System, method and apparatus for providing multiple access modes in a data communications network

• US 7,876,772 B2
• Filed: 08/01/2003
• Issued: 01/25/2011
• Est. Priority Date: 08/01/2003
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Foundry Networks LLC (Broadcom, Inc.)
• Inventors: Kwan, Philip
• Primary Examiner(s): Rao; Seema S
• Assistant Examiner(s): CHAN, SAI MING
• Application Number:
  US10/631,898
• Publication Number:
  US 20050025125A1
• Time in Patent Office: 2,734 Days
• Field of Search: 370/352, 370/449, 709/216, 726/4, 726/27
• US Class Current: 370/449
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports. Control logic within the network access device is adapted to determine whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network. If the user authentication protocol is not supported, then the input port to which the network access device is coupled is placed in a semi-authorized access state that limits access to a pre-configured network accessible via the host network.

Claims

1. A computer implemented method comprising:

at a network access device communicably coupled to a host network, sensing a user device coupled to a port of the network access device;

determining, by the network access device, if the user device supports a user authentication protocol used by the host network, the determining comprising polling the user device for the user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

placing, by the network access device, the port into a semi-authorized access state if the determining indicates that the user device does not support the user authentication protocol, the semi-authorized access state providing the user device with limited network access.

2. The method of claim 1, wherein the semi-authorized state limits access by the user device to a network, the network selected from the group comprising a Voice over Internet Protocol (VoIP) network, the Internet, and a low security virtual local area network (VLAN).

3. The method of claim 1, wherein the placing comprises selectively placing the port into one of a plurality of semi-authorized access states.

4. The method of claim 3, wherein the placing comprises:

determining a type of the user device; and

selectively placing the port into one of a plurality of semi-authorized access states based on the type of the user device.

5. The method of claim 4, wherein the selectively placing comprises selectively placing the port into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

6. The method of claim 4, wherein the selectively placing comprises selectively placing the port into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

7. The method of claim 1, wherein the user authentication protocol is IEEE 802.1x.

8. The method of claim 1, wherein the network access device comprises a network switch.

9. A network access device comprising:

a plurality of input ports;

a plurality of output ports;

a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports; and

control logic adapted to determine, by the network access device, whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network, and to place, by the network access device, the one of the input ports in a semi-authorized access state if the determination indicates the authentication protocol is not supported, the semi-authorized access state providing the user device with limited network access, the determining comprising polling the user device for the user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.

10. The device of claim 9, wherein the semi-authorized state limits access by the user device to a network, the network selected from the group comprising a Voice over Internet Protocol (VoIP) network, the Internet, and a low security virtual local area network (VLAN).

11. The device of claim 9, wherein the control logic is adapted to selectively place the one of the input ports into one of a plurality of semi-authorized access states.

12. The device of claim 11, wherein the control logic is adapted to determine a type of the user device and to selectively place the one of the input ports into one of a plurality of semi-authorized access states based on the type of the user device.

13. The device of claim 12, wherein the control logic is adapted to selectively place the one of the input ports into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

14. The device of claim 12, wherein the control logic is adapted to selectively place the one of the input ports into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

15. The device of claim 9, wherein the user authentication protocol is IEEE 802.1x.

16. A network system, comprising:

a host network that uses a user authentication protocol;

a network access device communicatively coupled to the host network; and

a user device coupled to a port of the network access device;

wherein the network access device is adapted to;

determine whether the user device supports the user authentication protocol; and

place the port in a semi-authorized access state if the determination indicates the user authentication protocol is not supported, the semi-authorized access state providing the user device with limited network access, the determining comprising polling the user device for the user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.

17. The network system of claim 16, wherein the semi-authorized state limits access by the user device to a network, the network selected from the group comprising a Voice Over Internet Protocol (VoIP) network, the Internet, and a low-security virtual local area network (VLAN).

18. The network system of claim 16, wherein the network access device is adapted to selectively place the port into one of a plurality of semi-authorized access states.

19. The network system of claim 18, where the network access device is adapted to determine a type of the user device and to selectively place the port into one of a plurality of semi-authorized access states based on the type of the user device.

20. The network system of claim 19, wherein the network access device is adapted to selectively place the port into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

21. The network system of claim 19, wherein the network access device is adapted to selectively place the port into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

22. The network system of claim 16, wherein the user authentication protocol is IEEE 802.1x.

23. The network system of claim 16, wherein the network access device is a network switch.

24. An apparatus comprising:

means for sensing a user device coupled to a port of a network access device;

means for determining, by the network access device, if the user device supports a user authentication protocol used by the host network, the determining comprising polling the user device for the user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

means for placing, by the network access device, the port into a semi-authorized access state if the determining indicates that the user device does not support the user authentication protocol, the semi-authorized access state providing the user device with limited network access.

25. A computer implemented method comprising:

at a network access device communicably coupled to a host network, sensing a user device coupled to a port of the network access device; and

at the network access device, allowing the user device limited access to a network via the network access device if it is determined that the user device is unable to communicate using a particular user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device.

26. The method of claim 25, further comprising performing further user authentication in accordance with the user authentication protocol if it is determined that the user device is able to communicate using the user authentication protocol.

27. The method of claim 25 wherein the limited access comprises less access than access afforded a user device that is successfully authenticated using the user authentication protocol.

28. The method of claim 27 wherein the limited access comprises access to a low-security Virtual Local Area Network (VLAN).

29. A network access device comprising:

a memory;

a plurality of input ports;

a plurality of output ports communicably coupled to a host network;

a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports; and

control logic at the network access device configured to;

sense a user device coupled to one of the input ports;

determine if the user device supports a user authentication protocol used by the host network, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

place the port into a semi-authorized access state if the determination indicates that the user device does not support the user authentication protocol, the semi-authorized access state providing the user device with limited network access.

30. The network access device of claim 29 wherein the control logic is further configured to perform further user authentication in accordance with the user authentication protocol if it is determined that the user device is able to communicate using the user authentication protocol.

31. The network access device of claim 29 wherein the limited access comprises less access than access afforded a user device that is successfully authenticated using the user authentication protocol.

32. The network access device of claim 31 wherein the limited access comprises access to a low-security Virtual Local Area Network (VLAN).

33. An apparatus comprising:

a memory;

means for sensing a user device coupled to a port of the apparatus, the apparatus communicably coupled to a host network; and

means for determining if the user device supports a user authentication protocol used by the host network, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

means for placing the port into a semi-authorized access state if the determining indicates that the user device does not support the user authentication protocol, the semi-authorized access state providing the user device with limited network access.