providing a computer system, the computer system,
receiving notification of an attempt by a user to access a private network;
assigning the user a first virtual local area network (VLAN);
authenticating the user;
passing an assertion token to a device of the authenticated user;
placing the user device into a second virtual local area network (VLAN) that is specific to a role of the user;
assigning a common default address to the device of the user;
receiving a request from the user to access a secured application, the secured application residing on a first secure unique local network (SULN); and
assigning a network address to the first SULN.
14. The method of claim 13 , further comprising the step of:
verifying an assertion token from the user.
15. The method of claim 13 , further comprising the step of:
placing the user into a second virtual local area network (VLAN).
16. The method of claim 13 , further comprising the step of:
providing one or more user policies to a policy enforcement point network device, the policy enforcement point device enforcing network policies.
17. The method of claim 13 , further comprising the step of:
assigning the network address of the first secure unique local network (SULN) to the device of the user.
18. The method of claim 17 , further comprising the step of:
providing additional user policies to a policy enforcement point device, the policy enforcement point device enforcing network policies.
19. The method of claim 17 , further comprising the step of:
monitoring the SULN with a threat protection system, the threat protection system overseeing and monitoring of the first SULN for anomalies.