SYSTEM, METHOD AND APPARATUS FOR PROVIDING MULTIPLE ACCESS MODES IN A DATA COMMUNICATIONS NETWORK

• US 20100325700A1
• Filed: 08/26/2010
• Published: 12/23/2010
• Est. Priority Date: 08/01/2003
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.), Foundry Networks LLC A Delware Limited Liability Company
• Inventors: KWAN, Philip
• Granted Patent: US 8,249,096 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports. Control logic within the network access device is adapted to determine whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network. If the user authentication protocol is not supported, then the input port to which the network access device is coupled is placed in a semi-authorized access state that limits access to a pre-configured network accessible via the host network.

Claims

1. A computer implemented method comprising:

at a network access device communicably coupled to a network, sensing a user device coupled to a port of the network access device;

determining, by the network access device, if the user device supports a user authentication protocol used by the network, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

placing, by the network access device, the port into a semi-authorized access state if the determining indicates that the user device does not support the user authentication protocol, the semi-authorized access state providing the user device with limited network access.

2. The method of claim 1, wherein the semi-authorized state limits access by the user device to a network, the network selected from the group comprising a Voice over Internet Protocol (VoIP) network, the Internet, and a low security virtual local area network (VLAN).

3. The method of claim 1, wherein the placing comprises selectively placing the port into one of a plurality of semi-authorized access states.

4. The method of claim 3, wherein the placing comprises:

determining a type of the user device; and

selectively placing the port into one of a plurality of semi-authorized access states based on the type of the user device.

5. The method of claim 4, wherein the selectively placing comprises selectively placing the port into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

6. The method of claim 4, wherein the selectively placing comprises selectively placing the port into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

7. The method of claim 1, wherein the user authentication protocol is IEEE 802.1x.

8. The method of claim 1, wherein the network access device comprises a network switch.

9. A network access device comprising:

a switching fabric for routing data received on one or more of input ports of the device to one or more output ports of the device; and

control logic configured to determine, by the network access device, whether a user device coupled to one of the one or more input ports supports a user authentication protocol used by a network, and to place, by the network access device, the one of the input ports in a semi-authorized access state if the determination indicates the authentication protocol is not supported, the semi-authorized access state providing the user device with limited network access, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.

10. The device of claim 9, wherein the semi-authorized state limits access by the user device to a network, the network selected from the group comprising a Voice over Internet Protocol (VoIP) network, the Internet, and a low security virtual local area network (VLAN).

11. The device of claim 9, wherein the control logic is configured to selectively place the one of the input ports into one of a plurality of semi-authorized access states.

12. The device of claim 11, wherein the control logic is configured to determine a type of the user device and to selectively place the one of the input ports into one of a plurality of semi-authorized access states based on the type of the user device.

13. The device of claim 12, wherein the control logic is configured to selectively place the one of the input ports into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

14. The device of claim 12, wherein the control logic is configured to selectively place the one of the input ports into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

15. The device of claim 11, wherein the user authentication protocol is IEEE 802.1x.

16. An apparatus comprising:

means for sensing a user device coupled to a port of a network access device;

means for determining, by the network access device, if the user device supports a user authentication protocol used by the network, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

means for placing, by the network access device, the port into a semi-authorized access state if the determining indicates that the user device does not support the user authentication protocol, the semi-authorized access state providing the user device with limited network access.

17. A computer implemented method comprising:

at a network access device communicably coupled to a network, sensing a user device coupled to a port of the network access device; and

at the network access device, allowing the user device limited access to a network via the network access device if it is determined that the user device is unable to communicate using a particular user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.

18. The method of claim 17, further comprising performing further user authentication in accordance with the user authentication protocol if it is determined that the user device is able to communicate using the user authentication protocol.

19. The method of claim 17 wherein the limited access comprises less access than access afforded a user device that is successfully authenticated using the user authentication protocol.

20. The method of claim 19 wherein the limited access comprises access to a low-security Virtual Local Area Network (VLAN).

21. A network access device comprising:

a memory;

a switching fabric configured to route data received on one or more input ports of the device to one or more output ports of the device; and

control logic configured to allow the user device limited access to a network if it is determined that the user device is unable to communicate using a particular user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.

22. The network access device of claim 21 wherein the control logic is further configured to perform further user authentication in accordance with the user authentication protocol if it is determined that the user device is able to communicate using the user authentication protocol.

23. The network access device of claim 21 wherein the limited access comprises less access than access afforded a user device that is successfully authenticated using the user authentication protocol.

24. The network access device of claim 23 wherein the limited access comprises access to a low-security Virtual Local Area Network (VLAN).

25. An apparatus comprising:

a memory;

means at a network access device for sensing a user device coupled to a port of the network access device; and

means at the network access device for allowing the user device limited access to a network via the network access device if it is determined that the user device is unable to communicate using a particular user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.