Matching of RADIUS request and response packets during high traffic volume

• US 6,771,665 B1
• Filed: 08/31/2000
• Issued: 08/03/2004
• Est. Priority Date: 08/31/2000
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sargent, Robert, Weber, Gregory, Eklund, Mark, Reed, Scott K., Rich, Steven J.
• Primary Examiner(s): MARCELO, MELVIN C
• Application Number:
  US09/652,762
• Time in Patent Office: 1,433 Days
• Field of Search: 370/252, 370/389, 370/474, 370/475, 709/217
• US Class Current: 370/475
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

A solution for matching RADIUS request packets with corresponding RADIUS response packets when the number of simultaneous outstanding requests is greater than 256 involves using a sixteen-octet authenticator field in each packet. For each response packet that arrives, the identifier of the packet is compared in turn with the identifier of each outstanding request packet. If the identifiers match, the authenticators are then compared. If the results of the comparison indicate a match, the packet is accepted and no further processing of the outstanding requests is required. Otherwise, a search of the outstanding request packets is continued. This solution allows for more than 256 simultaneous outstanding RADIUS requests and only encounters a mismatch or ambiguous match with a probability of one in 3.4×10³⁸ packets.

Claims

1. A method for matching a RADIUS response packet with a corresponding RADIUS request packet from one or more RADIUS request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, including:

determining if the identifier field of the RADIUS response packet matches the identifier field of the nth of the one or more RADIUS request packets;

detecting if the authenticator field of the RADIUS response packet matches the authenticator field of the nth of the one or more RADIUS request;

matching the RADIUS response packet with the nth of the one or more RADIUS request packets if both the identifier field of the RADIUS response packet matches the identifier field of said nth of the one or more RADIUS request packets and the authenticator field of the RADIUS response packet matches the authenticator field of said nth of the one or more RADIUS request packets; and

repeating said determining, detecting, and matching with an incremented n if there exist any unexamined RADIUS request packets.

2. The method of claim 1, wherein said determining if the identifier field of the RADIUS response packet matches the identifier field of the nth of the one or more RADIUS request packets includes:

examining the identifier fields of the RADIUS response packet and the nth of the one or more RADIUS request packets; and

comparing the identifier fields of the RADIUS response packet and the nth of the one or more RADIUS request packets to establish whether any are identical.

3. The method of claim 1, wherein said detecting if the authenticator field of the RADIUS response packet matches the authenticator field of the nth of the one or more RADIUS request includes:

examining the authenticator fields of the RADIUS response packet and the nth of the one or more RADIUS request packets; and

comparing the authenticator fields of the RADIUS response packet and the nth of the one or more RADIUS request packets to establish whether any are identical.

4. A method for matching an access response packet with a corresponding access request packet from one or more access request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, including:

determining if the identifier field of the access response packet matches the identifier field of the nth of the one or more access request packets;

detecting if the authenticator field of the access response packet matches the authenticator field of the nth of the one or more access request;

matching the access response packet with the nth of the one or more access request packets if both the identifier field of the access response packet matches the identifier field of said nth of the one or more access request packets and the authenticator field of the access response packet matches the authenticator field of said nth of the one or more access request packets; and

repeating said determining, detecting, and matching with an incremented n if there exist any unexamined access request packets.

5. The method of claim 4, wherein said determining if the identifier field of the access response packet matches the identifier field of the nth of the one or more access request packets includes:

examining the identifier fields of the access response packet and the nth of the one or more access request packets; and

comparing the identifier fields of the access response packet and the nth of the one or more access request packets to establish whether any are identical.

6. The method of claim 4, wherein said detecting if the authenticator field of the access response packet matches the authenticator field of the nth of the one or more access request includes:

examining the authenticator fields of the access response packet and the nth of the one or more access request packets; and

comparing the authenticator fields of the access response packet and the nth of the one or more access request packets to establish whether any are identical.

7. A method for matching an accounting response packet with a corresponding accounting request packet from one or more accounting request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, including:

determining if the identifier field of the accounting response packet matches the identifier field of the nth of the one or more accounting request packets;

detecting if the authenticator field of the accounting response packet matches the authenticator field of the nth of the one or more accounting request;

matching the accounting response packet with the nth of the one or more accounting request packets if both the identifier field of the accounting response packet matches the identifier field of said nth of the one or more accounting request packets and the authenticator field of the accounting response packet matches the authenticator field of said nth of the one or more accounting request packets; and

repeating said determining, detecting, and matching with an incremented n if there exist any unexamined accounting request packets.

8. The method of claim 7, wherein said determining if the identifier field of the accounting response packet matches the identifier field of the nth of the one or more accounting request packets includes:

examining the identifier fields of the accounting response packet and the nth of the one or more accounting request packets; and

comparing the identifier fields of the accounting response packet and the nth of the one or more accounting request packets to establish whether any are identical.

9. The method of claim 7, wherein said detecting if the authenticator field of the accounting response packet matches the authenticator field of the nth of the one or more accounting request includes:

examining the authenticator fields of the accounting response packet and the nth of the one or more accounting request packets; and

comparing the authenticator fields of the accounting response packet and the nth of the one or more accounting request packets to establish whether any are identical.

10. An apparatus for matching a RADIUS response packet with a corresponding RADIUS request packet from one or more RADIUS request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, including:

means for determining if the identifier field of the RADIUS response packet matches the identifier field of the nth of the one or more RADIUS request packets;

means for detecting if the authenticator field of the RADIUS response packet matches the authenticator field of the nth of the one or more RADIUS request;

means for matching the RADIUS response packet with the nth of the one or more RADIUS request packets if both the identifier field of the RADIUS response packet matches the identifier field of said nth of the one or more RADIUS request packets and the authenticator field of the RADIUS response packet matches the authenticator field of said nth of the one or more RADIUS request packets; and

means for repeating said determining, detecting, and matching with an incremented n if there exist any unexamined RADIUS request packets.

11. The apparatus of claim 10, wherein said means for determining if the identifier field of the RADIUS response packet matches the identifier field of the nth of the one or more RADIUS request packets includes:

means for examining the identifier fields of the RADIUS response packet and the nth of the one or more RADIUS request packets; and

means for comparing the identifier fields of the RADIUS response packet and the nth of the one or more RADIUS request packets to establish whether any are identical.

12. The apparatus of claim 10, wherein said means for detecting if the authenticator field of the RADIUS response packet matches the authenticator field of the nth of the one or more RADIUS request includes:

means for examining the authenticator fields of the RADIUS response packet and the nth of the one or more RADIUS request packets; and

means for comparing the authenticator fields of the RADIUS response packet and the nth of the one or more RADIUS request packets to establish whether any are identical.

13. An apparatus for matching an access response packet with a corresponding access request packet from one or more access request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, including:

means for determining if the identifier field of the access response packet matches the identifier field of the nth of the one or more access request packets;

means for detecting if the authenticator field of the access response packet matches the authenticator field of the nth of the one or more access request;

means for matching the access response packet with the nth of the one or more access request packets if both the identifier field of the access response packet matches the identifier field of said nth of the one or more access request packets and the authenticator field of the access response packet matches the authenticator field of said nth of the one or more access request packets; and

means for repeating said determining, detecting, and matching with an incremented n if there exist any unexamined access request packets.

14. The apparatus of claim 13, wherein said means for determining if the identifier field of the access response packet matches the identifier field of the nth of the one or more access request packets includes:

means for examining the identifier fields of the access response packet and the nth of the one or more access request packets; and

means for comparing the identifier fields of the access response packet and the nth of the one or more access request packets to establish whether any are identical.

15. The apparatus of claim 13, wherein said means for detecting if the authenticator field of the access response packet matches the authenticator field of the nth of the one or more access request includes:

means for examining the authenticator fields of the access response packet and the nth of the one or more access request packets; and

means for comparing the authenticator fields of the access response packet and the nth of the one or more access request packets to establish whether any are identical.

16. An apparatus for matching an accounting response packet with a corresponding accounting request packet from one or more accounting request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, including:

means for determining if the identifier field of the accounting response packet matches the identifier field of the nth of the one or more accounting request packets;

means for detecting if the authenticator field of the accounting response packet matches the authenticator field of the nth of the one or more accounting request;

means for matching the accounting response packet with the nth of the one or more accounting request packets if both the identifier field of the accounting response packet matches the identifier field of said nth of the one or more accounting request packets and the authenticator field of the accounting response packet matches the authenticator field of said nth of the one or more accounting request packets; and

means for repeating said determining, detecting, and matching with an incremented n if there exist any unexamined accounting request packets.

17. The apparatus of claim 16, wherein said means for determining if the identifier field of the accounting response packet matches the identifier field of the nth of the one or more accounting request packets includes:

means for examining the identifier fields of the accounting response packet and the nth of the one or more accounting request packets; and

means for comparing the identifier fields of the accounting response packet and the nth of the one or more accounting request packets to establish whether any are identical.

18. The apparatus of claim 16, wherein said means for detecting if the authenticator field of the accounting response packet matches the authenticator field of the nth of the one or more accounting request includes:

means for examining the authenticator fields of the accounting response packet and the nth of the one or more accounting request packets; and

means for comparing the authenticator fields of the accounting response packet and the nth of the one or more accounting request packets to establish whether any are identical.

19. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine for matching a RADIUS response packet with a corresponding RADIUS request packet from one or more RADIUS request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, the program method including:

determining if the identifier field of the RADIUS response packet matches the identifier field of the nth of the one or more RADIUS request packets;

detecting if the authenticator field of the RADIUS response packet matches the authenticator field of the nth of the one or more RADIUS request;

matching the RADIUS response packet with the nth of the one or more RADIUS request packets if both the identifier field of the RADIUS response packet matches the identifier field of said nth of the one or more RADIUS request packets and the authenticator field of the RADIUS response packet matches the authenticator field of said nth of the one or more RADIUS request packets; and

repeating said determining, detecting, and matching with an incremented n if there exist any unexamined RADIUS request packets.

20. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine for matching an access response packet with a corresponding access request packet from one or more access request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, the program method including:

determining if the identifier field of the access response packet matches the identifier field of the nth of the one or more access request packets;

detecting if the authenticator field of the access response packet matches the authenticator field of the nth of the one or more access request;

matching the access response packet with the nth of the one or more access request packets if both the identifier field of the access response packet matches the identifier field of said nth of the one or more access request packets and the authenticator field of the access response packet matches the authenticator field of said nth of the one or more access request packets; and

repeating said determining, detecting, and matching with an incremented n if there exist any unexamined access request packets.

21. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine for matching an accounting response packet with a corresponding accounting request packet from one or more accounting request packets, the packets all having identifier fields and authenticator fields, and a variable n initially set to 1, the program method including:

determining if the identifier field of the accounting response packet matches the identifier field of the nth of the one or more accounting request packets;

detecting if the authenticator field of the accounting response packet matches the authenticator field of the nth of the one or more accounting request;

matching the accounting response packet with the nth of the one or more accounting request packets if both the identifier field of the accounting response packet matches the identifier field of said nth of the one or more accounting request packets and the authenticator field of the accounting response packet matches the authenticator field of said nth of the one or more accounting request packets; and

repeating said determining, detecting, and matching with an incremented n if there exist any unexamined accounting request packets.

22. An apparatus for matching a RADIUS response packet with a corresponding RADIUS request packet from one or more RADIUS request packets, the packets all having identifier fields and authenticator fields, including:

a matching identifier field determiner;

a RADIUS packet matcher coupled to said matching identifier field determiner;

a matching authenticator field determiner coupled to said RADIUS packet matcher and said matching identifier field determiner.

23. The apparatus of claim 22, wherein said matching identifier field determiner includes:

a RADIUS packet identifier field examiner; and

a RADIUS packet identifier field comparator coupled to said RADIUS packet identifier field examiner.

24. The apparatus of claim 22, wherein said matching authenticator field determiner includes:

a RADIUS packet authenticator field examiner; and

a RADIUS packet authenticator field comparator coupled to said RADIUS packet authenticator field examiner.

25. An apparatus for matching an access response packet with a corresponding access request packet from one or more access request packets, the packets all having identifier fields and authenticator fields, including:

a matching identifier field determiner;

an access packet matcher coupled to said matching identifier field determiner;

a matching authenticator field determiner coupled to said access packet matcher and said matching identifier field determiner.

26. The apparatus of claim 25, wherein said matching identifier field determiner includes:

an access packet identifier field examiner; and

an access packet identifier field comparator coupled to said access packet identifier field examiner.

27. The apparatus of claim 25, wherein said matching authenticator field determiner includes:

an access packet authenticator field examiner; and

an access packet authenticator field comparator coupled to said access packet authenticator field examiner.

28. An apparatus for matching an accounting response packet with a corresponding accounting request packet from one or more accounting request packets, the packets all having identifier fields and authenticator fields, including:

a matching identifier field determiner;

an accounting packet matcher coupled to said matching identifier field determiner;

a matching authenticator field determiner coupled to said accounting packet matcher and said matching identifier field determiner.

29. The apparatus of claim 28, wherein said matching identifier field determiner includes:

an accounting packet identifier field examiner; and

an accounting packet identifier field comparator coupled to said accounting packet identifier field examiner.

30. The apparatus of claim 28, wherein said matching authenticator field determiner includes:

an accounting packet authenticator field examiner; and

an accounting packet authenticator field comparator coupled to said accounting packet authenticator field examiner.