Method and apparatus for registering auto-configured network addresses based on connection authentication

• US 7,752,653 B1
• Filed: 11/21/2006
• Issued: 07/06/2010
• Est. Priority Date: 07/31/2002
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Droms, Ralph, Schnizlein, John M.
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US11/603,692
• Time in Patent Office: 1,323 Days
• Field of Search: 726/3, 726/4, 726/15
• US Class Current: 726/3
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 61/59 using proxies for addressing
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method and apparatus for registering auto-configured network addresses includes receiving first data at a networking device connected to a host at a physical connection. The first data is received from a first server and indicates authentication information associated with the host. A first message is received at the networking device from the host. The first message requests configuration information and includes a logical network address for the host determined at least in part by the host. A second message is generated based on the first message and the first data. The second message is sent to a second server that registers the host by associating the logical network address with the first data.

Claims

1. An apparatus for registering auto-configured network addresses, comprising:

a network interface that is configured to be coupled to a data network for receiving therefrom, and sending thereto, one or more packet flows;

a physical connection that is configured to be coupled to a host;

one or more processors;

one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of;

receiving, from a first server, first data indicating at least some authentication information associated with the host;

receiving, from the host, a first message requesting configuration information, the first message including a logical network address for the host determined at least in part by the host;

generating a second message based on the first message and the first data; and

sending the second message to a second, dynamic host control protocol (DHCP) server that registers the host by associating the logical network address with the first data;

wherein the first server provides authentication and authorization in response to a request for authentication for the physical connection.

2. The apparatus of claim 1, wherein:

an authenticator process sends the request for authentication and performs receiving the first data;

a DHCP relay agent process for the second server performs receiving the first message and sending the second message; and

generating the second message further comprises sending a third message from the authenticator process to the relay agent process based on the first data.

3. The apparatus of claim 2, wherein the instructions for generating the second message further comprise instructions for storing second data based on the first data by the authenticator process and instructions for retrieving the second data by the relay agent process in response to the step of receiving the first message.

4. The apparatus of claim 1, wherein the instructions for generating the second message operate according to dynamic host configuration protocol (DHCP).

5. The apparatus of claim 1, wherein the first data includes user class data indicating a particular group of one or more authorized users of the host;

and the instructions for generating the second message perform generating the second message based on the user class data.

6. The apparatus of claim 1, wherein the first data includes credential data indicating authentication is performed by the first server;

and the instructions for generating the second message perform generating the second message based on the credential data.

7. The apparatus of claim 1, wherein the first data includes a user identification that indicates a particular user;

and the instructions for generating the second message perform generating the second message based on the user identification.

8. The apparatus of claim 1, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

enabling the physical connection to forward subsequent messages between the host and a network connected to the intermediate device based on the first data;

storing the first data at least until a third request is received from the host for configuration information for the host, the third request including a logical network address for the host determined at least in part by the host, for associating the first data with the logical network address.

9. The apparatus of claim 1, wherein the first server is an authentication, authorization and accounting server.

10. The apparatus of claim 1, wherein the first server is a RADIUS (Remote Access Dial-In User Service) protocol server.

11. The apparatus of claim 1, wherein the physical connection comprises an Ethernet interface card on the networking device.

12. The apparatus of claim 1, wherein the physical connection comprises a wireless Ethernet encryption key and time slot.

13. The apparatus of claim 1, wherein receiving the first data is performed according to an Institute of Electrical and Electronics Engineers (IEEE) 802.1x standard.

14. An apparatus for registering auto-configured network addresses, comprising a networking device configured to be coupled to a host, further comprising:

one or more processors;

means, operatively coupled to the one or more processors, for receiving, from a first server, first data indicating at least some authentication information associated with the host;

means, operatively coupled to the one or more processors, for receiving, from the host, a first message requesting configuration information, the first message including a logical network address for the host determined at least in part by the host;

means, operatively coupled to the one or more processors, for generating a second message based on the first message and the first data; and

means, operatively coupled to the one or more processors, for sending the second message to a second, dynamic host control protocol (DHCP) server that registers the host by associating the logical network address with the first data;

wherein the first server provides authentication and authorization in response to a request for authentication for the physical connection.

15. The apparatus of claim 14, wherein:

an authenticator process sends the request for authentication and performs receiving the first data;

a DHCP relay agent process for the second server performs receiving the first message and sending the second message; and

generating the second message further comprises sending a third message from the authenticator process to the relay agent process based on the first data.

16. An apparatus for registering auto-configured network addresses, comprising:

a network interface that is configured to be coupled to a data network for receiving therefrom, and sending thereto, one or more packet flows;

a physical connection that is configured to be coupled to a host;

one or more processors;

one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of;

receiving from a host, a first request for configuration information for the host, the first request including a logical network address for the host determined at least in part by the host;

retrieving first data indicating at least one of authentication and authorization information received from a first server in response to a request for authentication of the physical connection;

generating a second request based on the first request and the first data; and

sending the second request to a second server that registers the host by associating the logical network address with the first data;

wherein an authenticator process sends the request for authentication and performs receiving the first data;

a DHCP relay agent process for the second server performs receiving the first request and sending the second request;

generating the second request further comprises sending a third request from the authenticator process to the relay agent process based on the first data.

17. An apparatus for registering auto-configured network addresses, comprising:

a network interface that is configured to be coupled to a data network for receiving therefrom, and sending thereto, one or more packet flows;

a physical connection that is configured to be coupled to a host;

one or more processors;

one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of;

receiving a request for configuration information for a host, the request including

a logical network address for the host determined at least in part by the host, and

first data that indicates at least one of authentication and authorization information from a first server in response to a request for authentication for the physical connection; and

registering the logical network address by associating the logical network address with the first data;

generating a second request based on the first request and the first data; and

sending the second request to a second, dynamic host control protocol (DHCP) server that registers the host by associating the logical network address with the first data;

wherein the first server provides authentication and authorization in response to a request for authentication for the physical connection.

18. The apparatus of claim 17, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

determining particular configuration information based at least in part on the first data; and

sending to the host a message including the particular configuration information.

19. The apparatus of claim 17, wherein the first data includes user class data indicating a particular group of users authorized for a particular set of one or more network services.

20. The apparatus of claim 18, wherein the instructions for determining the particular configuration information further comprise instructions for determining a domain name server for the host based at least in part on the first data.

21. The apparatus of claim 17, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform sending data associating the logical network address with the first data to a second server that provides a service to the host based at least in part on the first data.

22. The apparatus of claim 21, wherein the second server provides a service to the host based at least in part on the first data.

23. The apparatus of claim 21, wherein the second server is the same as the first server.

24. An apparatus for registering auto-configured network addresses, comprising:

a network interface that is configured to be coupled to a data network for receiving therefrom, and sending thereto, one or more packet flows;

a physical connection that is configured to be coupled to a host;

one or more processors;

one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of;

receiving a request for configuration information for a host, the request including a logical network address for the host determined at least in part by the host,

receiving first data from a first server in response to a request for authentication for the physical connection, the first data indicating at least one of authentication and authorization information; and

registering the logical network address by associating the logical network address with the first data;

generating a second request based on the first request and the first data; and

sending the second request to a second, dynamic host control protocol (DHCP) server that registers the host by associating the logical network address with the first data;

wherein the first server provides authentication and authorization in response to a request for authentication for the physical connection.

25. The apparatus of claim 24, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform correlating the request and the first data.

26. The apparatus of claim 25, wherein:

the request includes a unique identification for the host;

the first data includes the unique identification for the host; and

wherein the instructions for correlating the first message and the first data is based on the unique identification for the host.

27. The apparatus of claim 26, wherein the unique identification for the host is a media access control address.

28. A method of registering auto-configured network addresses, the method comprising the computer-implemented steps of:

receiving, at a networking device connected to a host at a physical connection, from a first server, first data indicating at least some authentication information associated with the host;

receiving at the networking device from the host, a first message requesting configuration information, the first message including a logical network address for the host determined at least in part by the host;

generating a second message based on the first message and the first data; and

sending the second message to a second, dynamic host control protocol (DHCP) server that registers the host by associating the logical network address with the first data;

wherein the first server provides authentication and authorization in response to a request for authentication for the physical connection.

29. A method as recited in claim 28, wherein:

an authenticator process sends the request for authentication and performs the step of receiving the first data;

a relay agent process for the second server performs the steps of receiving the first message and sending the second message;

the relay agent process is separate from the authenticator process; and

the step of generating the second message further comprises the step of sending a third message, from the authenticator process to the relay agent process, based on the first data.