System, method and apparatus for providing multiple access modes in a data communications network

• US 8,681,800 B2
• Filed: 05/01/2012
• Issued: 03/25/2014
• Est. Priority Date: 08/01/2003
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Foundry Networks LLC (Broadcom, Inc.)
• Inventors: Kwan, Philip
• Primary Examiner(s): CHAN, SAI MING
• Application Number:
  US13/461,519
• Publication Number:
  US 20120216256A1
• Time in Patent Office: 693 Days
• Field of Search: 370/440, 370/395.2, 370/395.5
• US Class Current: 370/395.2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports. Control logic within the network access device is adapted to determine whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network. If the user authentication protocol is not supported, then the input port to which the network access device is coupled is placed in a semi-authorized access state that limits access to a pre-configured network accessible via the host network.

Claims

1. A method comprising:

at a network access device communicably coupled to a network,

sensing a user device coupled to a port of the network access device;

if authentication of a physical address of the user device is successful, determining if the user device supports a protocol used by the network to validate the identity of a user of the user device;

if the user device supports the protocol, validating the identity of the user according to the protocol; and

providing the user device with limited network access if the user device does not support the protocol.

2. The method of claim 1, wherein the limited network access limits access by the user device to a network, the network selected from the group comprising a Voice over Internet Protocol (VoIP) network, the Internet, and a low security virtual local area network (VLAN).

3. The method of claim 1, wherein the placing comprises selectively placing the port into one of a plurality of semi-authorized access states.

4. The method of claim 3, wherein the placing comprises:

determining a type of the user device; and

selectively placing the port into one of a plurality of semi-authorized access states based on the type of the user device.

5. The method of claim 4, wherein the selectively placing comprises selectively placing the port into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

6. The method of claim 4, wherein the selectively placing comprises selectively placing the port into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

7. The method of claim 1, wherein the protocol is IEEE 802.1x.

8. The method of claim 1, wherein the network access device comprises a network switch.

9. A network access device comprising:

a switching fabric for routing data received on one or more of input ports of the device to one or more output ports of the device; and

control logic configured to;

sense a user device coupled to a port of the network access device;

if authentication of a physical address of the user device is successful, determine;

if the user device supports a protocol used by the network to validate the identity of a user of the user device;

if the user device supports the protocol, validate the identity of the user according to the protocol; and

provide the user device with limited network access if the user device does not support the protocol.

10. The device of claim 9, wherein the limited network access limits access by the user device to a network, the network selected from the group comprising a Voice over Internet Protocol (VoIP) network, the Internet, and a low security virtual local area network (VLAN).

11. The device of claim 9, wherein the control logic is configured to selectively place the one of the input ports into one of a plurality of semi-authorized access states.

12. The device of claim 11, wherein the control logic is configured to determine a type of the user device and to selectively place the one of the input ports into one of a plurality of semi-authorized access states based on the type of the user device.

13. The device of claim 12, wherein the control logic is configured to selectively place the one of the input ports into a semi-authorized access state that limits access by the user device to a network comprising a Voice over Internet Protocol (VoIP) network.

14. The device of claim 12, wherein the control logic is configured to selectively place the one of the input ports into a semi-authorized access state that limits access by the user device to a network comprising the Internet if the user device is a portable computing device.

15. The device of claim 9, wherein the protocol is IEEE 802.1x.

16. A method comprising:

at a network access device communicably coupled to a network, sensing a user device coupled to a port of the network access device;

authenticating a physical address of the user device;

if authentication of the physical address is successful, allowing the user device limited access to a network via the network access device if it is determined that the user device is unable to communicate using a particular user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

if the user device supports the user authentication protocol, validating, by the network access device, the identity of the user according to the user authentication protocol.

17. The method of claim 16 wherein the limited access comprises less access than access afforded a user device that is successfully authenticated using the user authentication protocol.

18. The method of claim 17 wherein the limited access comprises access to a low-security Virtual Local Area Network (VLAN).

19. A network access device comprising:

a memory;

a switching fabric configured to route data received on one or more input ports of the device to one or more output ports of the device; and

control logic configured to;

sense a user device coupled to a port of the network access device;

authenticate a physical address of the user device;

if authentication of the physical address is successful, allow the user device limited access to a network via the network access device if it is determined that the user device is unable to communicate using a particular user authentication protocol, the user authentication protocol comprising a protocol to validate the identity of a user of the user device; and

if the user device supports the user authentication protocol, validate, by the network access device, the identity of the user according to the user authentication protocol.

20. The network access device of claim 19 wherein the limited access comprises less access than access afforded a user device that is successfully authenticated using the user authentication protocol.

21. The network access device of claim 20 wherein the limited access comprises access to a low-security Virtual Local Area Network (VLAN).