High-availability Remote-Authentication Dial-In User Service

• US 8,619,798 B2
• Filed: 10/31/2011
• Issued: 12/31/2013
• Est. Priority Date: 04/20/2007
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Tuvell, Walter, Tavakoli, Oliver, Porcher, Thomas C
• Primary Examiner(s): Hamza, Faruk
• Assistant Examiner(s): PHAM, TITO Q
• Application Number:
  US13/285,933
• Publication Number:
  US 20120042029A1
• Time in Patent Office: 792 Days
• Field of Search: None
• US Class Current: 370/401
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols

Abstract

A method may include receiving, in a first server from a second server, a request for a service of a network by a device; sending, from the first server to the second server, a response to the request for the service to permit access to the service; and sending state information about the response to a third server for storage in a database.

Claims

1. A method comprising:

receiving, by a server in a network and from a first device, a request for a network address to be used to establish a session for a user device,

determining, by the server, one or more privileges associated with the user device based on the request;

determining, by the server, one or more restrictions associated with the user device based on the request,

the one or more restrictions including information identifying a period of time for a particular privilege of the one or more privileges;

determining, by the server, to grant the request based on the one or more privileges and the information identifying the period of time for the particular privilege;

requesting, by the server and from a second device, a group of network addresses,

the group of network addresses being included in a plurality of network addresses,

the plurality of network addresses including assigned addresses and unassigned addresses, and

the second device storing information that includes;

first data classifying each of the plurality of network addresses as one of;

the assigned addresses, or

the unassigned addresses, and

second data identifying devices to which the assigned addresses are assigned;

acquiring, by the server and from the second device, the group of network addresses from the unassigned addresses included in the plurality of addresses;

assigning, by the server, a particular network address, of the group of network addresses, to the user device;

sending, by the server, a response to the first device,

the response indicating that the request should be granted, and

the response including information identifying the particular network address; and

causing, by the server, the second device to update the first data and the second data based on assigning the particular network addresses to the user device.

2. The method of claim 1,

where the particular network address enables the user device to connect to the network, and

where causing the second device to update the first data and the second data further includes:

sending, to the second device, information associated with a session identifier associated with a connection between the user device and the network.

3. The method of claim 1,

where the particular network address enables the user device to connect to the network, and

where the method further comprises:

determining a status of a connection between the user device and the network; and

sending, to the second device, status information related to the status of the connection, and

where the second device updates the first data to reclassify the particular network address as one of the unassigned address when the status information indicates that the connection is inactive.

4. The method of claim 1, where the second device is included in a plurality of second devices that redundantly store the information.

5. The method of claim 1, further comprising:

providing, to the second device, a failure notice related to a failure detected in the server.

6. The method of claim 1,

where the first data further identifies times when the assigned addresses were assigned, and

where causing the second device to update the first data and the second data further includes:

causing the second device to update a time when the session is established for the user device with the network.

7. The method of claim 6, where the second device updates the first data to reclassify the particular network address as one of the unassigned addresses after a particular duration of time has passed after the time when the network address is assigned to the first device.

8. A device comprising:

a processor to;

receive, from a first computing device, a request for a network address to be used to establish a session for a user device,

determine one or more privileges associated with the user device based on the request,

determine one or more restrictions associated with the user device based on the request,

the one or more restrictions including information identifying a period of time for a particular privilege of the one or more privileges,

determine to grant the request based on the one or more privileges and the information identifying the period of time for the particular privilege,

request, from a second computing device, two or more network addresses,

the two or more network addresses being included in a plurality of network addresses associated with a network,

the plurality of network addresses including assigned addresses and unassigned addresses, and

the second computing device storing information that includes;

first data classifying each of the plurality of network addresses as one of;

 

the assigned addresses, or

 

the unassigned addresses, and

second data identifying devices to which the assigned addresses are assigned,

receive, from the second computing device, the two or more network addresses, of the plurality of network addresses,

the two or more addresses comprising unassigned addresses,

cache the two or more network addresses,

assign, to the user device, a particular network address from the cached two or more network address,

send a response to the first device,

the response indicating that the request should be granted, and

the response including information identifying the particular network address, and

cause the second computing device to update the first data and the second data based on assigning the particular network to the user device.

9. The device of claim 8,

where the particular network address enables the user device to connect to the network, and

where the processor, when causing the second computing device to update the first data and the second data, is further to:

send, to the second computing device, information associated with a session identifier associated with a connection between the user device and the network.

10. The device of claim 8,

where the particular network address enables the user device to connect to the network,

where the processor is further to:

determine a status of a connection between the user device and the network; and

send, to the second computing device, status information related to the status of the connection, and

where the second computing device updates the first data to reclassify the particular network address as one of the unassigned addresses when the status information indicates that the connection is inactive.

11. The device of claim 8, where the second computing device is included in a plurality of second computing devices that redundantly store the information.

12. The device of claim 8,

where the processor is further to:

provide, to the second computing device, a failure notice related to a failure detected in the device, and

where the second computing device provides, based on receiving the failure notice, one network address, classified as unassigned, to the user device.

13. The device of claim 8,

where the first data further identifies times when the assigned addresses were assigned, and

where the processor, when causing the second computing device to update the first data and the second data, is further to:

cause the second computing device to update the first data based on a time associated with assigning the particular network address to the user device.

14. The device of claim 13, where the second computing device updates the first data to reclassify the particular network address as unassigned after a particular duration of time has passed after the time when the particular network address is assigned to the first computing device.

15. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by a device, cause the device to receive, from a first computing device, a request for a network address to be used to establish a session for a user device;

one or more instructions which, when executed by the device, cause the device to determine one or more privileges associated with the user device based on the request;

one or more instructions which, when executed by the device, cause the device to determine one or more restrictions associated with the user device based on the request,

the one or more restrictions including information identifying a period of time for a particular privilege of the one or more privileges;

one or more instructions which, when executed by the device, cause the device to determine to grant the request based on the one or more privileges and the information identifying the period of time for the particular privilege;

one or more instructions which, when executed by the device, cause the device to request, from a second computing device, two or more network addresses,

the two or more network addresses being included in a plurality of network addresses associated with a network,

the plurality of network addresses including assigned addresses and unassigned addresses, and

the second device storing information that includes;

first data indicating each of the plurality of network addresses as one of;

the assigned addresses, or

the unassigned addresses, and

second data identifying devices to which the assigned addresses are assigned;

one or more instructions which, when executed by the device, cause the device to receive, from the second computing device, information identifying the two or more network addresses,

the two or more network address comprising unassigned addresses;

one or more instructions which, when executed by the device, cause the device to cache the two or more network addresses;

one or more instructions which, when executed by the device, cause the device to assign, to the user device, a particular network address of the cached two or more network addresses;

one or more instructions which, when executed by the device cause the device to send a response to the first device,

the response indicating that the request should be granted, and

the response including information identifying the particular network address; and

one or more instructions which, when executed by the device, cause the device to cause the second computing device update the first data and the second data to indicate that the particular network address has been assigned to the user device.

16. The non-transitory computer-readable medium of claim 15,

where the particular network address enables the user to connect to the network, and

where the one or more instructions to cause the second computing device to update the first data and the second data include:

one or more instructions to send, to the second computing device, information associated with a session identifier associated with a connection between the user device and the network.

17. The non-transitory computer-readable medium of claim 15,

where the particular network address enables the user device to connect to the network,

where the instructions further comprise:

one or more instructions to determine a status of a connection between the user device and the network; and

one or more instructions to send, to the second computing device, status information related to the status of the connection, and

where the second computing device reclassifies the particular network address as unassigned when the status information indicates that the connection is inactive.

18. The non-transitory computer-readable medium of claim 15, where the second computing device is included in a plurality of second computing devices that redundantly store the information.

19. The non-transitory computer-readable medium of claim 15, where the instructions further comprise:

one or more instructions to provide, to the second computing device, a failure notice related to a failure detected in the device,

where the second computing device provides, based on receiving the failure notice, a network address, classified as unassigned, to the user device.

20. The non-transitory computer-readable medium of claim 15, where second device further stores information identifying a time associated with when the assigned addresses were assigned, and

where the second computing device reclassifies the particular network address as unassigned after a particular duration of time has passed after the time when the particular network address is assigned to the first computing device.