RADIUS SECURITY ORIGIN CHECK

• US 20080178264A1
• Filed: 01/20/2007
• Published: 07/24/2008
• Est. Priority Date: 01/20/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Keohane, Susann Marie, McBrearty, Gerald Francis, Shieh, Johnny Meng-Han, Mullen, Shawn Patrick, Murillo, Jessica Carol
• Granted Patent: US 7,886,339 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A computer implemented method, apparatus, and computer program product for authenticating a user to a network. In response to receiving a request from a user to access a protected resource, the process sends a unique bit sequence into a network connection utilized by the user. Next, the process authenticates the user to access the protected resource in response to receiving a verification that the unique bit sequence was received by an access point that authenticated the user when the user logged on to the network.

Claims

1. A computer implemented method for authenticating a user to a network, the computer implemented method comprising:

responsive to receiving a request from the user to access a protected resource, sending a unique bit sequence into a network connection utilized by the user; and

responsive to receiving a verification that the unique bit sequence has been received by an access point that authenticated the user when the user logged on to the network, authenticating the user to access the protected resource.

2. The computer implemented method of claim 1 further comprising:

identifying an Internet protocol address for the network connection utilized by the user to connect to the network.

3. The computer implemented method of claim 1 further comprising:

sending a query to an authentication server, wherein the query requests confirmation that the network connection is originating from an Internet protocol address assigned to the user.

4. The computer implemented method of claim 1 further comprising:

sending a notice to an authentication server that the protected resource is injecting the unique bit sequence into the network connection.

5. The computer implemented method of claim 3 further comprising:

sending a notice to the access point that the protected resource is injecting the unique bit sequence into the network connection.

6. The computer implemented method of claim 1 further comprising:

confirming that the network connection utilized by the user is originating from an Internet protocol address assigned to the user based on a determination that the unique bit sequence was detected heading toward a computing device associated with the Internet protocol address assigned to the user.

7. The computer implemented method of claim 6 wherein confirming further comprises:

sending a message verifying an origin of the network connection to an authentication server.

8. The computer implemented method of claim 7 further comprising:

responsive to receiving the message verifying the origin of the network connection, sending an authentication of the user to the protected resource.

9. The computer implemented method of claim 8 wherein the authentication is the verification that the unique bit sequence was received by the access point that authenticated the user when the user logged on to the network.

10. The computer implemented method of claim 1 wherein the unique bit sequence is a random sequence of bits having a bit length equal to a length of a maximum transmission unit.

11. A computer implemented method for authenticating a user to a network, the computer implemented method comprising:

responsive to receiving a request from the user to access a protected resource, sending an Internet protocol address used by the user to an authentication server; and

responsive to receiving login information for the user from the authentication server, authenticating the user using the login information.

12. The computer implemented method of claim 11 wherein the login information is a user name and password pair.

13. The computer implemented method of claim 11 further comprising:

responsive to receiving, by the authentication server, the Internet protocol address for the user from the protected resource, retrieving a user name and password pair used by the Internet protocol address; and

sending the user name and password pair to the protected resource, wherein the user name and password pair forms the login information.

14. A computer program product comprising:

a computer usable medium including computer usable program code for authenticating a user to a network, said computer program product comprising;

computer usable program code for sending a unique bit sequence into a network connection utilized by the user in response to receiving a request from the user to access a protected resource; and

computer usable program code for authenticating the user to access the protected resource in response to receiving a verification that an origin security check package was received by an access point that authenticated the user when the user logged on to the network.

15. The computer program product of claim 14, wherein the unique bit sequence is a random sequence of bits having a bit length equal to a length of a maximum transmission unit.

16. The computer program product of claim 14 further comprising:

computer usable program code for confirming that the network connection utilized by the user is originating from an Internet protocol address assigned to the user based on a determination that the unique bit sequence was detected heading toward a computing device associated with the Internet protocol address assigned to the user.

17. A system for authenticating a user to a network, the system comprising:

a protected resource, wherein the protected resource sends a unique bit sequence into a network connection utilized by the user to determine if the user is an authorized user, and wherein the protected resource notifies an authentication server that the unique bit sequence has been sent.

18. The system of claim 17 further comprising:

an access point, wherein the access point detects the unique bit sequence heading for a computing device.

19. The system of claim 18 further comprising:

the authentication server, wherein the authentication server verifies that the user is the authorized user if the unique bit sequence is detected by the access point, moving toward an authenticated computing device corresponding to an Internet protocol address assigned to the user.

20. The system of claim 17 wherein the unique bit sequence is a random sequence of bits having a bit length equal to a length of a maximum transmission unit.