Method and apparatus for network login authorization

• US 8,751,647 B1
• Filed: 06/30/2001
• Issued: 06/10/2014
• Est. Priority Date: 06/30/2001
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Extreme Networks, Inc.
• Inventors: Yip, Michael, Polo, Michael, Bunker, Brian, Bagchi, Indranil
• Primary Examiner(s): Winder, Patrice
• Assistant Examiner(s): Chang, Julian
• Application Number:
  US09/895,144
• Time in Patent Office: 4,728 Days
• Field of Search: 709/203, 709217-225, 709227-229, 709/245, 370/401, 713155-159, 713182-186, 726 2- 15
• US Class Current: 709/225
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method and apparatus is provided to control the admission of a user to a network by preventing a port through which the user connects to the network from forwarding data packets until the user is authorized. A network login controller operates in conjunction with a user interface to receive a user identification data from the port user. The network login controller further operates in conjunction with an authorization server to authenticate the user by sending a user authentication request containing the user identification data to the authentication server. The network login controller grants or denies permission to the user to access the network based on the user authentication response from the authentication server. If permission is granted, then the network login controller unblocks the port through which the user is connected to place it in packet-forwarding mode. If permission is denied, then the port remains in packet non-forwarding mode (i.e. it remains blocked).

Claims

1. A method comprising:

blocking a port on a packet forwarding device to prevent a user connected to the port from sending and receiving data packets, the port belonging to a plurality of virtual local area networks (VLANs), wherein blocking comprises setting a port state of the port on the packet forwarding device to unauthorized for one or more of the plurality of VLANs to which it belongs;

generating an authentication Internet Protocol (IP) address capable of being used to authenticate the user connected to the blocked port from an endstation belonging to one of the plurality of VLANs for which the port is blocked;

authenticating the user connected to the port via the authentication IP address assigned to the user by an authentication server; and

in response to successfully authenticating the user, unblocking the port to enable the user to send and receive data packets, wherein unblocking comprises setting the port state of the port on the packet forwarding device to authorized for the VLAN to which the endstation belongs.

2. The method of claim 1, wherein authenticating comprises:

receiving a user identification data from the user connected to the port; and

verifying whether the user identification data is authentic.

3. The method of claim 2, wherein verifying comprises:

sending the user identification data to an authentication server; and

receiving an indication from the authentication server whether the user identification data is authentic.

4. The method of claim 3, wherein sending and receiving is performed in accordance with the Remote Authentication Dial-In Service (RADIUS) communication protocol.

5. The method of claim 1, further comprises assigning the unblocked port to a permanent VLAN.

6. The method of claim 5, further comprising:

assigning a temporary layer-3 address to the user when the port is blocked; and

assigning a permanent layer-3 address to the user when the port is unblocked.

7. The method of claim 6, wherein the temporary address is obtained from a first address server accessible to the packet forwarding device.

8. The method of claim 6, wherein the permanent address is obtained from a second address server accessible to the permanent VLAN to which the unblocked port is assigned.

9. The method of claim 7, wherein the first address server comprises a DHCP server.

10. The method of claim 9, wherein the DHCP server is located on the packet forwarding device.

11. The method of claim 8, wherein the second address server comprises a DHCP server.

12. An apparatus comprising:

a packet forwarding device coupled to the edge of a network, the packet forwarding device having a blocked port that prevents a user connected to the port from an endstation belonging to one of a plurality of virtual local area networks (VLANs) for which the port is blocked from accessing the network, the blocked port having a port state on the packet forwarding device of unauthorized for any one or more of the plurality of VLANs for which the port is blocked; and

a network login controller coupled to the packet forwarding device to unblock the port for the VLAN to which the endstation belongs when the user is authenticated so that the user can access the network, wherein the network login controller in conjunction with an address server provides the user an authentication Internet Protocol (IP) address with which to authenticate the user of the port before the user is authorized, and further wherein to unblock the port is to set the blocked port'"'"'s port state on the packet forwarding device to authorized for the VLAN to which the endstation belongs.

13. The apparatus of claim 12, wherein the user is authenticated when the network login controller receives a user identification data from the user connected to the port and verifies whether the user identification data is authentic.

14. The apparatus of claim 13, wherein the network login controller verifies whether the user identification data is authentic by sending the user identification data to an authentication server and receiving an indication from the authentication server whether the user identification data is authentic.

15. The apparatus of claim 14, wherein the sending and receiving is performed in accordance with the Remote Authentication Dial-In Service (RADIUS) communication protocol.

16. The apparatus of claim 12, wherein the network login controller is capable of assigning the unblocked port to a permanent VLAN.

17. The apparatus of claim 16 wherein the network login controller assigns a temporary layer-3 address to the user when the port is blocked and assigns a permanent layer-3 address to the user when the port is unblocked.

18. The apparatus of claim 17, wherein the temporary address is obtained from a first address server accessible to the packet forwarding device.

19. The apparatus of claim 17, wherein the permanent address is obtained from a second address server accessible to the permanent VLAN to which the unblocked port is assigned.

20. The apparatus of claim 18, wherein the first address server comprises a DHCP server.

21. The apparatus of claim 20, wherein the DHCP server is located on the packet forwarding device.

22. The apparatus of claim 19, wherein the second address server comprises a DHCP server.

23. The apparatus of claim 12, wherein the packet forwarding device additionally comprises an unblocked port that requires no authentication.

24. The apparatus of claim 12, wherein the blocked port prevents a first user connected to the port through a first VLAN from accessing the network but allows network access to a second user connected to the port through a second VLAN.

25. A network login authorization apparatus comprising:

a network device, coupled to the edge of a network, having a blocked port, the blocked port tagged as belonging to more than one virtual local area network (VLAN) and having a port state on the network device of unauthorized for each VLAN for which the port is blocked;

a network authentication server coupled to the network device, wherein the network authentication server provides user configuration data to configure the blocked port with an authentication Internet Protocol (IP) address for use by the network login authorization apparatus in authorizing users; and

a processor, coupled to the network device and the network authentication server, to perform instructions for unblocking the blocked port in response to a request through the authentication Internet Protocol (IP) address by a user connected to the blocked port from an endstation belonging to a VLAN for which the port is blocked to access the network, wherein the request is granted when a user identification entered by the user matches a corresponding user authentication data obtained from the network authentication server, and further wherein to perform instructions for unblocking the blocked port is to perform instructions for setting the blocked port'"'"'s port state on the network device, for the VLAN to which the endstation belongs, to authorized.