Method and apparatus for determining authentication capabilities

• US 20060026671A1
• Filed: 08/02/2004
• Published: 02/02/2006
• Est. Priority Date: 08/02/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Stieglitz, Jeremy, Potter, Darran, Clymer, Andrew
• Granted Patent: US 7,194,763 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64

Abstract

A method is disclosed for determining the authentication capabilities of a supplicant before initiating an authentication conversation with a client, for example, using Extensible Authentication Protocol (EAP). In one aspect, the method provides for sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server; receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant; determining how many second authentication methods in the counter-list match the first authentication methods; and performing an authentication policy action based on how many of the second authentication methods match the first authentication methods. Policy actions can include blocking access, re-directing to sources of acceptable authentication methods, granting one of several levels of network access, etc.

Claims

1. A method, comprising the computer-implemented steps of:

sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server;

receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant;

determining how many second authentication methods in the counter-list match the first authentication methods; and

performing an authentication policy action based on how many of the second authentication methods match the first authentication methods.

2. A method as recited in claim 1, wherein the determining and performing steps comprise:

determining whether the counter-list identifies enough second authentication methods that match the first authentication methods, based on a policy applicable to the supplicant and identity information associated with the supplicant; and

initiating an authentication conversation with the supplicant only when the counter-list identifies enough matching second authentication methods.

3. A method as recited in claim 1, wherein the authentication policy action comprises sending an authentication failure message to the supplicant when the counter-list fails to identify enough matching second authentication methods.

4. A method as recited in claim 1, wherein the authentication policy action comprises re-directing the supplicant to an authentication method provisioning system that contains one or more of the first authentication methods.

5. A method as recited in claim 1, wherein the authentication policy action comprises:

initiating an authentication conversation with the supplicant based on one of the first authentication methods that matches; and

if the authentication conversation is successful, granting one of a plurality of levels of access to the computer network based on how many second authentication methods in the counter-list match the first authentication methods.

6. A method as recited in claim 1, wherein the authentication policy action comprises:

initiating a plurality of authentication conversations with the supplicant based on a plurality of the first authentication methods that match;

determining respective results for each of the plurality of authentication conversations;

determining whether to grant access to one or more network resources based on results of each of the plurality of authentication conversations.

7. A method as recited in claim 6, wherein determining whether to grant access comprises granting one of a plurality of levels of access to the computer network based on the results of the plurality of authentication conversations.

8. A method as recited in any of claims 6 or 7, wherein the authentication conversations comprise any one or more of:

receiving and evaluating machine certificates, machine identity information, software or policy compliance information, machine or user governance information, or performing other user or machine credential checks.

9. A method as recited in claim 1, wherein the authentication methods are Extensible Authentication Protocol (EAP) methods.

10. A method as recited in claim 1, wherein the list of first authentication methods is sent in an EAP type-length-value (TLV) request.

11. A method as recited in claim 10, wherein the list of first authentication methods comprises one or more octet pairs, wherein a first octet of an octet pair comprises a number of an EAP method, and a second octet comprises a mandatory flag.

12. A method as recited in claim 1, wherein the first list is an ordered list.

13. A method as recited in claim 1, further comprising establishing, before performing the steps of claim 1, an outer EAP tunnel authentication conversation between the supplicant and the authentication server.

22. A method as recited in claim 14, further comprising establishing, before performing the steps of claim 1, an outer EAP tunnel authentication conversation between the supplicant and the authentication server.

23. A computer-readable medium carrying one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, 9, 10, 11, 12, or 13.

25. An apparatus as recited in claim 24, further comprising means for performing the functions recited in the steps of any of claims 2, 3, 4, 5, 6, 7, 9, 10, 11, 12, or 13.

26. An apparatus for providing multiple authentication types within an authentication protocol that supports a single type of authentication for a client in communication with an authorization server over a network, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, 9, 10, 11, 12, or 13.

14. A method of determining capabilities of a supplicant under Extensible Authentication Protocol (EAP), the method comprising the computer-implemented steps of:

sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first EAP methods that are supported by an authentication server, in a Capability Assertion Request comprising one or more EAP type-length-value objects;

receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant, in a Capability Assertion Response comprising one or more EAP TLV objects;

determining how many second authentication methods in the counter-list match the first authentication methods; and

performing an authentication policy action based on how many of the second authentication methods match the first authentication methods.

15. A method as recited in claim 14, wherein the determining and performing steps comprise:

determining whether the counter-list identifies enough second authentication methods that match the first authentication methods, based on a policy applicable to the supplicant and identity information associated with the supplicant; and

initiating an authentication conversation with the supplicant only when the counter-list identifies enough matching second authentication methods.

16. A method as recited in claim 14, wherein the authentication policy action comprises sending an authentication failure message to the supplicant when the counter-list fails to identify enough matching second authentication methods.

17. A method as recited in claim 14, wherein the authentication policy action comprises re-directing the supplicant to an authentication method provisioning system that contains one or more of the first authentication methods.

18. A method as recited in claim 14, wherein the authentication policy action comprises:

initiating an authentication conversation with the supplicant based on one of the first authentication methods that matches; and

if the authentication conversation is successful, granting one of a plurality of levels of access to the computer network based on how many second authentication methods in the counter-list match the first authentication methods.

19. A method as recited in claim 14, wherein the authentication policy action comprises:

initiating a plurality of authentication conversations with the supplicant based on a plurality of the first authentication methods that match; and

determining respective results for each of the plurality of authentication conversations;

determining whether to grant access to one or more network resources based on results of each of the plurality of authentication conversations.

20. A method as recited in claim 19, wherein determining whether to grant access comprises granting one of a plurality of levels of access to the computer network based on the results of the plurality of authentication conversations.

21. A method as recited in claim 14, wherein the list of first authentication methods comprises one or more octet pairs, wherein a first octet of an octet pair comprises a number of an EAP method, and a second octet comprises a mandatory flag.

24. An apparatus, comprising:

means for sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server;

means for receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant;

means for determining how many second authentication methods in the counter-list match the first authentication methods; and

means for performing an authentication policy action based on how many of the second authentication methods match the first authentication methods.