ALLOCATION OF LOCAL MAC ADDRESSES TO CLIENT DEVICES

• US 20170142064A1
• Filed: 11/18/2015
• Published: 05/18/2017
• Est. Priority Date: 11/18/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jones, Peter Geoffrey, Weis, Brian Eliot
• Granted Patent: US 10,454,887 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/5038 for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

At a network device configured to control access to a network, a client device authentication request is received from a client device. The request includes identity credentials and a temporary media access control (MAC) address of the client device. The client device is successfully authenticated based on the identity credentials. After authentication, a new MAC address is established in the client device. A data frame is received from at the network device. It is determined whether the client device is using the new MAC address based on the received data frame. If it is determined that the client device is using the new MAC address, the client device is permitted access the network.

Claims

1. A method comprising:

at a network device connected with a network;

receiving from a client device an authentication request including identity credentials and a temporary media access control (MAC) address of the client device;

in response to successfully authenticating the client device based on the identity credentials;

establishing a new MAC address in the client device;

receiving a data frame;

determining whether the client device is using the new MAC address based on the received data frame; and

if it is determined that the client device is using the new MAC address, granting the client device access to the network.

2. The method of claim 1, wherein the new MAC address is a local MAC address.

3. The method of claim 1, wherein the determining includes determining whether the client device is using the new MAC address within a predetermined time period after the sending;

and further comprising;

if it is determined that the client device is not using the new MAC address within a predetermined time period after the sending, not permitting the client device to access the network.

4. The method of claim 1, further comprising, after successfully authenticating:

mapping the identity credentials and the new MAC address to an indication that the client device is using the new MAC address if it is determined that the client device is using the new MAC address.

5. The method of claim 1, wherein the establishing includes:

receiving a proposed MAC address from the client device; and

sending an indication to the client device that the proposed MAC address is to be used as the new MAC address.

6. The method of claim 1, wherein the establishing includes:

selecting the new MAC address from among a plurality of available MAC addresses; and

sending the new MAC address to the client device in an address allocation frame.

7. The method of claim 6, wherein the selecting includes the local MAC address from a pool of available local MAC addresses.

8. The method of claim 6, further comprising integrity protecting the address allocation frame based on the new MAC address to produce an integrity protected address allocation frame, and wherein:

the sending includes sending the integrity protected address allocated frame;

the receiving includes receiving the data frame as an integrity protected data frame having a source MAC address that matches the new MAC address; and

the determining includes;

integrity checking the integrity protected data frame based on the new MAC address; and

if the integrity checking is successful, determining that the client device is using the new MAC address.

9. The method of claim 6, further comprising encrypting and integrity protecting the address allocation frame based on the new MAC address to produce an encrypted, integrity protected address allocation frame, and wherein:

the sending further includes sending the encrypted, integrity protected address allocation frame;

the receiving further includes receiving the data frame as an encrypted, integrity protected data frame; and

the determining further includes;

decrypting and integrity checking the encrypted, integrity protected data frame based on the new MAC address; and

if the decrypting is successful and the integrity checking is successful, determining that the client device is using the new MAC address.

10. The method of claim 6, further comprising encrypting the address allocation frame based on a session key associated with the new MAC address to produce an encrypted address allocation frame, and wherein:

the sending includes sending the encrypted address allocation frame;

the receiving includes receiving the data frame as an encrypted data frame; and

the determining includes;

decrypting the encrypted data frame based on the session key; and

if the decrypting is successful, determining the client device is using the new MAC address.

11. The method of claim 10, further comprising:

receiving a master key from the authenticating; and

deriving the session key from the master key, wherein the session key is matched to another session key in the client device.

12. An apparatus comprising:

a network interface unit configured to communicate with a client device and a network; and

a processor coupled to the network interface unit, and configured to;

receive from the client device an authentication request including identity credentials and a temporary media access control (MAC) address of the client device;

in response to successfully authenticating the client device based on the identity credentials;

establish a new MAC address in the client device;

receive a data frame;

determine whether the client device is using the new MAC address based on the received data frame; and

if it is determined that the client device is using the new MAC address, grant the client device access to the network.

13. The apparatus of claim 12, wherein the new MAC address is a local MAC address.

14. The apparatus of claim 12, wherein the processor is further configured to:

determine whether the client device is using the new MAC address within a predetermined time period after the sending; and

if it is determined that the client device is not using the new MAC address within a predetermined time period after the sending, not permit the client device to access the network.

15. The apparatus of claim 12, wherein the processor is configured to establish by:

selecting the new MAC address; and

sending the new MAC address to the client device in an address allocation frame.

16. The apparatus of claim 15, wherein the processor is further configured to integrity protect the address allocation frame based on the new MAC address to produce an integrity protected address allocation frame, and wherein:

the processor is configured to send by sending the integrity protected address allocated frame;

the processor is configured to receive by receiving the data frame as an integrity protected data frame having a source MAC address that matches the new MAC address; and

the processor is configured to determine by;

integrity checking the integrity protected data frame based on the new MAC address; and

if the integrity checking is successful, determining that the client device is using the new MAC address.

17. The apparatus of claim 15, the processor is further configured to encrypt the address allocation frame based on a session key associated with the new MAC address to produce an encrypted address allocation frame, and wherein:

the processor is configured to send by sending the encrypted address allocation frame;

the processor is configured to receive by receiving the data frame as an encrypted data frame; and

the processor is configured to determine by;

decrypting the encrypted data frame based on the session key; and

if the decrypting is successful, determining the client device is using the new MAC address.

18. A tangible processor readable medium storing instructions that, when executed by a processor, cause the processor to:

receive from a client device an authentication request including identity credentials and a temporary media access control (MAC) address of the client device;

in response to successfully authenticating the client device based on the identity credentials;

establish a new MAC address in the client device;

receive a data frame;

determine whether the client device is using the new MAC address based on the received data frame; and

if it is determined that the client device is using the new MAC address, grant the client device access to a network.

19. The processor readable medium of claim 18, wherein the instructions to cause the processor to establish include instructions to cause the processor to:

select the new MAC address; and

send the new MAC address to the client device in an address allocation frame.

20. The processor readable medium of claim 19, further comprising instructions to cause the processor to integrity protect the address allocation frame based on the new MAC address to produce an integrity protected address allocation frame, and wherein:

the instructions to cause the processor to send include instructions to cause the processor to send the integrity protected address allocated frame;

the instructions to cause the processor to receive include instructions to cause the processor to receive the data frame as an integrity protected data frame having a source MAC address that matches the new MAC address; and

the instructions to cause the processor to determine include instructions to cause the processor to determine by;

integrity checking the integrity protected data frame based on the new MAC address; and

if the integrity checking is successful, determining that the client device is using the new MAC address.

21. The processor readable medium of claim 19, further comprising instructions to cause the processor to encrypt the address allocation frame based on a session key associated with the new MAC address to produce an encrypted address allocation frame, and wherein:

the instructions to cause the processor to send include instructions to cause the processor to send the encrypted address allocation frame;

the instructions to cause the processor to receive include instructions to cause the processor to receive the data frame as an encrypted data frame; and

the instructions to cause the processor to determine include instructions to cause the processor to determine by;

decrypting the encrypted data frame based on the session key; and

if the decrypting is successful, determining the client device is using the new MAC address.