Method and apparatus for automatically re-validating multiple clients of an authentication system

• US 20060026670A1
• Filed: 08/02/2004
• Published: 02/02/2006
• Est. Priority Date: 08/02/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Stieglitz, Jeremy, Potter, Darran, Clymer, Andrew
• Granted Patent: US 7,587,751 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is disclosed for performing on-demand posture validation for all of multiple clients or supplicants of an authentication system, comprising creating and storing a session list identifying communication sessions relating to supplicants that access a computer network through an access device; receiving input requesting performing posture validation for all the supplicants; determining a time value for starting the posture validation for a particular supplicant identified in the session list; generating and sending to the access device, a request to perform posture validation, wherein the request comprises supplicant identifying information and the time value and instructs the access device to initiate the posture validation for that supplicant only after the time value has expired; and repeating the steps of determining, generating and sending for all supplicants in the session list.

Claims

1. A method, comprising the computer-implemented steps of:

creating and storing a session list identifying communication sessions relating to supplicants that access a computer network through an access device;

receiving input requesting performing posture validation for all the supplicants;

determining a time value for starting the posture validation for a particular supplicant identified in the session list;

generating and sending to the access device, a request to perform posture validation, wherein the request comprises supplicant identifying information and the time value and instructs the access device to initiate the posture validation for that supplicant only after the time value has expired; and

repeating the steps of determining, generating and sending for all supplicants in the session list.

2. A method as recited in claim 1, wherein the user input comprises a selection for mass posture re-validation by a network administrator using a network management application.

3. A method as recited in claim 1, wherein the user input comprises an event received from an anti-virus system, threat detection system, intrusion detection system, or other functional system.

4. A method as recited in claim 1, wherein the request to perform posture validation comprises a RADIUS Change of Authorization request message.

5. A method as recited in claim 1, wherein the request to perform posture validation comprises a RADIUS Change of Authorization request message with a Service Type value of Authorize-Only.

6. A method as recited in claim 1, wherein the request to perform posture validation comprises a RADIUS Change of Authorization request message with a Service Type value of Authorize-Only, wherein the supplicant identifying information comprises a User-Identity attribute in the Change of Authorization request message, and the time value is encoded as an additional attribute in the Change of Authorization request message.

7. A method as recited in claim 1, further comprising the steps, performed at an access device, of:

initiating a timer for a time period equal to the time value; and

initiating posture validation for the supplicant identified in the request to perform posture validation only after the timer has expired.

8. A method as recited in claim 1, wherein posture validation comprises any one or more of:

receiving and evaluating machine certificates, machine identity information, software configuration or policy compliance information, machine or user governance information, or performing other user or machine credential checks.

9. A computer-readable medium carrying one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, or 8.

11. An apparatus as recited in claim 24, further comprising means for performing the functions recited in the steps of any of claims 2, 3, 4, 5, 6, 7, or 8.

12. An apparatus for providing multiple authentication types within an authentication protocol that supports a single type of authentication for a client in communication with an authorization server over a network, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, or 8.

10. An apparatus, comprising:

means for creating and storing a session list identifying communication sessions relating to supplicants that access a computer network through an access device;

means for receiving input requesting performing posture validation for all the supplicants;

means for determining a time value for starting the posture validation for a particular supplicant identified in the session list;

means for generating and sending to the access device, a request to perform posture validation, wherein the request comprises supplicant identifying information and the time value and instructs the access device to initiate the posture validation for that supplicant only after the time value has expired; and

means for repeating the steps of determining, generating and sending for all supplicants in the session list.