Fail-safe network authentication

• US 20070157308A1
• Filed: 01/03/2006
• Published: 07/05/2007
• Est. Priority Date: 01/03/2006
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kim, Nathaniel, Lingafelt, Charles, Bardsley, Jeffrey, Roginsky, Allen
• Application Number:
  US11/324,868
• Publication Number:
  US 20070157308A1
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An authenticator is configured with intelligence for the purpose of providing a “failsafe” mode for port-based authentication (802.1x). This failsafe mode enables end users to access a network when communication between the authenticator and the authentication server has temporarily failed, but keeps security measures in place so that unauthorized users cannot gain network access. An 802.1x access control point (e.g., a switch) is enabled to continue to authenticate certain users onto the network during periods of temporary communication failure with the authentication server, by locally storing alternative authentication information limited to historical authentication information of clients that have previously accessed the network via the authentication server. Subsequent revalidation of specific users using the primary authentication information follows restoration of communication with the authentication server.

Claims

1. A fail-safe method of authenticating a client to a network, comprising the steps of:

receiving, at an 802.1x authenticator, a request for authentication from an 802.1x supplicant contained in a client;

entering a fail-safe mode, wherein alternative authentication information stored at said 802.1x authenticator is used to authenticate said client, when primary authentication information stored on an 802.1x authentication server is unavailable; and

re-authenticating said client using said primary authentication information once said primary authentication information stored on said 802.1x authentication server is available, thereby exiting said fail-safe mode.

2. The method of claim 1, wherein said alternative authentication information comprises historical authentication information pertaining to clients that have previously successfully accessed the network via said 802.1x authenticator, said method further comprising the step of:

storing said alternative authentication information in a database local to said 802.1x authenticator.

3. The method of claim 2, further comprising the steps of:

monitoring communication between said 802.1x authenticator and said 802.1x authentication server; and

entering said fail-safe mode when the communication between said 802.1x authenticator and said 802.1x authentication server fails.

4. A fail-safe system for authenticating a client to a network, comprising:

an 802.1x authenticator coupleable to said client, said client containing an 802.1x supplicant;

an 802.1x authentication server, coupleable to said 802.1x authenticator, storing primary authentication information; and

a database local to said 802.1x authenticator, storing alternative authentication information, wherein;

said alternative authentication information is used to authenticate said client when said primary authentication information is unavailable.

5. The system of claim 4, wherein said client is reauthenticated using said primary authentication information when said primary authentication is available.

6. The system of claim 5, wherein said alternative authentication information comprises historical authentication information limited to authentication information pertaining to clients that have previously successfully accessed the network via said 802.1x authenticator.

7. A fail-safe computer program product for authenticating a client to a network, the computer program product comprising a computer-readable storage medium having computer readable program code embodied in the medium, the computer-readable program code comprising:

computer-readable program code that receives, at an 802.1x authenticator, a request for authentication from an 802.1x supplicant contained in a client;

computer-readable program code that configures said 802.1x authenticator to enter a fail-safe mode, wherein alternative authentication information stored at said 802.1x authenticator is used to authenticate said client when primary authentication information stored on an 802.1x authentication server is unavailable; and

computer-readable program code that re-authenticates said client using said primary authentication information once said primary authentication information stored on said 802.1x authentication server is available, thereby exiting said fail-safe mode.

8. The computer program product of claim 7, wherein said alternative authentication information comprises historical authentication information pertaining to clients that have previously successfully accessed the network via said 802.1x authenticator, said method further comprising:

computer-readableprogram code that stores said alternative authentication information in a database local to said 802.1x authenticator.

9. The computer program product of claim 8, further comprising:

computer-readable program code that monitors communication between said 802.1x authenticator and said 802.1x authentication server; and

computer-readable program code that enters said fail-safe mode when the communication between said 802.1x authenticator and said 802.1x authentication server fails.