Identity-based internet protocol networking
Disclosed herein are system, method, and computer program product embodiments for identity-based internet protocol networking. An embodiment operates by receiving a packet from a device of a secured network. A strength of authentication of the device is determined based on how a user account associated with the device is authenticated. A policy corresponding to the strength of authentication is determined. The packet is transmitted based upon the policy.
1. A method, comprising:
receiving a packet from a device of a secured network, wherein the packet comprises an identity-based internet protocol (IBIP) shim within a header of the packet:
determining a device and a destination to which the packet is to be transmitted based on the IBIP shim;
determining a policy corresponding to the strength of authentication, wherein the policy indicates at least whether the device is authorized to transmit the packet to the destination; and
transmitting the packet based upon the policy.
2. The method of claim 1 , wherein the determining the strength of authentication comprises:
determining the strength of authentication based on whether a security badge is detected as being provided to the device.
3. The method of claim 2 , wherein the determining the strength of authentication comprises:
determining the strength of authentication based on whether a username and password were received.
4. The method of claim 1 , wherein the determining the policy comprises:
determining that the policy is based on an identification of the device and an identification of the destination, wherein the destination identifies a device that is part of the secured network.
5. The method of claim 1 , wherein the transmitting comprises:
transmitting the packet to the destination based upon at least the policy authorizing the device.
6. The method of claim 1 , wherein the transmitting comprises:
dropping the packet based upon at least the policy not authorizing the device.
7. The method of claim 6 , further comprising:
logging a policy violation; and
removing the device from the secured network.
8. A system, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
receive a packet from a device of a secured network, wherein the packet comprises an identity-based internet protocol (IBIP) shim within a header of the packet;
determine a device and a destination to which the packet is to be transmitted based on at least the IMP shim:
determine a strength of authentication of the device based on at least how a user account associated with the device is authenticated;
determine a policy corresponding to the strength of authentication, wherein the policy indicates at least whether the device is authorized to transmit the packet to the destination; and
transmit the packet based upon the policy.
9. The system of claim 8 , wherein the processor that determines the strength of authentication is configured to:
determine the strength of authentication strength based on whether a security badge is detected as being provided to the device.
10. The system of claim 9 , wherein the processor that determines the strength of authentication is configured to:
determine the strength of authentication based on whether a username and password were received.
11. The system of claim 8 , wherein the processor that determines the policy is configured to:
determine that the policy is based on an identification of the device and an identification of destination, wherein the destination identifies to a device that is part of the secured network.
12. The system of claim 8 , wherein the processor that transmits is configured to:
transmit the packet to the destination based upon at least the policy authorizing the device.
13. The system of claim 8 , wherein the processor that transmits is configured to:
drop the packet based upon at least the policy not authorizing the device.
14. The system of claim 13 , wherein the at least one processor is further configured to:
log a policy violation; and
remove the device from the secured network.
15. A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
receiving a packet from a device of a secured network, wherein the packet comprises an identity-based internet protocol (IBIP) shim within a header of the packet, including information indicating a destination to which the packet is to be transmitted;
determining a device and the destination based on the IBIP shim;
determining a strength of authentication of the device based on at least how a user account associated with the device is authenticated;
determining a policy corresponding to the strength of authentication, wherein the policy indicates at least whether the device is authorized to transmit the packet to the destination; and
transmitting the packet based upon the policy.
16. The non-transitory computer-readable device of claim 15 , herein the determining the strength of authentication comprises:
determining the strength of authentication based on whether a security badge is detected as being provided to the device.
17. The non-transitory computer-readable device of claim 16 , wherein the determining the strength of authentication comprises:
determining the strength of authentication based on whether a username and password were received.
18. The non-transitory computer-readable device of claim 15 , wherein the determining the policy comprises:
determining that the policy is based on an identification of the device and an identification of the destination, wherein the destination identifies a device that is part of the secured network.