1. Field of the Invention
This invention relates to the field of information network security, and more particularly relates to a method and apparatus for securing access to a network by including network security information within the overhead of a frame.
2. Description of the Related Art
The rapid increase in the size and complexity of networks continually creates new security challenges. Furthermore, the advent of new technologies can also expose networks to new security threats. This is true of all manner of networks, including enterprise networks, service provider networks and the like. Two important considerations in securing a network are: (1) controlling access to the network and entities within the network, and (2) providing security for data frames traversing the network.
With regard to network access control, flexible network access technologies such as wireless, Dynamic Host Configuration Protocol (DHCP), virtual private network (VPN) gateways and the like allow users access to a given protected network from a variety of access or entry points. Conventionally, constraints upon access enjoyed by network users are enforced by access control lists (ACLs), which are used to implement security policies. Effective implementation of ACLs or other network security techniques often requires the dissemination of ACLs or other security information to various locations within the network. As a network grows in size and complexity, disseminating security information becomes more and more challenging.
With regard to maintaining the security of a frame, protecting the security and integrity of data being transferred between two network nodes is also becoming increasingly difficult and increasingly important, especially in the case in which the data being transmitted is itself information regarding network security. Traditionally, for a network implementing the open system interconnection (OSI) model, the standards set through the Institute of Electrical and Electronics Engineers (IEEE) have provided frame security at layer-3 and above. However, there are many protocols that do not presently provide frame security at layer-3. Examples of such protocols include net basic-input-output-system extended user interface (NetBEUI), spanning tree, link aggregation protocol, dynamic host configuration protocol (DHCP), address resolution protocol (ARP), internet packet exchange (IPX) and others. Therefore, providing frame security (e.g., at the open system's interconnect (OSI) model's layer-3) is no longer sufficient to effectively secure many networks.
What is required, then, is a solution that allows frames to carry network information in a manner that facilitates the implementation of network security at various protocol levels. Preferably, such frames should be able to carry information regarding network security in a manner that simplifies the implementation of network security policies. Also preferably, such an approach should provide for the security of individual frames, such that the information regarding network security can be secure within the frame. The approach should be implemented without incurring a disproportionate administrative burden or consuming inordinately large amounts of network resources, while at the same time the approach should be able to be implemented in existing and future protocols.