High-availability remote-authentication dial-in user service

• US 9,197,578 B2
• Filed: 12/23/2013
• Issued: 11/24/2015
• Est. Priority Date: 04/20/2007
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Tuvell, Walter, Tavakoli, Oliver, Porcher, Thomas C.
• Primary Examiner(s): Lee, Jae Y
• Assistant Examiner(s): PHAM, TITO Q
• Application Number:
  US14/139,261
• Publication Number:
  US 20140115160A1
• Time in Patent Office: 701 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols

Abstract

A method may include receiving, in a first server from a second server, a request for a service of a network by a device; sending, from the first server to the second server, a response to the request for the service to permit access to the service; and sending state information about the response to a third server for storage in a database.

Claims

1. A method comprising:

receiving, by a first device and from a second device, a request associated with a third device;

determining, by the first device, one or more restrictions associated with the third device based on the request,

the one or more restrictions including information identifying a period of time for a particular privilege;

determining, by the first device, to grant the request based on the information identifying the period of time for the particular privilege;

assigning, by the first device, a network address to the third device based on determining to grant the request;

causing, by the first device, a fourth device to update information identifying a time when a session is established with the third device based on the network address;

requesting, by the first device, a group of network addresses from the fourth device; and

receiving, by the first device and as the group of network addresses, unassigned addresses stored by the fourth device.

2. The method of claim 1, where the request is for the network address to be used to establish the session associated with the third device.

3. The method of claim 1, further comprising:

determining one or more privileges associated with the third device based on the request,

the one or more privileges including the particular privilege.

4. The method of claim 1, further comprising:

providing a response to the second device.

5. The method of claim 4, where the response indicates that the request should be granted.

6. The method of claim 4, where the response includes information identifying the network address.

7. The method of claim 1, further comprising:

causing the fourth device to update data regarding assigned network addresses based on assigning the network address to the third device.

8. A system comprising:

a processor to;

receive a request associated with a user device;

determine one or more restrictions associated with the user device based on the request,

the one or more restrictions including information identifying a period of time for a particular privilege;

determine to grant the request based on the information identifying the period of time for the particular privilege;

assign a network address to the user device based on determining to grant the request;

cause a server to update information identifying that a session is established with the user device based on the network address;

request a group of network addresses from the server; and

receive, as the group of network addresses, one or more addresses stored by the server,

the one or more addresses being different from the network address.

9. The system of claim 8, where, when receiving the request, the processor is to:

receive the request from a network access server (NAS).

10. The system of claim 8,

where the processor is further to:

notify a network database server (NDS) regarding the request after receiving the request, and

where the NDS includes the server.

11. The system of claim 8, where the processor is further to:

select the network address from a network address table that includes unassigned network addresses.

12. The system of claim 8, where the processor is further to:

determine that a network address table does not have any available network addresses; and

request the network address from the server based on determining that the network address table does not have any available network addresses.

13. The system of claim 8, further comprising:

update a network address table based on assigning the network address to the user device.

14. The system of claim 8, where, when causing the server to update the information, the processor is to:

notify the server regarding the request being granted and the network address being assigned.

15. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by at least one processor of a first device, cause the at least one processor to;

receive, from a second device, a request associated with a third device;

determine one or more restrictions associated with the third device based on the request,

the one or more restrictions including information identifying a period of time for a particular privilege;

determine to grant the request based on the information identifying the period of time for the particular privilege;

cause a fourth device to update information identifying that a session is established with the third device based on determining to grant the request;

request a group of network addresses from the fourth device; and

receive, as the group of network addresses, unassigned addresses of a plurality of addresses stored by the fourth device.

16. The non-transitory computer-readable medium of claim 15,

where the request includes a request for a network address to be used to establish the session with the third device, and

where the instructions further include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

assign the network address to the third device based on determining to grant the request.

17. The non-transitory computer-readable medium of claim 15,

where the request includes an authorization request by the third device to access a particular service, and

where the instructions further include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

provide information indicating that the authorization request has been granted for the third device to access the particular service.

18. The non-transitory computer-readable medium of claim 15,

where the request includes a request by the third device to access a particular application,

where the instructions further comprise:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

notify a network database server (NDS) regarding the request to access the particular application, and

where the NDS includes the fourth device.

19. The non-transitory computer-readable medium of claim 15, where the instructions further comprise:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

cause the fourth device to update information identifying an expiration time for the session.

20. The non-transitory computer-readable medium of claim 15, where the instructions further comprise:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

provide, to the second device, a response that indicates that the request should be granted and includes information identifying the network address.