Methods and apparatus for connecting to virtual networks using non supplicant authentication

• US 7,869,436 B1
• Filed: 10/13/2005
• Issued: 01/11/2011
• Est. Priority Date: 10/13/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Adler, Saul, Martini, Luca, Yarlagadda, Venkateswara Rao, Wainner, W. Scott, Guichard, James N.
• Primary Examiner(s): Sam; Phirin
• Application Number:
  US11/250,010
• Time in Patent Office: 1,916 Days
• Field of Search: None
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A system allows a device to communicate using a virtual network the method by assigning a network address to the device. The network address is selected from a plurality of network addresses that can be assigned to any of a plurality of virtual networks. The system receives a request to authenticate the device, and then determines a virtual network on which to assign the device. The virtual network is selected from the plurality of virtual networks. The system identifies the device as authenticated based on the assigning of the network address and the virtual network.

Claims

1. A method for allowing a device to communicate using a virtual network, the method comprising:

assigning a network address to the device, the network address selected from a plurality of network addresses that can be assigned to any of a plurality of virtual networks;

authorizing the device to be included in each of the plurality of virtual networks, wherein the device is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

receiving a request to authenticate the device;

determining a virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks; and

authenticating the device to be included in the assigned virtual network based on the request to authenticate.

2. The method of claim 1 wherein receiving a request to authenticate the device comprises:

performing an HTTP authentication on the device; and

wherein determining a virtual network on which to assign the device comprises;

determining an access level for the device based on the result of the HTTP authentication, the access level associated with at least one virtual network within the plurality of virtual networks; and

selecting a virtual network from the plurality of virtual networks, based on the determined access level for the device.

3. The method of claim 1 wherein determining a virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks comprises:

exclusively assigning the network address of the device to a first virtual network of the plurality of the virtual networks operational in the switch so that data communications traffic associated with the device is transported using the first virtual network; and

while the network address is assigned to the first virtual network, disallowing other virtual networks of the plurality of virtual networks from being assigned that network address.

4. The method of claim 3 wherein receiving a request to authenticate the device comprises:

performing a non-802.1x supplicant authentication.

5. The method of claim 3 comprising:

maintaining the plurality of the virtual networks operational in the switch using a shared pool of network addresses that can be assigned to anyone of the virtual networks, and that once assigned, is exclusive to the virtual network to which it is assigned.

6. In a data communications device, a method of allowing a client to communicate using a virtual network, the method comprising:

detecting a first packet from the client, wherein the client includes an assigned network address associated with a plurality of virtual networks, and wherein the client is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

identifying that the first packet is assigned to a first virtual network of the plurality of virtual networks operational in the data communications device;

assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network; and

routing the first packet and subsequent packets, each having the addressing information of the first packet, using the routing information associated with the first virtual network.

7. The method of claim 6 comprising:

maintaining respective routing information for each of the plurality of virtual networks, and

wherein assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network comprises;

exclusively assigning the addressing information of the first packet to routing information of the first virtual network, such that when addressing information for any packet is assigned to a specific virtual network, that addressing information is not assigned to any other virtual network.

8. The method of claim 6 wherein assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network comprises:

inserting a first source network address that includes the assigned network address of the first packet into a first VRF associated with the first virtual network;

obtaining a first destination network address from the first packet;

propagating the first packet toward the first destination network address; and

wherein the method comprises;

detecting a second packet on a second virtual network;

assigning addressing information of the second packet to routing information associated with the second virtual network by performing the operations of;

inserting a second source network address of the second packet into a second VRF associated with the second virtual network; and

obtaining a second destination network address from the second packet;

and propagating the second packet toward the second destination network address.

9. The method of claim 8 comprising:

detecting that the first destination network address of the first packet is the first source network address;

propagating the first packet toward the first source network address on the first virtual network associated with the first VRF containing the first source network address;

detecting that the second destination network address of the second packet is the second source network address; and

propagating the second packet toward the second source network address on the second virtual network associated with the second VRF containing the second source network address.

10. In a data communications device, a method of allowing a client to communicate with a shared device using a virtual network the method comprising:

detecting a first incoming packet on a virtual network;

capturing a first incoming packet state of the first incoming packet;

associating the first incoming packet state with the virtual network on which the first incoming packet arrived;

propagating the first incoming packet along the virtual network toward a destination network address;

receiving a response packet in response to the first incoming packet;

examining a response packet state of the response packet;

determining that the response packet state of the response packet matches the first incoming packet state of the first incoming packet;

converting the response packet to conform to the first incoming packet state; and

in response, propagating the response packet along the virtual network associated with the first incoming packet state of the first incoming packet.

11. The method of claim 10 wherein capturing a first incoming packet state of the first incoming packet comprises:

determining a first source network address of the first incoming packet; and

identifying a first port through which the first incoming packet arrived.

12. The method of claim 10 wherein determining that the response packet state of the response packet matches the first incoming packet state of the first incoming packet comprises:

identifying that a first source network address of the first incoming packet equals a destination network address of the response packet; and

identifying a first port through which the incoming packet arrived is the same as a second port through which the response packet is attempting to exit.

13. The method of claim 10 comprising:

detecting a second incoming packet on a virtual network, a second source network address of the second incoming packet equaling the first source network address of the first incoming packet;

capturing a second incoming packet state of the second incoming packet;

disassociating the first incoming packet state with the virtual network on which the first incoming packet arrived; and

associating the second incoming packet state with the virtual network on which the second incoming packet arrived.

14. A system for allowing a device to communicate using a virtual network, the system comprising:

in a first data communications device configured to perform the operations of;

assigning a network address to the device, the network address selected from a plurality of network addresses that can be assigned to any of a plurality of virtual networks;

authorizing the device to be included in each of the plurality of virtual networks, wherein the device is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

receiving a request to authenticate the device;

determining a first virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks; and

authenticating the device to be included in the assigned virtual network based on the request to authenticate; and

in a second data communications devices, performing the operations of;

detecting a first packet from the device;

identifying that the first packet is assigned to a first virtual network of the plurality of virtual networks operational in the data communications device;

assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network; and

routing the first packet and subsequent packets, each having the addressing information of the first packet, using the routing information associated with the first virtual network.

15. The system of claim 14 comprising:

in a third data communications devices, performing the operations of;

detecting a first incoming packet on the first virtual network;

capturing a first incoming packet state of the first incoming packet;

associating the first incoming packet state with the first virtual network on which the first incoming packet arrived; and

propagating the first incoming packet along the virtual network toward a destination network address.

16. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with an virtual network assigning application that when executed on the processor allows a device to communicate using a virtual network by performing the operations of;

assigning a network address to the device, the network address selected from a plurality of network addresses that can be assigned to any of a plurality of virtual networks;

authorizing the device to be included in each of the plurality of virtual networks, wherein the device is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

receiving a request to authenticate the device;

determining a virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks; and

authenticating the device to be included in the assigned virtual network based on the request to authenticate.

17. The computerized device of claim 16 wherein when the computerized device performs the operation of receiving a request to authenticate the device, the computerized device performs the operation of:

performing an HTTP authentication on the device; and

wherein when the computerized device performs the operation of determining a virtual network on which to assign the device, the computerized device performs the operations of;

determining an access level for the device based on the result of the HTTP authentication, the access level associated with at least one virtual network within the plurality of virtual networks; and

selecting a virtual network from the plurality of virtual networks, based on the determined access level for the device.

18. The computerized device of claim 16 wherein when the computerized device performs the operation of determining a virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks, the computerized device performs the operations of:

exclusively assigning the network address of the device to a first virtual network of the plurality of the virtual networks operational in the switch so that data communications traffic associated with the device is transported using the first virtual network; and

while the network address is assigned to the first virtual network, disallowing other virtual networks of the plurality of virtual networks from being assigned that network address.

19. The computerized device of claim 18 wherein when the computerized device performs the operation of receiving a request to authenticate the device, the computerized device performs the operation of:

performing a non-802.1x supplicant authentication.

20. The computerized device of claim 18 wherein the computerized device performs the operation of:

maintaining the plurality of the virtual networks operational in the switch using a shared pool of network addresses that can be assigned to anyone of the virtual networks, and that once assigned, is exclusive to the virtual network to which it is assigned.

21. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with virtual packet directing application that when executed on the processor allows a client to communicate using a virtual network by performing the operations of;

detecting a first packet from the client, wherein the client includes an assigned network address associated with a plurality of virtual networks, and wherein the client is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

identifying that the first packet is assigned to a first virtual network of the plurality of virtual networks operational in the data communications device;

assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network; and

routing the first packet and subsequent packets, each having the addressing information of the first packet, using the routing information associated with the first virtual network.

22. The computerized device of claim 21 wherein the computerized device performs the operation of:

maintaining respective routing information for each of the plurality of virtual networks, and

wherein when the computerized device performs the operation of assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network, the computerized device performs the operation of;

exclusively assigning the addressing information of the first packet to routing information of the first virtual network, such that when addressing information for any packet is assigned to a specific virtual network, that addressing information is not assigned to any other virtual network.

23. The computerized device of claim 21 wherein when the computerized device performs the operation of assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network, the computerized device performs the operations of:

inserting a first source network address of the first packet into a first VRF associated with the first virtual network;

obtaining a first destination network address from the first packet;

propagating the first packet toward the first destination network address;

and wherein the computerized device performs the operations of;

detecting a second packet on a second virtual network;

assigning addressing information of the second packet to routing information associated with the second virtual network by performing the operations of;

inserting a second source network address of the second packet into a second VRF associated with the second virtual network;

obtaining a second destination network address from the second packet; and

propagating the second packet toward the second destination network address.

24. The computerized device of claim 23 wherein the computerized device performs the operations of:

detecting that the first destination network address of the first packet is the first source network address;

propagating the first packet toward the first source network address on the first virtual network associated with the first VRF containing the first source network address;

detecting that the second destination network address of the second packet is the second source network address; and

propagating the second packet toward the second source network address on the second virtual network associated with the second VRF containing the second source network address.

25. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with an virtual packet directing application that when executed on the processor allows a client to communicate with a shared device using a virtual network by performing the operations of;

detecting a first incoming packet on a virtual network;

capturing a first incoming packet state of the first incoming packet;

associating the first incoming packet state with the virtual network on which the first incoming packet arrived;

propagating the first incoming packet along the virtual network toward a destination network address;

receiving a response packet in response to the first incoming packet;

examining a response packet state of the response packet;

determining that the response packet state of the response packet matches the first incoming packet state of the first incoming packet; and

converting the response packet to conform to the first incoming packet state; and

in response, propagating the response packet along the virtual network associated with the first incoming packet state of the first incoming packet.

26. The computerized device of claim 25 wherein when the computerized device performs the operation of capturing a first incoming packet state of the first incoming packet comprises:

determining a first source network address of the first incoming packet; and

identifying a first port through which the first incoming packet arrived.

27. The computerized device of claim 25 wherein when the computerized device performs the operation of determining that the response packet state of the response packet matches the first incoming packet state of the first incoming packet, the computerized device performs the operations of:

identifying that a first source network address of the first incoming packet equals a destination network address of the response packet; and

identifying a first port through which the incoming packet arrived is the same as a second port through which the response packet is attempting to exit.

28. The computerized device of claim 27 wherein the computerized device performs the operations of:

detecting a second incoming packet on a virtual network, a second source network address of the second incoming packet equaling the first source network address of the first incoming packet;

capturing a second incoming packet state of the second incoming packet;

disassociating the first incoming packet state with the virtual network on which the first incoming packet arrived; and

associating the second incoming packet state with the virtual network on which the second incoming packet arrived.

29. A computer readable medium encoded with computer programming logic that when executed on a process in a computerized device produces a virtual network assigning process that allows a device to communicate using a virtual network by causing the computerized device to perform the operations of:

assigning a network address to the device, the network address selected from a plurality of network addresses that can be assigned to any of a plurality of virtual networks;

authorizing the device to be included in each of the plurality of virtual networks, wherein the device is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

receiving a request to authenticate the device;

determining a virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks; and

authenticating the device to be included in the assigned virtual network based on the request to authenticate.

30. A computer readable medium encoded with computer programming logic that when executed on a process in a computerized device produces a packet directing process that allows a client to communicate using a virtual network by causing the computerized device to perform the operations of:

detecting a first packet from the client, wherein the client includes an assigned network address associated with a plurality of virtual networks, and wherein the client is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

identifying that the first packet is assigned to a first virtual network of the plurality of virtual networks operational in the data communications device;

assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network; and

routing the first packet and subsequent packets, each having the addressing information of the first packet, using the routing information associated with the first virtual network.

31. A computer readable medium encoded with computer programming logic that when executed on a process in a computerized device produces a packet directing process that allows a client to communicate with a shared device using a virtual network by causing the computerized device to perform the operations of:

detecting a first incoming packet on a virtual network;

capturing a first incoming packet state of the first incoming packet;

associating the first incoming packet state with the virtual network on which the first incoming packet arrived;

propagating the first incoming packet along the virtual network toward a destination network address;

receiving a response packet in response to the first incoming packet;

examining a response packet state of the response packet;

determining that the response packet state of the response packet matches the first incoming packet state of the first incoming packet;

converting the response packet to conform to the first incoming packet state; and

in response, propagating the response packet along the virtual network associated with the first incoming packet state of the first incoming packet.

32. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

where the memory is encoded with an virtual network assigning application that when executed on the processor configures the computerized device with a means for allowing a device to communicate using a virtual network, the means including;

means for assigning a network address to the device, the network address selected from a plurality of network addresses that can be assigned to any of a plurality of virtual networks;

means for authorizing the device to be included in each of the plurality of virtual networks, wherein the device is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

means for receiving a request to authenticate the device;

means for determining a virtual network on which to assign the device, the virtual network selected from the plurality of virtual networks; and

means for authenticating the device to be included in the assigned virtual network based on the request to authenticate.

33. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

where the memory is encoded with an packet directing application that when executed on the processor configures the computerized device with a means for allowing a client to communicate using a virtual network, the means including;

means for detecting a first packet from the client, wherein the client includes an assigned network address associated with a plurality of virtual networks, and wherein the client is configured to maintain the assigned network address when the device is included in any one of the plurality of virtual networks;

means for identifying that the first packet is assigned to a first virtual network of a plurality of virtual networks operational in the data communications device;

means for assigning addressing information associated with the assigned network address of the first packet to routing information associated with the first virtual network; and

means for routing the first packet and subsequent packets, each having the addressing information of the first packet, using the routing information associated with the first virtual network.