Network authorization status notification

• US 8,381,268 B2
• Filed: 05/06/2008
• Issued: 02/19/2013
• Est. Priority Date: 05/11/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Winget, Nancy Cam, Salowey, Joseph A., Burns, James Edward, Thomson, Susan Elizabeth, Zhou, Hao
• Primary Examiner(s): Truong, Thanhnga B
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US12/115,677
• Publication Number:
  US 20080282327A1
• Time in Patent Office: 1,750 Days
• Field of Search: 726/2, 726 4- 5, 726/14, 713/201, 713/183, 455/411, 709223-225
• US Class Current: 726/4
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

A system that enables network authorization status to be conveyed to the device requesting network services within or outside the scope of an authentication exchange is provided. The authorization status notification or information can be automatically generated or otherwise triggered by a request from the user or device. For instance, a query can be employed to solicit device authorization status related to a particular service or group of services. Additionally, authorization status notification can be automatically triggered based upon a change in the device authorization state.

Claims

1. A method, comprising:

monitoring a plurality of network application services accessible to an entity;

authenticating the entity;

establishing authorization status of the entity, wherein the authorization status identifies a scope of access permission to a subset of the plurality of network application services provided by one or more application servers accessible to the entity;

subsequent to the establishing authorization status of the entity, receiving a request for an updated authorization status from the entity;

in response to the request, generating a notification message that includes the updated authorization status;

communicating the notification message to the entity;

dynamically monitoring authorization status of the entity; and

triggering the act of communicating based upon identifying a change in the authorization status, wherein the notification message further comprises a remedial measure to address the change in the authorization status.

2. The method of claim 1, wherein the notification message includes at least one of network name, authorization profile name, communication permissions, provisioning permissions, remediation permissions, access permissions, type of access permission, quality of service, scope of authorization, or reasons for restrictions.

3. The method of claim 1, further comprising cryptographically protecting the request or the notification message.

4. The method of claim 1, further comprising triggering an action based upon the notification message, wherein the action is at least one of communication, remediation, re-authentication, enrollment, complete rejection, or limited rejection.

5. The method of claim 1, further wherein the act of communicating employs incorporation of the notification message as an attribute in at least one of a DHCP, LLDP, EAPoL or EAPoUDP message.

6. The method of claim 1, further comprising communicating the notification message to a disparate entity.

7. The method of claim 1, wherein the plurality of network application services comprises a telephone application to the entity, and wherein the authorization status comprises a scope of access permission to the telephone application of the entity.

8. The method of claim 1, wherein the plurality of network application services comprises a mobile device communication service to the entity, and wherein the authorization status comprises a scope of access permission to the mobile device communication service of the entity.

9. A system, comprising:

a processor;

a memory;

a real-time status generation component of a processing device configured to operate with the processor and memory to determine real-time authorization status of a client at a point subsequent to authorization status being assigned to the client, wherein the real-time authorization status identifies a scope of access permission to a subset of the plurality of network application services provided by one or more application servers accessible to the client; and

a notification component of the processing device configured to operate with the processor and memory to, subsequent to authorization of the client, generate and convey a message to the client, wherein the message includes the real-time authorization status, dynamically monitor authorization status of the entity, and trigger an act of communicating a notification message based upon identifying a change in the authorization status, wherein the notification message further comprises a remedial measure to address the change in the authorization status.

10. The system of claim 9, further comprising a monitoring component that dynamically monitors the authorization status of the client.

11. The system of claim 9, wherein the message is a post-authentication notification.

12. The system of claim 9, wherein the message is triggered as a function of a change in the authorization status.

13. The system of claim 9, wherein the notification is triggered as a function of a request from the client.

14. The system of claim 9, the authorization status includes at least one of network name, authorization profile name, communication permission, provisioning permission, remediation access permission, scope of access permission, type of access permission, quality of service, lifetime of an authorization or reason for restrictions.

15. The system of claim 9, further comprising query response component that evaluates a request from the client, wherein the notification component triggers transmission of the message as a function of the request.