System and method for dynamically determining the role of a network device in a link authentication protocol exchange

• US 20060036856A1
• Filed: 08/10/2004
• Published: 02/16/2006
• Est. Priority Date: 08/10/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kok, Wilson
• Granted Patent: US 7,657,744 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Various methods and systems for dynamically determining the role of a network device in a link authentication protocol exchange are disclosed. In one embodiment, such a method involves monitoring several (e.g., two) link authentication protocol exchanges. These link authentication protocol exchanges can be initiated at substantially the same time. A first network device acts as an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges. One of the link authentication protocol exchanges is terminated prior to completion.

Claims

1. A method comprising:

monitoring a plurality of link authentication protocol exchanges, wherein

a first network device is an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges; and

terminating one of the link authentication protocol exchanges prior to completion of the one of the link authentication protocol exchanges.

2. The method of claim 1, wherein

the link authentication protocol exchanges are initiated at substantially the same time.

3. The method of claim 1, wherein

it is indeterminate whether the first network device should be the authenticator or the supplicant, prior to initiation of the link authentication protocol exchanges.

4. The method of claim 1, wherein

the terminating comprises terminating participation of the first network device in one of the link authentication protocol exchanges.

5. The method of claim 4, further comprising:

detecting whether the first network device has connectivity with an authentication server, wherein

the terminating is performed in response to the detecting.

6. The method of claim 5, wherein

the detecting comprises detecting receipt of a non-ID request from a second network device by the first network device, and

the terminating comprises terminating the first one of the link authentication protocol exchanges.

7. The method of claim 5, wherein

the detecting comprises detecting receipt of a message from the authentication server by the first network device, and

the terminating comprises terminating the second one of the link authentication protocol exchanges.

8. The method of claim 5, further comprising

detecting that both the first network device and a second network device have connectivity with the authentication server;

and

performing a tiebreaker function, in response to the detecting, wherein

the terminating is performed in response to the performing the tiebreaker function.

9. The method of claim 8, wherein

the performing the tiebreaker function comprises comparing a first identifier of the first network device with a second identifier of the second network device.

10. The method of claim 5, wherein the link authentication protocol exchanges are IEEE 802.1X protocol exchanges.

11. The method of claim 5, further comprising:

completing one of the link authentication protocol exchanges; and

authenticating an interface that is coupled to a link coupling the first network device to a second network device in response to the completing.

12. A network device comprising:

an authenticator module for a link authentication protocol;

a supplicant module for the link authentication protocol; and

a role determination module coupled to the authenticator module and the supplicant module.

13. The network device of claim 12, wherein

the role determination module is configured to:

monitor the authenticator module and the supplicant module, and

terminate operation of one of the authenticator module and the supplicant module, prior to completion of a link authentication exchange being participated in by the one of the authenticator module and the supplicant module.

14. The network device of claim 13, wherein

the role determination module is configured to detect whether the network device has connectivity with an authentication server.

15. The network device of claim 14, wherein

the role determination module is configured to detect receipt of a non-ID request by the supplicant module, and

the role determination module is configured to terminate operation of the authentication module in response to the non-ID request.

16. The network device of claim 14, wherein

the role determination module is configured to detect receipt of a message from the authentication server by the authentication module, and

the role determination module is configured to terminate operation of the supplicant module in response to the message.

17. The network device of claim 14, wherein

the role determination module is configured to:

detect whether both the network device and a second network device have connectivity with the authentication server, and

perform a tiebreaker function in response to detecting that both the network device and the second network device have connectivity with the authentication server, and

terminate operation of one of the authenticator module and the supplicant module in response to a result of the tiebreaker function.

18. A system comprising:

a plurality of network devices coupled by a plurality of links, wherein a first network device of the network devices comprises;

an authenticator module for a link authentication protocol;

a supplicant module for the link authentication protocol; and

a role determination module coupled to the authenticator module and the supplicant module.

19. The system of claim 18, wherein

a first link of the links couples the first network device to a second network device of the network devices.

20. The system of claim 19, wherein

the second network device comprises:

a second authenticator module for the link authentication protocol,

a second supplicant module for the link authentication protocol, and

a second role determination module coupled to the second authenticator module and to the second supplicant module.

21. The system of claim 20, wherein

the role determination module is configured to:

monitor the authenticator module and the supplicant module, and

terminate operation of one of the authenticator module and the supplicant module, prior to completion of a link authentication exchange being participated in by the one of the authenticator module and the supplicant module.

22. The system of claim 21, wherein

the role determination module is configured to detect whether the network device or the second network device has connectivity with an authentication server.

23. The system of claim 22, wherein

the role determination module is configured to detect receipt of a non-ID request from the second network device by the supplicant module, and

the role determination module is configured to terminate operation of the authentication module in response to the non-ID request.

24. The system of claim 22, wherein

the role determination module is configured to detect receipt of a message from the authentication server by the authentication module, and

the role determination module is configured to terminate operation of the supplicant module in response to the message.

25. The system of claim 22, wherein

the role determination module is configured to:

detect whether both the network device and the second network device have connectivity with the authentication server, and

perform a tiebreaker function in response to detecting that both the network device and the second network device have connectivity with the authentication server, and

terminate operation of one of the authenticator module and the supplicant module in response to a result of the tiebreaker function.

26. A computer readable medium comprising program instructions executable to:

monitor a plurality of link authentication protocol exchanges, wherein

a first network device is an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges; and

terminate one of the link authentication protocol exchanges prior to completion of the one of the link authentication protocol exchanges.

27. The computer readable medium of claim 26, wherein

the link authentication protocol exchanges are initiated at substantially the same time.

28. The computer readable medium of claim 26, wherein

it is indeterminate whether the first network device should be the authenticator or the supplicant, prior to initiation of the link authentication protocol exchanges.

29. The computer readable medium of claim 26, wherein

terminating the one of the link authentication protocol exchanges comprises terminating participation of the first network device in one of the link authentication protocol exchanges.

30. The computer readable medium of claim 29, wherein the program instructions are further executable to:

detect whether the first network device has connectivity with an authentication server, wherein

the one of the link authentication protocol exchanges is terminated in response to the detecting.

31. The computer readable medium of claim 30, wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a non-ID request from a second network device by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the first one of the link authentication protocol exchanges.

32. The computer readable medium of claim 30, wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a message from the authentication server by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the second one of the link authentication protocol exchanges.

33. The computer readable medium of claim 30, wherein the program instructions are further executable to:

detect that both the first network device and a second network device have connectivity with the authentication server; and

perform a tiebreaker function, in response to detecting that both the first network device and the second network device have connectivity with the authentication server, wherein

the one of the link authentication protocol exchanges is terminated in response to the performing the tiebreaker function.

34. A system comprising:

means for monitoring a plurality of link authentication protocol exchanges, wherein

a first network device is an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges; and

means for terminating one of the link authentication protocol exchanges prior to completion of the one of the link authentication protocol exchanges.

35. The system of claim 34, wherein

the link authentication protocol exchanges are initiated at substantially the same time.

36. The system of claim 34, wherein

it is indeterminate whether the first network device should be the authenticator or the supplicant, prior to initiation of the link authentication protocol exchanges.

37. The system of claim 34, wherein

terminating the one of the link authentication protocol exchanges comprises terminating participation of the first network device in one of the link authentication protocol exchanges.

38. The system of claim 37, further comprising:

means for detecting whether the first network device has connectivity with an authentication server, wherein

the one of the link authentication protocol exchanges is terminated in response to the detecting.

39. The system of claim 38, wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a non-ID request from a second network device by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the first one of the link authentication protocol exchanges.

40. The system of claim 38, wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a message from the authentication server by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the second one of the link authentication protocol exchanges.

41. The system of claim 38, further comprising:

means for detecting that both the first network device and a second network device have connectivity with the authentication server; and

means for performing a tiebreaker function, in response to detecting that both the first network device and the second network device have connectivity with the authentication server, wherein

the one of the link authentication protocol exchanges is terminated in response to the performing the tiebreaker function.