Method and apparatus providing for internet protocol address authentication

• US 6,895,511 B1
• Filed: 05/19/1999
• Issued: 05/17/2005
• Est. Priority Date: 10/29/1998
• Status: Expired due to Term

• Current Assignee: Infoblox Incorporated
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Anderson, Rod, Borsato, Larry W., Waters, Glenn, Gaudet, Mark, Hamilton, Ian
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/314,601
• Time in Patent Office: 2,190 Days
• Field of Search: 713/201, 713/200, 713/202, 370/352, 370/401, 709/228, 709/220, 709/222, 709/245, 709/225, 709/227, 709/217, 709/229, 709/223, 709/226
• US Class Current: 726/5
• CPC Class Codes: H04L 41/024 using relational databases for representation of network management data, e.g. managing via structured query language [SQL]
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and apparatus for storage of user identifier/IP address pairs in a network. The network includes a DHCP server for assigning IP addresses to computer and other devices in the network, a device (such as a computer) coupled to receive an IP address from the DHCP server, an authentication server coupled with the device for receiving user identifier/IP address pairs from the device and authenticating the user, and a directory server coupled to receive authenticated user identifier/IP address pairs from the authentication server.

Claims

1. A method of binding a user with an internet protocol address comprising:

a) connecting the user with a binding system and identifying a user identifier and an internet protocol address to be used by the user;

b) storing the user identifier/internet protocol address pair in a data store using the binding system.

2. The method as recited by claim 1 wherein the connection with the binding system is a secure connection.

3. The method as recited by claim 1 wherein prior to identifying the user, the method further comprises issuing a registration request to the binding system, the registration request including the user identifier and a password.

4. The method as recited by claim 3 wherein the registration request is made using HTTP as the transport protocol.

5. The method as recited by claim 1 wherein the internet protocol address was assigned to the user by a dynamic host configuration protocol (DHCP) server.

6. The method as recited by claim 1 wherein the binding system comprises a combination of a lightweight directory access protocol (LDAP) data store and an authentication server.

7. The method as recited by claim 6 wherein the authentication server authenticates the user before storing the user identifier/internet protocol address pair.

8. A server for use in authentication of user identifier/internet protocol address pairs comprising:

a) a first data store having stored therein an authenticated user identifier/internet protocol address pair; and

b) a second data store having stored therein a program which when executed on a processor retrieves the authenticated user identifier/internet protocol address pair and transmits the pair to a requesting device.

9. The server as recited by claim 8 wherein the server further comprises a third data store having stored therein a program which when executed on a processor stores authenticated user identifier/internet protocol address pairs received from an authentication server.

10. The server as recited by claim 9 wherein the authentication server communicates over an encrypted communication channel with the server.

11. A method of providing authenticated user identifier/IP address pairs comprising:

a) a first device communicating with a dynamic host configuration protocol (DHCP) server to have an IP address assigned to the first device;

b) the first device communicating with an authentication server a user identifier and the IP address;

c) the authentication server authenticating the user;

d) the authentication server communicating to a directory server a user identifier/IP address pair; and

e) the directory server storing the user identifier/IP address pair.

12. The method as recited by claim 11 wherein the authentication server authenticates the user by use of a user identifier and password supplied by the computer.

13. The method as recited by claim 11 wherein the communication between the computer and the authentication server is encrypted.

14. The method as recited by claim 11 wherein the user identifier/IP address pair is communicated from the authentication server to the directory server over an encrypted channel.

15. The method as recited by claim 11 wherein the authentication server executed on the same hardware platform as the directory server.

16. A network comprising:

a) a dynamic host configuration protocol (DHCP) server;

b) a computer coupled in communication with the DHCP server over the network;

c) an authentication server coupled in communication over the network with the computer, the authentication server for authenticating a user using the computer based on a user identifier communicated from the computer; and

d) a directory server coupled in communication with the authentication server, the directory server receiving and storing authenticated user identifier/IP address pairs from the authentication server.

17. The network as recited by claim 16 wherein the communication channel between the computer and the authentication server is an encrypted communication channel.

18. The network as recited by claim 16 wherein the communication channel between the authentication server and the directory server is an encrypted communication channel.

19. The network as recited by claim 16 wherein the authentication server and the directory server execute on the same hardware platform.

20. The network as recited by claim 16 further comprising requesting devices coupled in communication with the directory server for requesting authenticated user identifier/IP address pairs.

21. A network comprising a dynamic host configuration protocol (DHCP) server for assigning IP addresses to computer and other devices in the network, a device coupled to receive an IP address from the DHCP server, an authentication server coupled with the device for receiving user identifier/IP address pairs from the device and authenticating the user, and a directory server coupled to receive authenticated user identifier/IP address pairs from the authentication server.

22. A lightweight directory access protocol (LDAP) server comprising:

a first data store having stored therein an user identifier/internet protocol address pair; and

a second data store having stored therein a program which when executed on processor retrieves the user identifier/internet protocol address pair and transmits the pair to a requesting device.

23. The LDAP server as recited by claim 22 wherein the server further comprises a third data store having stored therein a program which when executed on a processor stores user identifier/internet protocol address pairs received from an binding server.

24. A lightweight directory access protocol (LDAP) server comprising:

a first data store having stored therein an user identifier and dynamic information related to the user identifier; and

a second data store having stored therein a program which when executed on processor retrieves the user identifier and dynamic information and transmits the information to a requesting device.

25. The LDAP server as recited by claim 24 wherein the server further comprises a third data store having stored therein a program which when executed on a processor stores dynamic information related to a user identifier in the first data store.

26. The LDAP server as recited by claim 24 wherein the dynamic information is an internet protocol address.