US4896319A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Identification and authentication of end user systems for packet communications network services
Assignee: Nokia Bell Labs
•
Filing: 1988-03-31
•
Granted: 1990-01-23
•
Expires: 2008-03-31
Abstract
Abstract A high capacity metropolitan area network (MAN) is described. Data traffic from users is connected to data concentrators at the edge of the network, and is transmitted over fiber optic data links to a hub where the data is switched. The hub includes a plurality of data switching modules, each having a control means, and each connected to a distributed control space division switch. Advantageously, the data switching modules, whose inputs are connected to the concentrators, perform all checking and routing functions, while the 1024x1024 maximum size space division switch, whose outputs are connected to the concentrators, provides a large fan-out distribution network for reaching many concentrators from each data switching module. Distributed control of the space division switch permits several million connection and disconnection actions to be performed each second, while the pipelined and parallel operation within the control means permits each of the 256 switching modules to process at least 50,000 transactions per second. The data switching modules chain groups of incoming packets destined for a common outlet of the space division switch so that only one connection in that switch is required for transmitting each group of chained packets from a data switching module to a concentrator. MAN provides security features including a port identification supplied by the data concentrators, and a check that each packet is from an authorized source user, transmitting on a port associated with that user, to an authorized destination user that is in the same group (virtual network) as the source user.
Inventors
- 👤 William P. Lidinsky
- 👤 Gary A. Roediger
- 👤 Scott B. Steele
- 👤 Ronald C. Weddige
- 👤 Bruce R. Zelle
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 18:21
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0272; H04L12/00; H04L12/54; H04L12/56; H04L63/08; H04L63/083; H04L63/10; H04L63/12; H04L63/123; H04L63/16; H04L63/162; H04L9/00; H04L9/40
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
96 words
In a data network, a method of obtaining security in packet transmission from an input port to an output port, comprising the steps of: including in each data packet an identity of said input port and an identity of a user of said input port transmitting said each data packet; and in said network, prior to transmitting to said output port, for said each data packet, checking whether said user, identified by said user identity, has been previously authorized to transmit from said input port identified by said port identity if network transmission capacity is available.
Claim 2
Dependent Claim
96 words
In a data network, a method of obtaining security in packet transmission from an input port to an output port, comprising the steps of: including in each data packet an identity of said input port and an identity of a user of said input port transmitting said each data packet; and in said network, prior to transmitting to said output port, for said each data packet, checking whether said user, identified by said user identity, has been previously authorized to transmit from said input port identified by said port identity if network transmission capacity is available.
Claim 3
Dependent Claim
119 words
In a data network, a method of obtaining security in packet transmission from an input port to an output port, comprising the steps of: including in each data packet an identify of said input port and an identity of a user of said input port transmitting said each data packet; and in said network, prior to transmitting to said output port, for said each data packet, checking whether said user, identified by said user identity, has been previously authorized to transmit from said input port identified by said port identity if network transmission capacity is available; wherein said identify of said port is supplied by said data network and is out of control of a user at said port.
Claim 4
Dependent Claim
119 words
In a data network, a method of obtaining security in packet transmission from an input port to an output port, comprising the steps of: including in each data packet an identify of said input port and an identity of a user of said input port transmitting said each data packet; and in said network, prior to transmitting to said output port, for said each data packet, checking whether said user, identified by said user identity, has been previously authorized to transmit from said input port identified by said port identity if network transmission capacity is available; wherein said identify of said port is supplied by said data network and is out of control of a user at said port.
Claim 5
Dependent Claim
77 words
A data network for transmitting data packets, comprising: means for inserting in a packet am identity of a port transmitting said packet, said means being comprised in said network and out of control of a user at said port; and means for authenticating from said port identity of said port and from addressing data in said packet whether said port is authorized to transmit said packet to said network prior to transmitting said packet to a destination.
Claim 6
Dependent Claim
77 words
A data network for transmitting data packets, comprising: means for inserting in a packet am identity of a port transmitting said packet, said means being comprised in said network and out of control of a user at said port; and means for authenticating from said port identity of said port and from addressing data in said packet whether said port is authorized to transmit said packet to said network prior to transmitting said packet to a destination.
Claim 7
Dependent Claim
34 words
The data network of claim 3 wherein said means for authenticating further comprises means for authenticating whether said port is authorized to transmit said packet to a destination user identified in said addressing data.
Claim 8
Dependent Claim
261 words
In a data network, a method of achieving secure transmission from a source user to a destination user comprising the steps of: said destination user logging into said system with a login data packet comprising a destination user password, destination user identification, a destination group identification, and a destination port identification supplied by said network; said data network authenticating said destination user password, destination user identification, destination user group number, and destination user port number as being authorized to receive packets for said destination group and user; said source user logging into said system with a login packet comprising an identification of said source user, a source user password, a source group identification, and a source port identification supplied by said network; authenticating said source user password and source user, source user group, and source user port identifications; recording, in source tables, authorization for said identifications of said source user, source group, and source port; recording, in routing tables, authorization for said destination user and said destination group, and an identity of said destination port; for each transmitted packet, checking a source user identification and source group identification, and a source port identification supplied by said network, in said source tables, and finding a destination port using a destination user identification and a destination group identification in said routing tables; if results of said source checking and destination port finding steps indicate that said source and said destination have been recorded in said source tables and said destination tables, transmitting said packet to a destination port identified in said finding step.
Claim 9
Dependent Claim
261 words
In a data network, a method of achieving secure transmission from a source user to a destination user comprising the steps of: said destination user logging into said system with a login data packet comprising a destination user password, destination user identification, a destination group identification, and a destination port identification supplied by said network; said data network authenticating said destination user password, destination user identification, destination user group number, and destination user port number as being authorized to receive packets for said destination group and user; said source user logging into said system with a login packet comprising an identification of said source user, a source user password, a source group identification, and a source port identification supplied by said network; authenticating said source user password and source user, source user group, and source user port identifications; recording, in source tables, authorization for said identifications of said source user, source group, and source port; recording, in routing tables, authorization for said destination user and said destination group, and an identity of said destination port; for each transmitted packet, checking a source user identification and source group identification, and a source port identification supplied by said network, in said source tables, and finding a destination port using a destination user identification and a destination group identification in said routing tables; if results of said source checking and destination port finding steps indicate that said source and said destination have been recorded in said source tables and said destination tables, transmitting said packet to a destination port identified in said finding step.
Claim 10
Dependent Claim
30 words
The method of claim 5 wherein said source group and said destination group for a transmitted packet are the same, whereby only users with a common group identification may communicate.
Claim 11
Dependent Claim
43 words
The method of claim 6 further comprising the steps of: if results of said source checking and said destination finding do not indicate that said source and said destination have been recorded in said source tables and said destination tables, discarding said packet.
Claim 12
Dependent Claim
21 words
The method of claim 7 further comprising the step of recording source and destination data for a packet to be discarded.
Claim 13
Dependent Claim
33 words
The method of claim 6 wherein said destination finding step further comprises the step of inserting an identification of said destination port found in said destination finding step into said each transmitted packet.
Claim 14
Dependent Claim
76 words
The method of claim 2 further comprising the steps of: checking whether a virtual network number comprised in said each data packet is authorized for said user identity and said port identity; checking whether a destination identification comprised in said each data packet is included in a virtual network specified by said virtual network number; and responsive to positive results from said checking steps, transmitting said each packet to a port identified by said destination identification.
Claim 15
Dependent Claim
37 words
The data network of claim 4, wherein said means for authenticating comprises means for authenticating whether a user identified in said packet is authorized to transmit from said port to a virtual network identified in said packet.
Claim 16
Dependent Claim
33 words
The data network of claim 11 wherein said means for authenticating further comprises means for authenticating whether a destination identified in said data network is authorized to receive packets for said virtual network.
References Cited (Backward Citations)
US4386266A
Cited
US4475192A
Cited
US4663754A
Cited
US4710613A
Cited
US4672533A
Cited
US4707827A
Cited
US4764919A
Cited
US4745593A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1993-01-22 | 1993-07-24 | 1994-01-23 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 1997-01-22 | 1997-07-24 | 1998-01-23 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2001-01-22 | 2001-07-24 | 2002-01-23 | $7700.00 | Window Closed / Lapsed |