Method and system for the assignment of security group information using a proxy

1. An apparatus comprising:

a first network device, comprising at least one hardware processor, wherein

said first network device is configured to be coupled to a second network device,

said first network device is further configured to

receive an address of a network device, wherein

said address is represented by address information, and

said address information is received from said second network device,

receive a security group of said network device, wherein

said security group is identified using security group information,

said security group information indicates said network device is a member of said security group, and

said security group information is received from said second network device, and

associate said address information and said security group information with one another by storing said address information and said security group information,

said second network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed, and

said second network device is configured to cause said first network device to store said address information and said security group information by virtue of being configured to

send an install message to said first network device, wherein

said install message comprises said address information and said security group information, and

said install message is configured to cause said first network device to associate said address information and said security group information.

2. The apparatus of claim 1 , wherein

said first network device is further configured to

receive said packet from said second network device,

determine if security group information is associated with said packet using address information associated with said packet, and

associate said security group information with said packet using address information associated with said packet, if security group information is not associated with said packet.

3. The apparatus of claim 2 , wherein said first network device is a distribution layer network device, and said distribution layer network device is further configured to:

determine if security group information should be associated with said packet; and

perform said association of said security group information with said packet only if said security group information should be associated with said packet and said security group information is not associated with said packet, wherein said distribution layer network device is configured to associate said security group information with said packet by virtue of being configured to add said security group information to said packet.

4. The apparatus of claim 3 , further comprising:

an access layer network device, wherein

said second network device is said access layer network device,

said access layer network device is coupled to said distribution layer network device, and

said access layer network device is configured to send said packet to said distribution layer network device.

5. The apparatus of claim 4 , wherein said access layer network device is configured to:

identify a security group membership of another network device, wherein

address information is associated with said another network device,

said security group membership indicates said another network device is a member of a security group, and

said security group is identified using said security group information; and

send said address information and said security group information, wherein

said identifying and said sending are performed by said access layer network device.

6. An apparatus comprising:

a first network device comprising

at least one hardware processor,

means for coupling said first network device to a second network device,

means for receiving an address of a network device, wherein

said address is represented by address information, and

said address information is received from said second network device via said means for receiving,

means for receiving a security group of said network device, wherein

said security group is identified using security group information,

said security group information indicates said network device is a member of said security group, and

said security group information is received from said second network device via said means for receiving, and

means for associating said address information and said security group information with one another comprising means for storing said address information and said security group information, wherein

said second network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed, and

said second network device is configured to cause said first network device to store said address information and said security group information by virtue of being configured to

send an install message to said first network device, wherein

 said install message comprises said address information and said security group information, and

 said install message is configured to cause said first network device to associate said address information and said security group information.

7. An apparatus comprising:

a first network device, comprising at least one hardware processor, wherein

said first network device is configured to

identify an address of a network device, wherein

said address is identified using address information,

identify a security group of the network device, wherein

said security group is identified using security group information, and

said security group information indicates said network device is a member of said security group, and

send said address information and said security group information,

said first network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed,

said first network device is an access layer network device, and

said access layer network device is configured to cause a distribution layer network device to store said address information and said security group information by virtue of being configured to

send an install message to said distribution layer network device,

wherein

said install message comprises said address information and said security group information, and

said install message is configured to cause said distribution layer network device to associate said address information and said security group information.

8. The apparatus of claim 7 , further comprising:

said distribution layer network device, wherein

said distribution layer network device is coupled to receive said address information and said security group information from said access layer network device, and

said distribution layer network device is configured to associate said address information and said security group information.

9. The apparatus of claim 8 , wherein

said distribution layer network device is configured to associate said address information and said security group information by virtue of being configured to

store said address information and said security group information such that said address information and said security group information are associated with one another.

10. The apparatus of claim 8 , wherein

said access layer network device is further configured to

send said packet, and

said distribution layer network device is further configured to

receive said packet,

determine if security group information is associated with said packet, and

associate said security group information with said packet, if security group information is not associated with said packet.

11. A method comprising:

identifying, using at least one hardware processor, an address of a network device, wherein

said address is identified using address information;

identifying a security group of said network device, wherein

said security group is identified using security group information, and

said security group information indicates said network device is a member of said security group; and

sending said address information and said security group information, wherein

said identifying said security group and said sending are performed by a first network device,

said first network device is not configured to support the use of said security group by virtue of not being configured to add said security group information to a packet, such that access control processing of said packet using said security group information can be performed, and

said sending comprises

sending an install message from said first network device to a second network device;

said install message comprises said address information and said security group information, and

said install message is configured to cause said second network device to associate said address information and said security, group information.

12. The method of claim 11 , wherein said sending comprises:

sending said address information and said security group information from said first network device to a second network device, wherein

said second network device is configured to associate said address information and said security group information with one another.

13. The method of claim 12 , further comprising:

causing said second network device to associate said address information and said security group information by storing said address information and said security group information such that said address information and said security group information are associated with one another.

14. The method of claim 13 , further comprising:

receiving said packet from said first network device at said second network device, wherein

packet address information is associated with said packet, and

packet address information is address information associated with said network device;

determining if said security group information should be associated with said packet using said packet address information; and

associating said security group information with said packet, if said packet address information indicates that said security group information is associated with said network device.

15. The method of claim 14 , further comprising:

associating an address and said security group information with one another, wherein

said address allows said security group information to be associated with said packet.

16. The method of claim 15 , wherein

said address is at least one of a media access control address, an internet protocol address and a transport layer port address.

17. The method of claim 14 , wherein said associating comprises:

adding said security group information to said packet.

18. The method of claim 17 , wherein said adding comprises one of:

inserting said security group information in said packet; and

encapsulating said packet, wherein

said encapsulating comprises one of prepending and appending said security group information to said packet.

19. The method of claim 1 , further comprising:

if said security group is invalidated, sending a delete message from said first network device to a second network device, wherein

said delete message is configured to cause said second network device to delete said association of said address information and said security group information.

20. The method of claim 19 , wherein

said delete message comprises said address information and said security group information.