Methods and systems of remote authentication for computer networks

• US 7,673,146 B2
• Filed: 06/04/2004
• Issued: 03/02/2010
• Est. Priority Date: 06/05/2003
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Wiedmann, Christian, Lillie, Terrance L., Sneiderman, Richard P., Zeljko, Robert, Wiedmann, Ulrich
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US10/861,576
• Publication Number:
  US 20050021979A1
• Time in Patent Office: 2,097 Days
• Field of Search: 713/162, 713/182, 380/270, 726/15
• US Class Current: 713/182
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

As part of a network node authentication process, a MAC address or other globally unique identifier of an access point through which the network node will access a computer network is transmitted in an EAP or other authentication message to an authentication server to uniquely identify the access point to the authentication server.

Claims

1. A method, comprising exchanging, as part of a network node authentication process, access control parameters that define a network node'"'"'s ability to access other resources accessible through a computer network,

wherein exchanging the access control parameters includes transmitting a MAC address of an access point through which the network node will access the computer network in an authentication message to an authentication server to uniquely identify the access point to the authentication server;

wherein the access control parameters are selected from a list of possible rule sets during the network node authentication process;

wherein the access control parameters are provided to the access point only upon successful verification of the network node'"'"'s credentials by the authentication server;

wherein exchanging the access control parameters further includes transmitting a MAC address of the network node for authentication by the authentication server;

wherein the network node authentication process includes the network node and the authentication server identifying themselves to one another using digital certificates;

wherein the network node authentication process requires the network node and the authentication server to be authenticated using a password;

wherein the access control parameters are assigned on a per-user basis;

wherein the access control parameters comprise rules for handling packets;

wherein a software application executing on the network node is configured to add the network node'"'"'s and the access point'"'"'s MAC addresses to a username to be used for authentication by the authentication server.

2. The method of claim 1, wherein the authentication message comprises an EAP message.

3. The method of claim 1, wherein the network node authentication process makes use of an EAP TTLS authentication process.

4. The method of claim 1 wherein the network node authentication process makes use of an EAP TLS authentication process.

5. The method of claim 1 wherein the network node authentication process makes use of a PEAP authentication process.

6. The method of claim 1 wherein the network node authentication process provides for only the network node to be authenticated on the basis of the password.

7. The method of claim 1 wherein the network node authentication process uses a secure channel.

8. The method of claim 7 wherein the secure channel is both encrypted and integrity-protected.

9. The method of claim 1 wherein the network node authentication process includes an exchange of encryption keys for use between the access point and the network node.

10. The method of claim 1 wherein the authentication server comprises a RADIUS server.

11. The method of claim 1 wherein the access control parameters are associated with routines that allow the access point to monitor any part of a packet header in a packet received from the network node.

12. The method of claim 1 wherein the access control parameters are associated with state machines at the access point.

13. The method of claim 1 wherein the access point includes an access privilege table to which the access control parameters refer.

14. The method of claim 1 wherein the resources include Internet access.

15. The method of claim 1 wherein the access point comprises a wireless network access point and the network node communicates with the access point using a wireless network communication protocol.

16. The method of claim 1, wherein the MAC address of the access point is specified in a “

Called-Station-ID”

RADIUS protocol attribute.

17. The method of claim 1, wherein the authentication server provides dynamic encryption keys for use between the access point and the network node.

18. The method of claim 1, wherein the network node authentication process makes use of an EAP MSD5 authentication process.

19. The method of claim 1, wherein the network node authentication process makes use of an EAP SRP authentication process.

20. The method of claim 1, wherein the authentication server determines a local area network to which the network node has requested access utilizing a table lookup associating the MAC address of the access point with the local area network, and further identifies the network node authentication process from a plurality of network node authentication processes for use in authenticating the network node.

21. A method, comprising exchanging, as part of a network node authentication process, a unique identifier other than an Internet protocol address of an access point through which a network node will access a computer network in an authentication message to an authentication server to uniquely identify the access point to the authentication server;

wherein access control parameters are selected from a list of possible rule sets during the network node authentication process;

wherein the access control parameters are provided to the access point only upon successful verification of the network nod'"'"'s credentials by the authentication server;

wherein a MAC address of the network node is transmitted for authentication by the authentication server;

wherein the network node authentication process includes the network node and the authentication server identifying themselves to one another using digital certificates;

wherein the network node authentication process requires the network node and the authentication server to be authenticated using a password;

wherein the access control parameters are assigned on a per-user basis;

wherein the access control parameters comprise rules for handling packets;

wherein a software application executing on the network node is configured to add the network node'"'"'s and the access point'"'"'s MAC addresses to a username to be used for authentication by the authentication server.