Per-user firewall
View Patent ↗A network device to provide per-user firewall capabilities. The network device identifies a user associated with a received frame and a role of the user. The network device determines the firewall actions to be taken for the frame based on the role of the associated user. The user role may be dynamically changed by an administrator or automatically. A user role may be altered based on the authentication level of the user. The network device provides a system where a customized authentication experience may be provided for each user and services and permissions may be managed on a per-user basis.
1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause the one or more hardware processors to:
receive, at a first network device in a Local Area Network (LAN), a first packet associated with a first user device of a first user;
determine the first user device, inside the LAN, associated with the first packet received at the first network device;
assign a default role to the first user upon receiving the first packet, the default role providing services enabling the first user for a pre-authentication role with greater access to network services than the default role;
assign the pre-authentication role to the first user, the pre-authentication role enabling the first user to access common applications;
select, from a plurality of rules, a first set of one or more rules associated with a first role corresponding to the first user;
apply, upon authentication, at least the first set of rules to the first packet to determine a first priority level in a forwarding queue for the first packet;
forward the first packet from the first network device according to the first priority level to control the quality of service provided to the first user device inside the LAN.
2. The medium of claim 1 , wherein the instructions to apply at least the first set of rules are to cause the one or more hardware processors to:
allow forwarding of portions of data that are addressed to a set of ports allowed for the first user device and restricting forwarding of portions of the data that are not addressed to the set of ports allowed for the first user device.
3. The medium of claim 1 , wherein the instructions are further to cause the one or more hardware processors to:
allow forwarding of portions of data that are associated with a set of protocols allowed for the first user device and restrict forwarding of portions of data that are not associated with the set of protocols allowed for the first user device.
4. The medium of claim 1 , wherein the instructions are further to cause the one or more hardware processors to:
allow forwarding of portions of data that are associated with one of a set of source addresses allowed for the first user device and restrict forwarding of portions of data that are not associated with any of the set of source addresses allowed for the first user device.
5. The medium of claim 1 , wherein the first network device, in the LAN, is a switch.
6. The medium of claim 1 , wherein the instructions are further to cause the one or more processors to apply the set of rules to further determine one or more of the following actions for at least a portion of the first packet: deny, permit, redirect, Network Address Translation (NAT), blacklist, log, mirror, queue, or select type of service.
7. The medium of claim 1 , wherein the instructions that are to cause the one or more hardware processors to forward the first packet comprise one or more of: (a) instructions to cause the one or more hardware processors to redirect a first portion of the first packet, (b) instructions to cause the one or more hardware processors to perform a Network Address Translation (NAT) action on the first portion of the first packet, or (c) instructions to cause the one or more hardware processors to mirror the first portion of the first packet.
8. The medium of claim 1 , wherein the instructions to apply at least the first set of rules are to cause the one or more hardware processors to apply at least the first set of rules to further detect a type of service for the first packet.
9. The medium of claim 1 , further comprising instructions that are to cause the one or more hardware processors to:
identify the first user by a source address of the first packet.
10. The medium of claim 1 , further comprising instructions that are to cause the one or more hardware processors to:
alter the first role of the first user in response to an external provisioning message, the altered role of the first user comprising a second set of permissions or rules that are associated with the first user.
11. The medium of claim 1 , further comprising instructions that are to cause the one or more hardware processors to:
receive, at the first network device in the LAN, a second packet from a third network device outside of the LAN;
determine a second user device, inside the LAN, associated with the second packet received at the first network device;
select a second set of one or more rules, from the plurality of rules, corresponding to the second user device associated with the second packet;
apply at least the second set of rules to the second packet to determine a second priority level in the forwarding queue for the second packet, wherein the second priority level is lower than the first priority level; and
forward the second packet from the first network device to the second user device according to the second priority level such that the network provides a lower quality of service to the second user than the first user.
12. A network device comprising:
a hardware processor; and
a memory comprising instructions that causes the processor to:
receive, at the network device, a first packet associated with a first user device of a first user;
determine the first user device, inside the LAN, associated with the first packet received at the network device;
assign a default role to the first user upon receiving the first packet, the default role providing services enabling the first user for a pre-authenticating role with greater access to network services than the default role;
assign the pre-authentication role to the first user, the pre-authentication role enabling the first user to access common applications;
select from a plurality of rules, a first set of one or more rules associated with a first role corresponding to the first user;
apply, upon authentication, at least the first set of rules to the first packet to determine a first priority level in a forwarding queue for the first packet;
forward the first packet from the network device according to the first priority level to control the quality of service provided to the first user device inside the LAN.
13. The network device of claim 12 , wherein to apply at least the first set of rules, the instructions are further to cause the hardware processor to:
allow forwarding of portions of data that are addressed to a set of ports allowed for the first user device and restrict forwarding of portions of data that are not addressed to the set of ports allowed for the first user device.
14. The network device of claim 12 , wherein the instructions are further to cause the hardware processor to:
allow forwarding of portions of data that are associated with a set of protocols allowed for the first user device and restrict forwarding of portions of data that are not associated with the set of protocols allowed for the first user device.
15. The network device of claim 12 , wherein the instructions are further to cause the processor to:
allow forwarding of portions of data that are associated with one of a set of source addresses allowed for the first user device and restrict forwarding of portions of the data that are not associated with any of the set of source addresses allowed for the first user device.
16. The network device of claim 12 , wherein the network device is a switch.
17. The network device of claim 12 , wherein the instructions are further to cause the hardware processor to apply the set of rules to further determine one or more of the following actions for at least a portion of the first packet: deny, permit, redirect, Network Address Translation (NAT), blacklist, log, mirror, queue, or select type of service.
18. The network device of claim 12 , wherein the instructions that are to cause the hardware processor to forward the first packet comprises one or more of: (a) instructions to cause the hardware processor to redirect a first portion of the first packet, (b) instructions to cause the hardware processor to perform a Network Address Translation (NAT) action on the first portion of data first packet, or (c) instructions to cause the hardware processor to mirror the first portion of the first packet.
19. The network device of claim 12 , wherein the instructions to apply at least the first set of rules are to cause the one or more hardware processors to apply at least the first set of rules to further detect a type of service for the first packet.
20. The network device of claim 12 , wherein the instructions are further to cause the processor to:
receive, at the network device in a Local Area Network (LAN), a second packet from a third network device outside of the LAN;
determine a second user device, inside the LAN, associated with the second packet received at the first network device;
select a second set of one or more rules, from the plurality of rules, corresponding to the second user device associated with the second packet;
apply at least the second set of rules to the second packet to determine a second priority level in the forwarding queue for the second packet, wherein the second priority level is lower than the first priority level; and
forward the second packet from the first network device to the second user device according to the second priority level such that the network provides a lower quality of service to the second user than the first user.
21. A method comprising:
receiving, at a network switch in a network in a Local Area Network (LAN), a first packet associated with a first user device of a first user;
determining the first user device, inside the LAN, associated with the first packet received at the first network device;
assigning a default role to the first user upon receiving the first packet, the default role providing services enabling the first user for a pre-authentication role with greater access to network services than the default role;
assigning the pre-authentication role to the first user, the pre-authentication role enabling the first user to access common applications;
selecting, by the processor, from a plurality of rules, a first set of one or more rules associated with a first role corresponding to the first user;
applying, by the processor, upon authentication, at least the first set of rules to the first packet to determine a first priority level for the first packet in a forwarding queue;
forwarding, by the processor, the first packet from the network switch according to the first priority level to control the quality of service provided to the first user inside the LAN.